this week, a new feature was merged into the NUT development tree: beside of the historical OpenSSL support (for more than 10 years), NUT now also provides SSL features using Mozilla NSS. I've already posted a lengthy mail on the NUT developers list. But there are still a few things to be told:

• for legal reasons, I won't detail, NUT (GPL v2+), can't be linked on OpenSSL without exiting from the 'main' Debian repository. Thus, NUT packages in Debian (and derivatives) don't provide NUT crypto features!

• to me, NSS has some advantages, compared to OpenSSL. Among these, NSS is distributed under 3 licenses, including GPL. So it will fix the situation for NUT in Debian! But there will be more things to come with NSS, such as client authentication, and more security for infrastructure power management.

• other distros (mainly Redhat and Suse) have attempted (and are still attempting) to consolidate crypto features, using NSS. Debian has not taken any decision on this topic though. NUT now offers the choice between OpenSSL and Mozilla NSS.

• NSS support will be officially available with NUT 2.8.0. There is currently no release date since we're committed to a features set, not a release date. Some would say Debian old school. Everything would be different with more manpower, as everywhere else in our Free land...

For the braves who want to test, here is a small procedure, adapted to Debian. We will use an existing installation, and overwrite upsd, upsmon, libupsclient and few more. Beware that it will obviously breaks the MD5 sums of your nut packages!

• install NUT, if it's not already done:

# apt-get install nut

• download the source snapshot, and uncompress it:

$ tar xzvf nut-trunk-r3751.tar.gz

• install NSS development files:

# apt-get install libnss3-dev 

• change to NUT source directory and configure it using --with-nss, to force using NSS. For Debian, the following flags are needed:

./configure --without-all --with-nss \
        --prefix=/ --sysconfdir=/etc/nut  \
        --with-statepath=/var/run/nut \
        --with-altpidpath=/var/run/nut \
        --with-drvpath=/lib/nut \
        --with-pidpath=/var/run/nut \
        --datadir=/usr/share/nut \
        --with-pkgconfig-dir=/usr/lib/pkgconfig \
        --with-user=nut --with-group=nut

• now compile and install:

$ make && make install

• refer to the documentation, NSS backend usage chapter, for detailed configuration and usage instructions.

• if you're looking for a nice user interface to manage your certificate, check Firefox Key Manager or Fedora nss-gui.

• Enjoy

Before concluding, here is the traditional thank you guys:

• Emilien Kia, who developed the NSS support in NUT,
• Fr d ric Boh , for the validation testing,
• Charles Lepple, for handling the merge from github to our Alioth Subversion repository,
• and Eaton for sponsoring this development.

As a conclusion, cryptography integration and usability is still not on par with other proprietary OS. I would love to see the crypto situation improving in Debian (and friends obviously). So this was just my 2 cents (nuts ;-)) to the cause... cheers,
-- Arno

My last post explained how I retrieved and corrected data from snapshot.debian.org so that dose3 was able to parse it. In this post I will cover some surprising results I found when using my tools on those Packages and Sources files from 2005 until today. For each pair of Packages and Sources files I did the following:

1. created a reduced distribution
2. calculated the dependency graph

I call a reduced distribution the smallest set of binary and source packages with the following properties:

• all source packages can be built with the available binary packages
• all binary packages are built from the available source packages

Creating a reduced distribution first, greatly increases the execution speed of my algorithms as it reduces the amount of binary and source packages by an order of magnitude while still preserving the dependency cycle situation of the core packages. In many cases, once the packages of a reduced distribution are available, all the rest of Debian can be compiled from them without any dependency cycles. As also mentioned in earlier posts, there is always one central, big strongly connected component (SCC) in the dependency graph. I am especially interested in how the size of the reduced distribution and the SCC change over time as both are an indication of:

• the amount of interdependencies between core packages
• the amount of dependency cycles in the dependency graph

Lets look at the plots I did from the data I gathered. The gray data points indicate that at that point in time, one or more of the core source packages (the ones in the reduced distribution) in Debian Sid was not compilable. This means that the resulting values cannot be fully trusted. But as it is mostly only a single source package that doesnt compile, it doesnt influence the overall result much and therefor I included them anyways. Red and green data points represent a fully successful run. The only thing that I do not yet understand is what happened in 2007... So while a potential porter in 2005 only had to look at a graph of 150 nodes, he now needs to solve a graph of nearly 1000 nodes. The amount of edges in the dependency graph grew even more dramatic from about 500 to over 8000 edges. While the dependency situation for Debian Sid in 2005 can easily be printed using xdot and visually solved, this in not possible anymore in 2012. While dependencies of only a few dozen source packages had to manually be dropped in 2005, now even dropping build dependencies from a few hundred source packages doesnt solve the dependency situation. So my assumption is, that due to a growing amount of interdependencies between source and binary packages (as both gain more features), bootstrapping Debian for a new architecture becomes harder over time. Is this also the perceived subjective impression of people that ported Debian in the past? If my assumption is correct, then there is a growing need for official support of droppable build dependencies (or "stage builds" or "profile builds") to break dependency cycles during the bootstrapping process. Work of a porter would be much easier if source packages would already contain information about what build dependencies can be dropped (if so needed). In the best case, a machine could use those annotations to calculate a build order automatically. As one can see in the graph above, there are currently 370 source packages in the main SCC. This means that no more than this amount of packages (but probably much less) have to be annotated to break the SCC into a directed acyclic graph. Discussion about what syntax to use to mark potentially droppable build dependencies currently happens in bug#661538 but should maybe be discussed by a wider audience. The currently favored solution was proposed in said bugreport by Guillem Jover and is called "build profiles". It has the advantage that it is not only trivial to implement (a patch exist for dpkg and dose3 already supports them) but would also be useful for other purposes like embedded builds. The format is similar to how architecture restrictions for individual dependencies are specified but uses "triangular brackets":

Build-Depends: huge (>= 1.0) [i386 arm] <!embedded !bootstrap>, tiny

The work Patrick McDermott did for his GSoC project over the summer already uses above syntax.

I ve just downloaded and installed the Debian AMD64 package of the Google Apache Pagespeed module [1]. To see if it worked I used the Google PageSpeed insights tool which gave my blog a rating of 93% (and 88% for mobile) [2]. After installing mod_pagespeed I received the same scores. So it appears that Pagespeed isn t doing any good according to Google s analysis! etbe.coker.com.au 10.11.12.13 - [13/Oct/2012:05:22:31 +0000] "GET /wp-content/plugins/openid/f/W.openid.css,qver=519.pagespeed.cf.Bbu1gxRjUE.css HTTP/1.0" 200 2165 "http://etbe.coker.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1" 0
etbe.coker.com.au 10.11.12.13 - [13/Oct/2012:05:22:31 +0000] "GET /wp-content/themes/atahualpa/js/DD_roundies.js,qver=0.0.2a.pagespeed.jm.4gw5yluag0.js HTTP/1.0" 200 3679 "http://etbe.coker.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1" 0
etbe.coker.com.au 10.11.12.13 - [13/Oct/2012:05:22:31 +0000] "GET /wp-includes/js/jquery/jquery.js,qver=1.7.2.pagespeed.jm.XZwfunyK-6.js HTTP/1.0" 200 33587 "http://etbe.coker.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1" 0
etbe.coker.com.au 10.11.12.13 - [13/Oct/2012:05:22:33 +0000] "GET /wp-content/themes/atahualpa/images/xlogo.png.pagespeed.ic.ICWmaHBME5.png HTTP/1.0" 200 2267 "http://etbe.coker.com.au/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1" 0 The above sample of web logs shows that the string pagespeed is appended to some URLs with a hash of the file contents which apparently allows much longer cache times without making it difficult to change content. So Pagespeed is obviously doing something. Is Google analysis expected to say that there is no change? Note that my speed scores are 93% and 88% so my site is was apparently quite good before mod_pagespeed was installed maybe the analysis would report a difference on a site that didn t perform so well. Now even if mod_pagespeed has given a benefit to real users but not Google tests it still means that I won t get the SEO benefits that Google apparently gives to fast sites. Also to make things even more exciting the W3.org HTML validator [3] now says that there s an error in my blog. So not only has mod_pagespeed failed to improve performance in a way that Google notices but it has also broken something!

