I've been feeling like I've been neglecting Lintian, but actually, looking at the changelog, I've been doing about a release a month for the last several months. So it's more that a release a month isn't keeping up, quite, with the influx of bugs these days. To think I'd gotten it down to about 80 open bugs earlier this year.... Anyway, this release is almost entirely BTS cleanup, with no large changes or structural work. I think I knocked around 30-35 bugs off the list, which should get us down to somewhere in the 120 range. There's still some work to do to get under 100 again. There are lots and lots of little changes, mostly cleaning up false positives. The main new test additions are a bunch of new init script checks from Raphael Geissert and the extension of various script checks to example scripts, thanks to Damyan Ivanov. This should take care of nearly all the normal bugs and the easy minor bugs, but there are still a ton of wishlist bugs asking for new checks or expansions of existing checks. If anyone out there feels like poking at some fairly straightforward Perl code, I always try to make time to discuss possible approaches to implementing wishlist requests.

There will be an EU crackdown on websites selling consumer electronic goods which is entirely understandable when 203 out of 369 sites appeared to break the law. (first seen on BBC News) If you re a shop owner, the good site and bad site examples are pretty good, while local trading standards offices advise on selling online. If you re a buyer, see my guide on How to Check Web Shops for Basic Security. Why is it so bad? Do companies not understand the law? Do they not bother to check the law? Do they deliberately decide to ignore it? Don t customers prefer law-abiding web shops, or are low prices attractive enough to overcome that?

A while ago, I thought: I seem to be less productive than I used to be. Why might that be? Do I spend more and more time with e-Mails? Or is it something else? I couldn t tell, so I needed a time tracking tool. There are a few of those for Linux that allow you, while working, specify what you are doing and then generate statistics about it. This approach has a few disadvantages:

• It is distracting (and I want to increase productivity).
• You can only record one kind of information. So either, you record what you are doing (writing e-Mails, surfing the web, programming), or why you are doing it (work, study, leisure). You can not easily record both.
• If you are lazy and don t keep updating it, the statistics will be useless.
• You won t be able to catch a little thing like quickly answering an e-Mail or looking for the weather report.

So I created arbtt, the Automatic Rule-Based Time Tracker. It comes with a background program that is started with your desktop session and will, each minute, record what windows are open, which one is active, what their titles and corresponding programs are. It also checks how long the user has been idle. No interaction required, no distraction possible. This information is stored in a log file. A separate tool allows the user to investigate this data. It is called rule-based because the mapping from the raw data to sensible tags that give information about the time sample is specified by a simple, but hopefully sufficiently powerful language.A simple example for a rule that indicates the currently used program would be:

tag Program:$current.program,

The prefix Program: is a category. Arbtt will ensure that for each time sample and category, at most one tag is specified. A more complex rule is

current window $title =~ m!(?:~ home/jojo)/projekte/(?:programming/(?:haskell/)?)?([^/)]*)!
  ==> tag Project:$1,

which makes use of the fact that both GVim and gnome-terminal display the full path to the currently edited file resp. to the working directory in the window title. This rule will track all my projects separately, and even automatically pick up new projects when they appear! You can see more rules in the example file.The statistics program then allows you to query the tags with some options:

Usage: arbtt-stats [OPTIONS...]
  -h, -?  --help  show this help
  -V  --version  show the version number
  -x TAG  --exclude=TAG  ignore samples containing this tag
  -o TAG  --only=TAG  only consider samples containing this tag
  --also-inactive  include samples with the tag "inactive"
  -m PERC  --min-percentage=PERC  do not show tags with a percentage lower than PERC% (default: 1)
  -i  --information  show general statistics about the data
  -t  --total-time  show total time for each tag
  -c CATEGORY  --category=CATEGORY  show statistics about category CATEGORY

For example, if I want to know what folders I have open while using evolution, I can run arbtt-stats -o Program:evolution -c Evo-Folder -m 3 to see this:

Statistics for category Evo-Folder
==================================
                                 Time Percentage
=========================++======================
      Evo-Folder:Eingang    22h20m00s      17.0%
     Evo-Folder:Bekannte    16h40m00s      12.7%
    Evo-Folder:d-haskell     9h40m00s       7.4%
       Evo-Folder:Itomig     8h20m00s       6.4%
   Evo-Folder:Verschickt     7h40m00s       5.8%
Evo-Folder:pkg-fso-maint     7h00m00s       5.3%
         Evo-Folder:Bugs     6h00m00s       4.6%
Evo-Folder:planet debian     4h00m00s       3.0%
    (60 entries omitted)     4h49m00s      36.7%
        (unmatched time)        8m00s       1.0%

One big advantage of this approach is that you do not need to know in advance what queries you are interested in. Since the rules are applied when you are evaluating your data, and not when recording it, you can add more tags and forgotten special cases later.At this point, a big warning is due: This program will record a lot of very sensitive information about you. Be aware of this before you start using arbtt, and make sure you protect your data. You can get rid of all logs by deleting ~/.arbtt/capture.log.I have published arbtt on hackage. If you have cabal-install installed, you can install it with cabal install arbtt. See the README file for more information about setting it up. Depending on the feedback I get I will also consider packaging it for Debian.If you want to contribute, you are very welcome. The code is available at the darcs repository http://darcs.nomeata.de/arbtt/ (DarcsWeb). See the README for some ideas what to implement and feel free to come up with new ideas.