• [1] https://developers.google.com/speed/pagespeed/mod
• [2] https://developers.google.com/speed/pagespeed/insights#url=etbe.coker.com.au&mobile=false
• [3] http://validator.w3.org/

Related posts:

1. More About Google Earth I recently wrote about problems with Google Earth [1]. In...
2. A Strange Attempt to Trick Google I just noticed that my post about LED Headlights in...
3. google-bank Currently many people have Google advertising on their web sites,...

When I wanted to use my dependency graph analysis tools to analyze earlier states of Debian Sid, I naturally used snapshot.debian.org to retrieve the Packages and Sources files from which my tools retrieve the dependency information. The problem is, that many of those Packages and Sources files contain syntax errors that make the dose3 parser choke. This leads to my tools being unable to parse the affected files. The following script does not only download all Packages and Sources files in a five day interval (4460 MB from 2005/03/12 to 2012/10/11) but also cleans all the syntax errors that were not parsable by dose3. This includes invalid version naming, architecture lists separated by commas, disjunctions in Conflict fields and incorrect braces/bracket usage. Maybe this helps others who also want to profit from Packages and Sources files from the past. Fun fact #1: starting from June 2010, there were no more syntax errors in the Packages and Sources files of Debian Sid. Fun fact #2: starting from December 2009, there are no more mismatches between versions of binary packages in the Packages file and the versions of the corresponding source packages in the Sources file. <script src="https://gist.github.com/3880904.js"> </script>

The Problem Some of my clients need systems that store reasonable amounts of data. This is enough data that we can expect some data corruption on disk such that traditional RAID doesn t work, that old fashioned filesystems like Ext3/4 will have unreasonable fsck fimes, and that the number of disks in a small server isn t enough. NetApp is a really good option for bulk reliable storage, but their products are very expensive. BTRFS has a lot of potential, but the currently released versions (as supported in distributions such as Debian/Wheezy) lack significant features. One significant lack in current BTRFS releases is something equivalent to the ZFS send/receive functionality for remote backups, this was a major factor when I analysed the options for hard drive based backup [1], and you should always think about backup before deploying a new system. Currently ZFS is the best choice for bulk storage which is reliable if you can t afford NetApp. Any storage system needs a minimum level of reliability if only to protect it s own metadata and a basic RAID array doesn t protect against media corruption with current data volumes. The combination of performance, lack of fsck (which is a performance feature), large storage support, backup, and significant real-world use makes ZFS a really good option. Now I need to get some servers for more than 8.1TiB of storage (the capacity of a RAID-Z array of 4*3TB disks). One of my clients needs significantly more, probably at least 10 disks in a RAID-Z array so none of the cheaper servers will do. Basically the issue that some of my clients are dealing with (and which I have to solve) is how to provide a relatively cheap ZFS system for storing reasonable amounts of data. For some systems I need to start with about 10 disks and be able to scale to 24 disks or more without excessive expense. Also to make things a little easier and cheaper 24*7 operation is not required, so instead of paying for hot-swap disks we can just schedule down-time outside business hours. The Problem with Dell Dell is really good for small systems, the PowerEdge tower servers that support 2*3.5 or 4*3.5 disks and which have space for an SSD or two are really affordable and easy to order. But even in the mid-size Dell tower servers (which are small by server standards) you have problems with just getting a few disks operating outside a RAID array [2]. The Dell online store is really great for small servers, any time I m buying a server for less than $2500 I check the Dell online store first and usually their price is good enough that there is no need to get a quote from another company. Unfortunately all the servers with bigger storage involve disks that are unreasonably expensive (it seems that Dell makes their profit on the parts) and prices are not available online. I gave my email address and phone number to the Dell web site on Wednesday and they haven t cared to get back to me yet. This is the type of service that makes me avoid IBM and HP for any server deployment where the Dell online store sells something suitable! BackBlaze For some time BackBlaze have been getting interest by describing how they store lots of data in a small amount of space by tightly stacking SATA disks. They don t think that ZFS on Linux is ready for production, but their hardware ideas are useful. They have recently described their latest architecture [3]. They describe it as 135TB for $7,384. Of course the 135TB number is based on the idea of getting the full 3TB capacity out of each disk which they can do as they have redundancy over multiple storage pods. But anyone who wants a single fileserver needs some internal redundancy to cover disk failure. One option might be to have three RAID-Z2 arrays of 15 disks which gives a usable capacity of 42*3TB==126TB==113TiB. Note that while the ZFS documentation recommends between 3 and 9 disks per zpool for performance I don t expect performance problems, when you only have a gigabit Ethernet connection there shouldn t be a problem with three ZFS zpools making the network the bottleneck. For this option the way to go would be to start with an array of 15 disks and then buy a second set of 15 disks when the first storage pool becomes full. It seems likely that 4TB disks will become cheap before a 35TiB array is filled so we can get more efficiency by delaying purchases. The BackBlaze pod isn t cheap, they are sold as a complete system without storage disks for $US5,395 by Protocase [4]. That gives a markup of $US3,411 over the BackBlaze cost which isn t too bad given that BackBlaze are quoting the insane bulk discount hardware prices that I could never get. Protocase also offer the case on it s own for anyone who wants to build a system around it. It seems like the better option is to buy the system from Protocase, but that would end up being over $6,000 when Australian import duty is added and probably close to $7,000 when shipping etc is included. Norco Norco offers a case that takes 24 hot-swap SATA/SAS disks and a regular PC motherboard for $US399 [5]. It s similar to the BackBlaze pod but smaller, cheaper, and there s no obvious option to buy a configured and tested system. 24 disks would allow two RAID-Z2 arrays of 12 disks, the first array could provide 27TiB and the second array could provide something bigger when new disks are released. SuperMicro SuperMicro has a range of storage servers that support from 12 to 36 disks [6]. They seem good, but I d have to deal with a reseller to buy them which would involve pain at best and at worst they wouldn t bother getting me a quote because I only want one server at a time. Conclusion Does anyone know of any other options for affordable systems suitable for running ZFS on SATA disks? Preferably ones that don t involve dealing with resellers. At the moment it seems that the best option is to get a Norco case and build my own system as I don t think that any of my clients needs the capacity of a BackBlaze pod at the moment. Supermicro seems good but I d have to deal with a reseller. In my experience the difference between the resellers of such computer systems and used car dealers is that used car dealers are happy to sell one car at a time and that every used car dealer at least knows how to drive. Also if you are an Australian reader of my blog and you want to build such storage servers to sell to my clients in Melbourne then I d be interested to see an offer. But please make sure that any such offer includes a reference to your contributions to the Linux community if you think I won t recognise your name. If you don t contribute then I probably don t want to do business with you. As an aside, I was recently at a camera store helping a client test a new DSLR when one of the store employees started telling me how good ZFS is for storing RAW images. I totally agree that ZFS is the best filesystem for storing large RAW files and this is what I am working on right now. But it s not the sort of advice I expect to receive at a camera store, not even one that caters to professional photographers.

• [1] http://etbe.coker.com.au/2012/08/08/hard-drives-backup/
• [2] http://etbe.coker.com.au/2012/08/01/cheap-sata-poweredge-t410/
• [3] http://blog.backblaze.com/2011/07/20/petabytes-on-a-budget-v2-0revealing-more-secrets/
• [4] http://protocase.com/products/index.php?e=Backblaze
• [5] http://www.norcotek.com/item_detail.php?categoryid=1&modelno=rpc-4224
• [6] http://www.supermicro.com/products/nfo/storage.cfm

Related posts:

1. Cheap SATA Disks in a Dell PowerEdge T410 A non-profit organisation I support has just bought a Dell...
2. ZFS vs BTRFS on Cheap Dell Servers I previously wrote about my first experiences with BTRFS [1]....
3. Flash Storage and Servers In the comments on my post about the Dell PowerEdge...

I've been continuing to work on Shim this week, and it's now getting pretty close to feature complete. The biggest change has been migrating the MokList variable from a custom format to the one used by the UEFI spec databases, which means it's easier for the kernel to import the MOK entries and use them for validating module signatures.

The other benefit of this format is that it supports hashes as well as certificates, and so I've added support for enrolling hashes through the MokManager UI. This means that distributions can now ship with a signed copy of Shim without having to sign any other components of their distribution. When the user attempts to boot off the media they'll be faced with a menu and a countdown. If the countdown reaches 0, the system will simply fall back to the next entry in the bootlist. If they hit a key, they can choose to enrol a hash. The user then navigates the filesystem explorer, chooses the bootloader, confirms that they want to enrol it and then exits. Shim then verifies the bootloader against the hash and boots successfully.

The big advantage of this over the Linux Foundation approach is that once a hash has been enrolled the need for physical end-user presence is removed - ie, if you enrol the hash, you don't need to hit a key every time you boot. This is still slightly sub-optimal in that if you update your bootloader you'll need to enrol a new hash, but that can be partially automated by calling MokUtil in the postinst - the user then simply needs to confirm that they want to enrol the hash, rather than having to choose it manually. Completely transparent updates are going to require a signed bootloader and an enrolled signing key.

A couple of people have asked whether we're planning on implementing the Linux Foundation approach of simply asking the user whether they want to boot an unsigned file. We've considered it, but at the moment are leaning towards "no" - it's simply too easy to use to trick naive users into running untrusted code. Users are trained to click through pretty much any security prompt that they see, and if an attacker replaces a legitimate bootloader with one that asks them to press "y" to make their computer work, they'll press "y". If that bootloader then launches a trojaned Windows bootloader that launches a trojaned Windows kernel, that's kind of a problem. This could be somewhat mitigated by limiting this feature to removable media, and we're seriously considering that, but there are still some risks associated. We might just end up writing the code but disabling it at build time, and then anyone who wants to distribute with that policy can do so at their own risk.

Meanwhile, Peter Jones is working on tidying up the code we're using for the actual signing and will be publishing that once the last couple of kinks are worked out. We're using hardware cryptography, so even if someone compromises the build systems they won't be able to obtain the private key that we use. However, should something disastrous and unanticipated happen, we do have a plan in place for migrating to new keys with minimal user impact. We'll document the code and infrastructure we're using in order to make it as easy as possible for other distributions to implement equivalent functionality.

As I've mentioned before, our goal is to make it as easy as possible for distributions to implement whatever level of Secure Boot policy they want without having to engage with Microsoft themselves. Shim allows distributions to ship an OS that has no signed binaries at all, or alternatively to ship an OS that uses filesystem-level cryptography to ensure that even userspace is completely signed. I'm expecting to see a range of options available, and I hope that the majority of users will find something to suit their needs.

comments

Automatically devising a build order that allows to bootstrap Debian, currently fails (amongst other reasons) because of the lack of metadata information about which build dependencies can potentially be dropped from source packages. If that information was available, an algorithm could decide which build dependencies to drop so that dependency cycles can be broken. Finding droppable build dependencies of a source package is something only humans can do. This is because it involves to manually analyze and test the build system of a source package. Build systems are neither uniform nor do they encode their dependencies in a way that can directly be mapped to Debian packages. Therefor they are not machine readable. One idea to solve the dilemma, is to find a Linux distribution that provides the following:

• allows to do "profile builds" of its source packages with different features enabled or disabled
• stores information about which feature requires which build dependency
• stores everything in a format that can be parsed and analyzed
• covers a similar range of software packages as Debian does

If such a distribution can be found then the information from it can be used to find dependencies that can also be dropped from Debian source packages. Gentoo is a distribution that fulfills above requirements through so called USE flags that allow to enable or disable features during compilation. Dependencies of Gentoo source packages are stored in .ebuild files that control the build process. Since .ebuild files are bash scripts, parsing them is not trivial. I therefor used the emerge software package to extract that information. Thanks to the well written emerge code and to quick help in the Gentoo IRC channel, it didnt take long to make the code run on Debian. My sourcecode is downloadable here: https://gitorious.org/debian-bootstrap/gen2deb Before I list the results of using Gentoo USE flags to determine dependencies that can potentially be dropped from Debian source packages, let me list the problems that this method entails.

Only package name matching, no version matching When writing the mapping from Debian to Gentoo packages and back I discard version information. There are just too many versions that either Debian or Gentoo have and are not present in the other. So the assumption is, that Debian Sid and Gentoo have both the most recent major versions of upstream software which has roughly the same requirements in terms of build dependencies.

Gentoo packages are matched to Debian source packages In Gentoo there are only source packages and no binary packages. So I map Gentoo packages to Debian source packages. But Gentoo source packages build depend on other source packages while Debian source packages depend on binary packages. So at some point I have to translate Gentoo packages to Debian source packages and those source packages to Debian binary packages. I do this by analyzing the original binary package build dependencies of a Debian source package and then filter out those binary packages as being droppable that are built by the Debian source packages that were found to be droppable.

Not the exact same package set There is some software that is only in Gentoo and some that is only in Debian. Debian and Gentoo also split some source packages differently.

Gentoo has more direct dependencies Many build dependencies in Debian are indirectly pulled in through dependencies of direct build dependencies. In Gentoo source packages directly depend on most things they need to build successfully. This leads to the list of dependencies in Gentoo to be much larger than the list of dependencies in the corresponding Debian source package. It also means that lots of dependencies that can be dropped in Gentoo are not found to be droppable in Debian because they are not direct dependencies of that source package.

There are no implicit dependencies Gentoo will often drop dependencies that are essential or build-essential packages in Debian and are therefor implicit build dependencies that cannot be dropped.

Result Despite the many problems, the result doesnt look too wrong. I got some Debian source packages that were found to have droppable build dependencies from Thorsten Glaser and all dependencies that Gentoo found to be droppable were also dropped by him. To put everything into numbers: the current 912 nodes big SCC in Debian Sid can be reduced to 6 individual SCC with 422, 5, 5, 3, 2 and 2 nodes each. So using Gentoo cuts the size of the central component to more than half. Surely, there will be a number of dependencies that were found to be droppable in Gentoo but are actually not droppable in Debian. The point is, that it is better to have "some" data even if it contains false positives than no data at all. It is easier for a human to verify if some suggested droppable build dependencies are actually correct than going through hundreds of source packages with thousands of dependencies manually.

Last weekend I was in Southwest Harbour, Maine again for the annual LTSP hackfest (called By The Sea). It s a fun and productive event and as always it s been good catching up with LTSP folk, even though we were missing Oliver, Alkis and Vagrant. Here is a summary of what I can recall from the discussions of the weekend Recent Happenings in LTSP

• New LTSP Website After a really long time, LTSP finally has a new website. It s a big improvement, there s a new success stories page and the wiki is now self-hosted.
• LTSP PNP - This is a new package (ltsp-pnp) that can safely be installed on existing machines to allow a user to log into an LTSP server using LDM.

Going Forward Social

• On Friday, Chuck Liebow took us out for a boat ride around the harbour on the Sea Princess

• On Saturday night we had the big lobster dinner as per BTS tradition (I had steak since I m not a big seafood person). We were to busy eating and telling stories to be taking any pictures
• And last but certainly not least, I finally met Eric Harrisson, who did a lot of work on K12-LTSP in the Portland schools district. He has an awesome hobby where he builds guitars out of well, almost anything he can find.
  He brought along one of the experimental guitars he slapped together recently and told me all about how it s put together. Even more amazing, he said I could have it! I was planning on getting an acoustic guitar anyway so I m very thrilled about it. Not only is it a completely unique guitar but it sounds great too. I m going to have to think of something to make back for him!

It was great seeing everyone again. I first started using LTSP around 9 years ago and never imagined back then that I d get to meet the people behind it. Ron Colcernian sourced us some really cool LTSP tops that you can see us wearing in the group photo. I hope to get to BTS again next year!

Just posted to d-d-a, bits from the DPL for Septemer 2012.

---

Heya,
here is the periodic report of DPL activities, this time related to September 2012 (posted here with some delay, as I've been traveling oversea on behalf of Debian for the past few days). Help needed: Google Code-In The Google Code-In (GCI) initiative is about to start again. We don't have a great track record of participating into it, and that's a pity. The initiative revolves around small tasks that other Free Software projects have come to call "easy hacks", showing how effective they're in attracting new volunteers. To participate, we need both mentors and admins. If you're interested see Ana's call for help and please volunteer on the soc-coordination list. Related to this, you've probably seen the report of our participation in GSoC 2012. I'd like to thank all students, mentors, and admins for a very well organized edition. Logo relicensing & other assets The DFSG-relicensing of the Debian logo, which I've mentioned in recent updates, has now happened. The so called Debian "Open Use" logo, in both variants (with and without "Debian") is now dually licensed under LGPL3+ / CC-BY-SA 3.0. The change has been made effective with a resolution of the SPI Board of Directors. Note that the so called "official" logo, which we seem to use very little, is still released under the terms of a non-free license. Discussion is ongoing on -project to stop promoting it. If you're using it or if you've arguments in favor of against that, please participate in the discussion. I've got from SFLC an updated draft of the new proposed trademark policy, implementing most of the changes requested during related August discussions on -project. I'll post it for review there shortly. The Japanese Trademark Office (JPO) has sent us the final confirmation that trademark transfer request (from individuals Debian contributors in the area to SPI) has happened. We've paid the needed fee of 457 CHF to conclude the transaction. We finally settled a domain transfer agreement with the current owner of the debian.eu. Technically, the domain will be transferred to FFIS in the coming weeks. Core teams (non-)news Quite some core teams are in the process of changing their formations these weeks, but most are still pending proper delegation (or equivalent). So here are just a few "teasers":

• as you might have read in the ftp-master sprint report, we have a new ftp-master: congrats Ansgar! (delegation update pending, but no suspense here)
• we have a new front-desk member (delegation pending + suspense)
• we have a new debian policy team (delegation pending + suspense)
• the tech-ctte is in the process of selecting a new candidate to fill the vacant seat. I've nominated a couple of candidates myself, and I'm now waiting for tech-ctte recommendations as per Constitution 6.2. On related news, the tech-ctte has now dealt with the conflict on Python interpreter maintenership, which was also the longest standing issue brought before them. Having invested quite some energy in that issue myself, I'm delighted to see it finally addressed.

I hope to finalize all the pending tasks above this month. Future events I've spent quite some time to plan my participation in events I'll be attending during October on behalf of Debian, such as the ACM Reflections conference in Urbana-Champaign (at the time of writing, this has already happened), the Ubuntu Developer Summit in Copenhagen, and the LinuxDay event in Turin. Cheers.

---

PS the day-to-day activity log for September 2012 is available at the usual place master:/srv/leader/news/bits-from-the-DPL.txt.201209

For those of you back at my university, you may have noticed I'm not there this semester.

Google's 2012 FEP team

I spent this past summer at Google, Inc, developing internal tools for the AdSense team, specifically Google Programmable Ads. Being at Google was great; I loved my team and my intern cohort, the rest of the interns in the Freshman Engineering Practicum.

I'm not currently at Google; my internship ended at the beginning of August. Although it was a blast, all good things must come to an end.

I'm not at Mason, either. I was super excited to return to university, and was just about to buy my books and get ready to move in when I got an email from a former coworker at Ksplice, a startup Oracle acquired while I interned there last year. He was starting a new company which would focus on business communications. I'd be working with a bunch of my former coworkers, and based on what I had heard of the company's plans I was confident in their ability to make an awesome product.

Needless to say, when they decided to offer me a position working there full time, I jumped on it.

From an academic point of view, Mason didn't really have much of a mechanism to support this. Co-ops are uncommon there, and not really supported for more than one semester; a full year away had never been done, according to our career services. My department was fully supportive, however, so we managed to find a way to make it work. This involved filling out some oddly-named forms, such as Special Registration for Graduation Request, which the registrar asserted was the right form, trust us on this one.

Myself and Obey Arthur Liu at a SIPB hackathon

But that's all neither here nor there. I'm now up in Cambridge, MA, working with awesome people (including but not limited to tabbott, wdaher, jesstess, and keegan), and exploring the city. I'm hanging out with MIT SIPB, helping with the maintenance of Sugar Labs' servers in E15 and spending more time working on various open source projects.

To my friends at Mason: I miss you all. I know regardless of how the next year+ turns out, it'll be one one hell of a ride.

The plan for supporting UEFI Secure Boot in Fedora is still pretty much as originally planned, but it's dependent upon building a binary which has the Fedora key embedded, and then getting that binary signed by Microsoft. Easy enough for us to do, but not necessarily practical for smaller distributions. There's a few possible solutions for them.

• Require that Secure Boot be disabled
  
  Not ideal. The UI for doing this is going to vary significantly between machines, making it difficult to document. It also means that the security benefits of Secure Boot are lost.
  
  
• Require that the machine be placed in Setup Mode
  
  Clearing the enrolled Platform Key results in the system transitioning into Setup Mode, and from then on new keys can be enrolled into the key database until a new Platform Key is enrolled. Distributions could ship an unsigned bootloader that then writes the distribution keys into the database - James Bottomley has an example here. This means that the distribution can still benefit from Secure Boot, but otherwise has the same downside that the UI for doing this will vary between machines.
  
  
• Ship with a signed bootloader that can add keys to its own database
  
  This is more interesting. Suse's bootloader design involves the bootloader having its own key database, distinct from those provided by the UEFI specification. The bootloader will execute any second stage bootloaders signed with a key in that database. Since the bootloader is in charge of its own key enrolment, the bootloader is free to impose its own policy - including enrolling new keys off a filesystem.

I've taken Suse's code for key management and merged it into my own shim tree with a few changes. The significant difference is a second stage bootloader signed with an untrusted key will cause a UI to appear, rather than simply refusing to boot. This will permit the user to then navigate the available filesystems, choose a key and indicate that they want to enrol it. From then on, the bootloader will trust binaries signed with that key.

Distributions are then able to take an existing signed copy of shim and put it on their install media, along with a file containing their key. If a user attempts to boot then the boot will fail because the second stage bootloader isn't signed with a trusted key, but the user can then use the navigator and select the distribution's key file. After providing confirmation and rebooting, the second stage bootloader's signature will now be recognised and the installer will boot.

This has the advantage over the first two options that the UI is consistent, making it easier to document the install process. The primary disadvantage is that the distribution won't be able to rebuild shim and will have to ship a pre-compiled binary. This may well be unacceptable to distributions like Debian, but should still provide a viable approach for other distributions who are either unwilling or unable to deal with Microsoft themselves.

comments

I've just made release 1.2 of Obnam, my backup program. The NEWS file entry:

• Added a note to --node-size that it only affects new B-trees. Thanks, Michael Brown.
• New obnam diff subcommand to show differences (added/removed/modified files) between two generations, by Peter Valdemar M rch.
• obnam backup now logs the names of files that are getting backed up at the INFO level rather than DEBUG.
• The command synopsises for backup, restore, and verify commands now make it clearer that Obnam only accepts directories, not individual files, as arguments. (For now.)
• The output from the show plugin can now be redirected with the --output=FILE option. Affected subcommands: clients, generations, genids, ls, diff, nagios-last-backup-age.

Bug fixes:

• Notify user of errors during backups.
• The SFTP plugin now manages to deal with repository paths starting with /~/ which already exist without crashing.
• Character and block device nodes are now restored correctly. Thanks to Martin Dummer for the bug report.
• The symmteric key for a toplevel repository directory is re-encrypted when a public key is added or removed to the toplevel using the add-key or remove-key subcommands.
• Manual page typo fix. Thanks, Steve Kemp.

This release has been uploaded to my own apt repository on code.liw.fi, for squeeze and unstable. Due to the Debian freeze, I am not uploading this to Debian at this time, though some changes may eventually be uploaded there.

It's been some time since I didn't write in this blog about my running activities. So let's make an update for my international friends. If you don't care about running, you can move to the next post in your feed reader..:-) After a quite busy running activity during DebConf 12 in Nicaragua, as well as during the touristic trip we did afterwards, I went back to my "regular" schedule. Main objectives in September-December are roughly the following:

• Seine-Eure marathon, the flattest marathon in France, on October 21st. This marathon is the one where I set the record which I just broke in June, in Caen. So, the goal is easy to find : break it again. My target time is around 3h37. Not so ambitious in apparence, with a current record at 3h38'45". However, I can't afford the highly meticulous preparation I did in April-May-June, so I try to stay with an achievable target.
• The Le Raid Le Puy-Firminy 70km night run on November 24th. Here, I'll just try to go faster than 9h15 which I achieved last year, trying to have a better race management and avoid cramps. Of course, meteorological conditions will be the key, here, as it can be as low as -15 C in that part of France, in November..:-)

During August, I broke my monthly distance record by running nearly 300km in one month, even achieving 100km in only 5 days, around 24th. That was one of my goals: improve my overall resistance to run repetitions, which is one of the keys for ultra-running. These were achieved with many runs to/back work, with up to 13km in the morning and the same in the evening. Yes, running 26km at about 11km/h (and with some ups and downs in the woods to make it even worse) on a day where one has a normal work activity is quite a challenge. September has been more focused on marathon preparation. This time, no complicated plan with interval running as the month was also a very busy work month, where fitting training sessions during the day would be hard. So, I made an easy plan : run a half-marathon every Sunday and run part of my work-home commute every day (So, 3km run to the train station, 30mn train ride, then 4km run to my work place, then shower....and the same back after work). Out of the 5 half-marathons I ran during these 5 Sundays, two of them were official ones. On the first one, I finally managed to break my personal best on half, with 1h37'14". Only a 14 seconds improvement, but that one is certainly one of my best among personal bests....even better than 3h38'45" on marathon.. All other half-marathons were run at marathon speed, so targeting 5'06"/km, which will be my planned pace on October 21st. The one I ran on Sept. 16th, which was the other official race I ran was finally done quite significantly faster than this. First of all, because I had hard times to run "only" at 5'06"/km because of other runners emulation. And also, because I ran the last 3 kilometers up to nearly 14km/h (so, down to 4'15"/km), just for fun, because I could do it..:-) With all this preparation, I think that I now manage to very well manage my marathon speed. I'll probably do a final test tomorrow by trying to keep running at this speed for 3 rounds of my favourite "Maurepas Marathon" circuit, which is just exactly 1/4 of a marathon. More "funnily", I also did something I never did before during this really crazy month : simply said, I came back from work by running. All the way long. Through woods, forests, along some lakes and finally in the country. 42 kilometers (yes, a marathon). After a work day. Starting at 5:45pm and arriving home after 4h50 minutes. With 2 hours of heavy rain. With 2.5 hours running in the dark (with my headlamp of course). All alone. That was a crazy bet to do....but really great fun achieving this : the GPS trace is here. Really something I have to do again..:-) So, well, now I'm more or less prepared and having fun is just a matter for time..:-). I'll keep you guys posted with those and, guess what? I'm already picking my target races for next year..:-)

Logging in into a Linux machine and executing the hundreds commands available is just one of the most common usages of OpenSSH. Another interesting and very useful usage is tunneling some specific (or even all) traffic from your local machine to an external machine you have access to. Today we ll analyze how to access a certain virtual machine s console by tunneling the relevant VNC port locally and accessing it through your favorite VNC client. The scenario:

1. Machine A is our main virtualization machine and hosts several virtual machines. (VMs)
2. Each VM has its own VNC port assigned. (usually the port range goes from 5900 to 5910 or even more if the hosted VMs are more than 10)
3. We ll be using libvirt, thus virsh.

We first need to find out which port got assigned to the VM we want to have console access to:

sudo virsh
virsh # list
Id   Name   Status
----------------------------------------------------
5    foo    running
6    bar    running
7    foobar running
virsh # vncdisplay foobar
:3

We, then, create a tunnel which redirects all the traffic from the main virtualization machine s port to the port we gonna specify in the next command:

ssh -f -N -L 5910:localhost:5903 user@machine-A.com

A few details about the previous command:

1. -N tells SSH to not execute any command after logging in.
2. -f tells SSH to hide into the background just before the command gets executed.
3. -L enables the port forwarding between the local (client) host and the host on the remote side.

And why did I choose respectively port 5903 and 5910? While you can adjust port 5910 with your own choice (that will just move the tunneled traffic from port 5910 to your favorite port), that won t work as expected with port 5903 since each VNC port is binded to the number of display virsh assigned to it. (for example, the bar VM may be running on display 5, thus its vncdisplay port will be 5905) When done, fire up your favorite VNC client and create a new connection with the following details:

Protocol: VNC - Virtual Network Computing
Server: localhost - 127.0.0.1
Port: 5910

The connection will load and you ll be put in front of your foobar VM console.

Logging in into a Linux machine and executing the hundreds commands available is just one of the most common usages of OpenSSH. Another interesting and very useful usage is tunneling some specific (or even all) traffic from your local machine to an external machine you have access to. Today we ll analyze how to access a certain virtual machine s console by tunneling the relevant VNC port locally and accessing it through your favorite VNC client. The scenario:

1. Machine A is our main virtualization machine and hosts several virtual machines. (VMs)
2. Each VM has its own VNC port assigned. (usually the port range goes from 5900 to 5910 or even more if the hosted VMs are more than 10)
3. We ll be using libvirt, thus virsh.

We first need to find out which port got assigned to the VM we want to have console access to:

sudo virsh
virsh # list
Id   Name   Status
----------------------------------------------------
5    foo    running
6    bar    running
7    foobar running
virsh # vncdisplay foobar
:3

We, then, create a tunnel which redirects all the traffic from the main virtualization machine s port to the port we gonna specify in the next command:

ssh -f -N -L 5910:localhost:5903 user@machine-A.com

A few details about the previous command:

1. -N tells SSH to not execute any command after logging in.
2. -f tells SSH to hide into the background just before the command gets executed.
3. -L enables the port forwarding between the local (client) host and the host on the remote side.

And why did I choose respectively port 5903 and 5910? While you can adjust port 5910 with your own choice (that will just move the tunneled traffic from port 5910 to your favorite port), that won t work as expected with port 5903 since each VNC port is binded to the number of display virsh assigned to it. (for example, the bar VM may be running on display 5, thus its vncdisplay port will be 5905) When done, fire up your favorite VNC client and create a new connection with the following details:

Protocol: VNC - Virtual Network Computing
Server: localhost - 127.0.0.1
Port: 5910

The connection will load and you ll be put in front of your foobar VM console.

This is my monthly summary of my Debian related activities. If you re among the people who made a donation to support my work (1086.48 , thanks everybody!), then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. Dpkg I am subscribed to Launchpad s dpkg bug tracker and I was getting annoyed with the amount of noise I got under the form of bug reports that look like package foo failed to install/upgrade: package foo is already installed and configured . Those reports are a combination of a bug in APT and of random other failures (often hardware related like corrupted .deb files, or I/O errors, but sometimes also real problems in other packages) but they always end up assigned on dpkg (because dpkg is outputting an error message complaining about APT s decision to configure something that doesn t have to be configured). I simply don t have the time required to manually process and inspect all those reports, so I decided to filter them at the apport level with a new Ubuntu bug pattern that indicates that those reports are a duplicate of LP#541595. Thanks to this, the dpkg bug count quickly went down from 130 to about 80. Packaging I sponsored a new upstream version of ledgersmb. I quickly updated WordPress to version 3.4.2 since it contains security relevant fixes. I also pushed a small update of nautilus-dropbox fixing #686863 because upstream renamed the binary package that they hand out on their website from nautilus-dropbox to dropbox. Their dropbox package only conflicts with old versions of nautilus-dropbox and not with the version that Debian is shipping and thus I had to add a Conflicts on our side to forbid co-installation of both packages. Testing wheezy s installation I bought a new laptop (Lenovo Thinkpad X230) and used this as an excuse to test Wheezy s installation process. It worked mostly fine except for two things:

1. First I noticed that it would not accept my passphrase for my encrypted partition during early boot this turned out to be already reported as #619711 but was no longer getting any attention from the package maintainer. After some IRC discussion with Julien Cristau, we prodded Michael Prokop who had apparently already offered to take care of this issue. I tested his updated package and the result got quickly uploaded.
2. I had weird networking problems that turned out to be related to the lack of the loopback network (i.e. on localhost). This was the result of a broken /etc/network/interfaces: it had been incorrectly modified by NetworkManager. I reported this in #688355. This issue affects people with IPv6 enabled networks.

Debian France There s a resurgence of activity in Debian France. Sylvestre Ledru is leading the organization of a mini-debconf in Paris on November 24-25th. And Tanguy Ortolo is now taking care of some merchandising (Polo shirts, to change from the usual T-Shirt). I might give a talk during this mini-debconf, possibly about multi-arch. Misc It s been a few months that I noticed a 2 second lag of gnome-shell everytime that smuxi (my IRC client) sent a notification. It s very annoying, you have the impression that the entire machine freezes. So I contacted Mirco Bauer on #smuxi and we investigated a bit. It turns out that smuxi is using an old version of the notification protocol where the picture is sent as a bytestream leading to huge dbus messages. This is clearly sub-optimal so smuxi will be fixed to be able to send the path of the picture instead of the picture itself. On the other hand, it s really a bug of gnome-shell that it freezes during the time it takes to handle the bigger-than-usual dbus message. So I also filed a bug on GNOME Shell (Bugzilla #683829) to get this fixed. Librement: funding free software work I started a new project with the goal of helping free software developers to fund their free software work. It s still mostly vaporware for now but I have a public code repository, a nice logo and lots of ideas. If the topic is of interest to you, and you d like to be involved, feel free to get in touch. Otherwise stay tuned. Thanks See you next month for a new summary of my activities.

4 comments Liked this article? Click here. My blog is Flattr-enabled.

It's important to back things up. You should also make your life easier by using some good software. I use obnam for some backups, but I wanted to try out bup for a new backup workflow I needed. I will describe the workflow here.The situation: I have a laptop with things to be backed up. I also have a Raspberry Pi which I use as a network attached storage (it has a 1 TB external drive attached to it) and runs Raspbian Wheezy on it. Naturally, you can do this on any NAS running some GNU/Linux variant. In addition, I also have an external portable USB hard disk where another backup copy will be stored. How do I automate this?Here is how I went about this process. First, for the Raspberry Pi:

1. First, identify the directory or directories to be backed up. To keep this simple, the directory I am backing up is /home/kumar/Work.
2. On the Raspberry Pi, install bup. If you want to build it from the git clone, you would need python-dev, and pandoc for the documentation.

   sudo aptitude install pandoc python-dev
   git clone git://github.com/apenwarr/bup.git
   cd bup;make;sudo make install
   

3. Initialize the backup directory on the Raspberry Pi:

   BUP_DIR=/home/kumar/BACKUPS bup init

   BACKUPS is the place where bup is asked to store the backups (much like it's analogue of .git). You can store all your backups within this directory, and you can still classify backup sets within this directory with different names (much like git branches).
4. On the local machine, initialize the backup directory.

   bup index -uv /home/kumar/Work

5. Back it up. This will take time the first time, if the Work directory has several contents within it.

   bup save -r kumar@<raspberry_pi_ip_address>:BACKUPS -n workbackup /home/kumar/Work
   

   workbackup is the name of the backup set. This can be paperbackup or databackup or notesbackup so that several classes can be backed up within the BACKUPS directory.
6. Now, you have backed things up. Make changes in the Work directory. For instance, add/edit/remove/move some files.
7. Rerun the index and save commands from steps 4 and 5 above. Enjoy the speedup and ability to rewind to the previous state.
8. Test restoration of ONE directory of backup (just to save time) on Pi itself directly on the Pi:

   bup -d /home/kumar/BACKUPS/ restore -C /tmp/ /workbackup/latest/home/kumar/Work/offset-coupling-params
   

   Then scp it back if you need it.
9. Alternative: Use fuse. On the Pi:

   sudo aptitude install python-fuse
   sudo adduser kumar fuse
   mkdir Mount
   bup -d /home/kumar/BACKUPS fuse Mount
   Then cd into Mount and cp/scp the correct files wherever.
   fusermount -u Mount
   

10. Once happy, write the bup index/bup save commands into a script and run it periodically to back up (check this at the end of the post). Have fun.

Next, to prepare the external hard disk, I went with the old-style autofs automounting solution:

1. To automount the disk, in /etc/auto.master, add

   /auto			/etc/auto.misc	--timeout=60
   

2. In /etc/auto.misc add:

   backupdrive	-fstype=btrfs	:UUID="7927a7ab-8c3f-4198-bd73-d3cc519a9ac3"
   

   fstype may need changing for your file system, and UUID can be found using blkid on the exact partition of the hard disk you wish to back up to.
3. Initialize the backup directory:

   sudo mkdir /auto/backupdrive/BACKUPS
   sudo chown kumar.kumar /auto/backupdrive/BACKUPS
   bup -d /auto/backupdrive/BACKUPS/ init
   

4. Index and back up:

   bup -d /auto/backupdrive/BACKUPS/ index -uv /home/kumar/Work
   bup -d /auto/backupdrive/BACKUPS/ save -n workbackup /home/kumar/Work
   

5. Make changes in the Work directory. Add/edit/remove/move files.
6. Rerun index and save commands from step 5. Enjoy the speed.
7. Test restoration of ONE directory of backup from removable disk:

   bup -d /auto/backupdrive/BACKUPS/ restore -C /tmp/ /workbackup/latest/home/kumar/Work/offset-coupling-params
   

8. Once happy, write the bup index/bup save commands into a script and run it periodically to back up. Have fun.

Finally, a quick script to automate all of the above.

#!/bin/sh
bup index -u /home/kumar/Work
bup save -r kumar@<raspberry_pi_ip_address>:BACKUPS -n workbackup /home/kumar/Work
if ls /auto/backupdrive/ 2> /dev/null;then
    echo Backing up to the removable disk...
    bup -d /auto/backupdrive/BACKUPS/ index -u /home/kumar/Work
    bup -d /auto/backupdrive/BACKUPS/ save -n workbackup /home/kumar/Work
    echo Backed up to the removable disk! Yay!
else
    echo WARNING: Not backing up to the removable disk
fi

What this script does it, it backs up to the NAS, and then checks if the external disk is connected. If the disk is mounted, then it backs up to that disk as well. It might be a good idea to cron or anacron this script, or have someone remind you to run this periodically. The only limitation I have is that you can't use bup restore to restore from a remote repository yet, but that isn't a huge issue for me now. In addition, metadata is not stored by the bup save/restore commands. You would have to use split and join with tar to get that. However, bup is fast moving, so I'd expect these features soon. Till then, this workflow works all right for data only backups.Although this is just a mental dump of the procedure I made for myself, suggestions for improvement are welcome. Thanks.

Is Asperger Syndrome a Disability? Some people tell me that I m disabled. Usually it s an unstated implication such as referring to Asperger Syndrome as a disability with the assumption that I ll agree. One time I had someone assume that I had never had a paid job because they knew I m an Aspie, maybe I should boast more about my career successes. One interesting take on this is represented by Maco s bost about Disablism/Ablism where she says Vocab note: A person has an impairment. Society s treatment of that impairment is what disables the person [1]. The same concept is presented by BRAINHE in their Social Model of Disability document [2]. The Wikipedia page on Ableism says The ableist worldview holds that disability is an error, a mistake, or a failing, rather than a simple consequence of human diversity, akin to race, ethnicity, sexual orientation or gender [3]. This is fairly close to the position that Neurodiversity [4] advocates take on Autism. Jaarsma P and Welin S wrote an interesting paper titled Autism as a Natural Human Variation: Reflections on the Claims of the Neurodiversity Movement [5] which considers these issues in depth and comes to the conclusion that High Functioning Autism (for which Asperger Syndrome is generally regarded as a synonym) is a difference while Low Functioning Autism is a disability. I think that generally we should accept the opinion of the person in question. Someone who is unable to communicate or is too young to make an informed decision could have their disability status determined by carers. But anyone who is capable of making an informed decision and communicating it should have their opinion respected. I am not going to argue with any of the people who claim that they are disabled due to an Autism Spectrum Disorder. But I don t think that I am disabled and I think that people shouldn t argue with me about this. Over Pathologising Lynne Soraya wrote an interesting article for Psychology Today about one aspect of the supposed over-diagnosis [6]. She responds to Paul Steinberg, a psychiatrist who made a number of claims about Asperger Syndrome which lack evidence. Paul s main idea seems to be that anyone who has social problems but who seems to be successful regardless shouldn t have an Autism Spectrum diagnosis and he claims that such people should be regarded as having a social disability instead. His main idea seems to be that having a diagnosis is a bad thing, but his idea of having a social disability diagnosis instead doesn t seem so great. In many other discussions I ve seen people claim that a large number of diagnosis of anything is a problem. Their idea seems to be that the vast majority of the population shouldn t have a diagnosis for anything and that whenever a significant number of people are diagnosed with a psychological condition (and 1% of the population seems to be a significant number) then it s a problem. I don t think that having a large portion of the population diagnosed is necessarily a problem, I think that it would be OK if the majority of the population was diagnosed with something. The issue is not whether people are diagnosed but what happens after the diagnosis. When a child is diagnosed their parents can help them deal with whatever the issues are this may or may not require further involvement with psychologists or special schools. For the milder cases (of Autism, ADHD, and other conditions) merely knowing what areas will cause difficulty and teaching kids how to deal with them will be enough to solve many problems. When someone is diagnosed as a child but doesn t have obvious symptoms as an adult that is more likely to be an indication that they were taught good coping mechanisms and protected from bad situations as a child not that the diagnosis was wrong. There are some serious issues with special schools and psychiatric drugs, but diagnosis doesn t necessarily imply mistreatment and avoiding a diagnosis is not the correct way to avoid such mistreatment. When someone is diagnosed as an adult they have to learn to deal with it. The general lack of psychologists (waiting times as long as 6 months are common) and the fact that most psychologists won t do any good for someone on the Autism Spectrum is a real problem. But merely knowing the source of your problems is a major step towards alleviating or solving them. One of the arguments that is commonly used against so-called over-diagnosis is that adults don t show apparent symptoms. The issue here is that with some effort and planning adults on the spectrum can act like NTs. Acting like an NT doesn t imply being an NT, it usually requires a lot of ongoing effort that could be applied to other things if society didn t expect us to act like NTs all the time. Conclusion I wish people would stop telling me that I m either disabled or too high functioning to be on the Autism Spectrum. I will never think like an NT and I don t want to, so I ll always be an Aspie. By most objective measures I m at least as successful as the general population in all things that require social skills, so unless something like always losing at Poker is considered a disability I don t think that it s reasonable to consider me to be disabled. It would be nice if I could lock the people who claim that Autism is always a disability in a room with the people who think it s over-diagnosed and let them debate it, no matter which side lost the debate the result would be good! Update: I removed a broken link to a Youtube video, I published this post from a 3G connection and didn t test that the Youtube link still worked. For some reason the author had marked it private since the last time I visited it.

• [1] http://ubuntulinuxtipstricks.blogspot.com.au/2011/05/blogging-against-disablism-day-asl.html
• [2] http://www.brainhe.com/TheSocialModelofDisabilityText.html
• [3] http://en.wikipedia.org/wiki/Ableism
• [4] http://en.wikipedia.org/wiki/Neurodiversity
• [5] http://www.imh.liu.se/avd_halsa_samhalle/filarkiv1/1.264263/JaarsmaWelin2011Autismasanaturalvariation.pdf
• [6] http://www.psychologytoday.com/blog/aspergers-diary/201202/is-aspergers-overdiagnosed

Related posts:

1. Autism vs Asperger Syndrome Diagnostic Changes for Autism Spectrum Disorders Currently Asperger Syndrome (AS)...
2. Is Asperger Syndrome a Good Thing? A meme that keeps going around is that Asperger Syndrome...
3. Autism Awareness and the Free Software Community It s Autism Awareness Month April is Autism Awareness month, there...

It appears that a recent incident at a different campus of the "preschool" (I call it day care) that Zoe goes to has gotten the attention of the Free-Range Kids blog. Firstly, I need to say that on the parenting spectrum, I definitely self-identify closer to the free-range end than the helicopter end. I'm not sure that I'd let an 8 year old ride the New York subway on their own, but Zoe's not 8 yet, so I really can't say. Sarah and I received the same email that is reprinted on the blog, on Friday night, and we were both (very) mildly alarmed at the situation, but not particularly concerned, mostly because it wasn't the facility that Zoe goes to. I'm not sure I'd be that much more concerned if it was, to be honest. I did like the statistics that the parent quoted in response. I thought that that put things into perspective, but didn't really take abductions by estranged parents into consideration. My one reaction to reading the email was, "why did they wait until after the incident to escalate it?" but then, from my own experiences in dropping off or picking up Zoe, I could totally understand not all the staff knowing on sight all the parents or guardians that do pickups and drop offs. This does lead to one asking how they know who to buzz in, but that's another can of worms. Anyway, I read the 50 or so varyingly indignant comments on the Free Range Kids blog, and since they were talking about the company that I give a not inconsequential amount of money to, I feel the need to write a response.

• it's a day care centre "chain". They have kids ranging from infant to pre-K (if I'm getting my grade terminology correct). It's not what I'd call a "school", hence they call themselves a "preschool"
• having actually been to one of the facilities, I can understand the request to not mingle in the lobby. It's tiny, and it blocks the view of the doors from the front office, where an employee is usually buzzing people in from
• I can totally understand the desire by the staff to not hold the door open for other people, even if we "know" them, because of possible changes in family circumstances. I would say that there's a difference between knowing someone by sight, because they're always dropping off or picking up their kid at the same time as you are, and knowing their name, where they live, etc. Having done pickups and drop offs, there are parents in both categories. I'll still hold the door open for a parent that we socialise with outside of "school", but I'll think twice now before doing it for someone who only looks familiar but I don't really know. I don't want to be the one who facilitates a future incident
• I think a lot of the conservative position the day care management has stems from liability. I have no problem with that. If the shoe was on the other foot, and an estranged parent had walked in and taken their child, and the centre had a "locked door" policy, there'd be some uncomfortable questions to answer. I'm paying them a boatload of money, they say they operate under a "locked door" policy, I expect them to keep my kid safe

The whole episode raises the question: who was this person and what were they doing there? Some of the commentators hypothesize that they were casing the joint for a future incident, or just giving themselves an impromptu tour before placing their child there (Zoe and I toured before we signed up, but that was an official, prearranged thing). It really is unfortunate that the staff didn't challenge this person, but as I said, they probably all had to review the video surveillance footage together to ascertain that none of them knew who the person was. I consider this a bit of a deficiency itself, but I don't really expect them to all have photographic memory, especially if one parent mostly does drop off and pick up. The other (expensive) option would be to issue each authorized person with an electronically revocable proximity card, so they can let themselves in, but I feel that that's taking things to the extreme. They staff all carry portable radios. If they don't have a discreet "code" they can call when one of them sees a person they don't know, I'm sure they will have after this incident. I personally found the majority of the comments on the Free Range Kids blog to be on the extreme overreaction side of things. As much as I'm a believer in Free Range parenting, I think the day care provider has mostly reacted appropriately. Do I agree with their "locked facility" policy? It's my first experience with a commercial day care facility, so I don't have anything to compare it with. As I said earlier, I can totally understand where they're coming from in terms of limiting their liability. Previously, Zoe was in a "home day care" facility, without any locks, and I for one wasn't constantly worrying about someone wandering into that provider's home and abducting my daughter, so I guess the whole "locked facility" thing is on the more extreme end of the scale for me in the first place, but like I said, I'm uncalibrated for commercial day care centres. I'd certainly like to see the primary school environment that Zoe goes to not be such a locked down affair.

Well this weeks log comes bit late as my week got extended till today ;-). I had working day at office on Saturday and Sunday due to 2nd Quarter end and instead today is declared as compensatory holiday and tomorrow any how is Gandhi Jayanti. So here it goes. Debian Related Most of my work this week was done for Debian-IN team

• Integrated the KGB bot for Debian-IN team repository. Thanks to gregoa Tincho and dam for extending helping hand in getting it configured
• Updated the setup-repository to install a proper post-receive hook when creating new repositories.
• Copied the set-git-hook from pkg-ruby-extras team and modified it slightly to install post-receive hook for KGB integration for already existing repository. With this script I fixed few of the packages to use KGB which I own. Waiting for Kartik to fix remaining repositories as he is the DD for our team :-)
• Configured my personal instance of KGB which now stands in Debian-IN's channel (#debian-in). But bot is named RAW (Research and Analysis Wing) equivalaent of KGB and CIA in India :-P

Well most of this weeks work involved KGB ;-) Personal Works

• Attended the PyconIndia-2012 on Saturday, Got a NFC card :-) which I can't use as my phone is not NFC capable. Only handful of talks were nice rest were all newbie like talk which even lacked proper presentation skills hence didn't attend on second day. Looks like quality of conference in India is decreasing.
• Finally completed answering all questions on Philosophy and Procedures - 1 part of NM process :-). Phew it took me more time than I expected. Waiting for my AM's comment. Hopefully I will get next bunch of questions soon :-)

Misc Played Cricket after very long time (Guess after 10 long years). Well it was not official match or anything it was just another Gully Cricket. After the match it came to mind that I need regular physical workout :-P. Well that's it Cya till next week :-)