With the vrms meme raging on Planet Ubuntu, I noticed some people still have sun-java6 installed. I ve been using openjdk-6 since Hardy, and everything I use works fine with it (e.g. Vuze, Catan, Eclipse, FreeMind, and even Facebook s photo uploader thing). Given the Ubuntu Tech Board s remove sun-java6 from the archive Agenda item, it s possible sun-java6 (being redundant and orphaned) would go away in Ubuntu Karmic (sun-java5 is already gone because Sun will drop support for it in October, and sun-java6 is not far behind). I ve heard some noises about openjdk-6 not working for people, but I haven t actually seen any direct technical evidence of something working in one and not the other. Seeing as Jaunty s OpenJDK was certified by Sun, it would be very interesting to find failures, as this would indicate that Sun s certifications are missing something. Looking for examples of failures in Google, I couldn t find anything with obvious test-cases that failed with openjdk-6. I suspect I m just not trying hard enough, but I m curious what other people have run into. Test for yourself:

sudo apt-get purge sun-java6-jdk sun-java6-jre sun-java6-bin sun-java6-plugin
sudo apt-get install openjdk-6-jdk icedtea6-plugin

(Don t forget to restart your browser.)

---

*whew* I did a bunch of things yesterday. We took our kinderg rtner to her first Friday at her new school (and were about 10 minutes tardy. oops). We then took our toddler to a nearby playground with swings and slides and let her expend some energy. After she had been sufficiently exercised, we walked back home, stopping at a coffee shop on the way. The baristo (you call male baristas baristos, right? :) ) recognized my MC Frontalot shirt and asked whether I had caught him the previous weekend at PAX. Unfortunately, I have not attended PAX since 2006, but I *did* purchase the tee directly from The Front himself ;) When we got home, I worked a bit on an English Language parser implementation and then went to the University of Washington to meet with Emily Bender about getting in to the Professional Master s program in Computational Linguistics. It all looks good, and I even got the good news that the GRE is no longer required! After the meeting, I headed home and poked at the parser for a little while longer. I then picked Scarlet up from after-school care and brought her home. I then hopped in the car and drove toward Bellevue to meet up with Monty while he s in town. I over-estimated the amount of time traffic would steal on my way to Bellevue, and had an extra hour to blow. So I dropped by building 41 and shot the IronPython bull with Dino. It turns out he s got an android phone, too. I told him it was possible to put a debian chroot on it and that he should even be able to apt-get install ironpython to his phone soon ;) We talked briefly about the CodePlex Foundation and Sam Ramji s departure from The Evil Empire. Dino seems skeptical about the project. I don t have enough information to have much of an opinion. However, it sounds like some folks I trust are involved, so I m hopeful. I left MS just in time to make it to the wrong address at the specified time. My phone had just enough juice to call Monty to get the right address and then use the navigation system to find my way there. I wasn t able to make reservations at the place we intended to go for dinner until 8:15, so we went to the Barnes & Noble for a bit. They only had one NLP book in stock and the examples are all in Python. I should learn that language one of these days As we were leaving the Pacific Place, Monty mentioned to me that he is on the advisory board for the CodePlex Foundation, and that they have been responsive enough to his input that they changed the Mission statement, at his recommendation, just one day before the Foundation was publicized. He feels that this is a very good direction for Microsoft to be heading. My brother Chris was kind enough to watch the kids while we went out to dinner. Quick note: he recently graduated from UW with a BA in Electrical Engineering and is looking for work using his acquired knowledge, in case anyone needs one of those ;) We met up with my wife, Hannah and our friends, Mike & Cynthia at our place. Monty graciously avoided mentioning the terrible state in which our apartment has recently found itself. The kids were super cute and polite and said hi/bye. Over dinner we discussed building an android app (Monty has one, too ;) ) to automate the process of creating bounties for apps and getting folks to implement them. We also talked about MySQL and MariaDB, of course. Hannah and I recalled my time working for MySQL, Inc. on the MaxDB project and some subtle cultural differences we noticed while traveling. It was interesting getting the inside scoop about the Sun acquisition and some of the recent goings-on in the MySQL/Sun/Oracle world. I wasn t aware, for instance, that the EU is balking on the merger because of monopoly concerns.

Live-initramfs is a fork of Ubuntu s casper for use within Debian. Nowadays several Debian based live systems are using live-initramfs to build an initramfs suited to boot live systems. Besides debian-live and all its users that s at least Grml (and its derivates) and FAI. I m maintaining live-initramfs for Grml so I know the limitations of live-initramfs. Yes, it has some design flaws but upstream finally decided to take the time to redesign it. That s why I m posting this: I would like to see even more Debian based systems adopting live-initramfs (hello Sidux!). This would improve compatibility with regards to similar bootoptions and features as well as better cooperation among the teams. Of course this will be possible only if live-initramfs is capable of handling all the necessary customization and configuration tasks that different live systems require nowadays. So this are my current considerations regarding the redesign of live-initramfs:

• support all currently available bootoptions (for a clean upgrade path and wide adoption of live-initramfs 2.x)
• provide a possibility to use the rootfs from exactly the device that the kernel/initramfs is booting from (this is especially important if users have several similar systems on their usb drives)
• scan removable devices always before any harddisk devices by default
• provide a bootoption which displays the currently executed code:
  • avoids panic on user s side if something takes longer than usual, so let s inform the user instead
  • debugging is essential if anything fails, though:
  • rebuilding the initramfs with set -x isn t a solution for normal users
• bootoption toram should run some free memory checks
• support custom hooks via something like hooks/live-custom (so other distributions don t have to patch live-initramfs for adding additional stuff)
• consider inclusion of Grml s patches (at least what you think might be interesting for you)
• split scripts/[live-bottom] into a separate package:
  • provide just the core files for booting in live-initramfs package, move debian-live specific stuff to a separate package
  • but please don t just drop 23networking for PXE booting
• write messages through a clean interface:
  • so no /dev/console workarounds are necessary to get around the file descriptor hacks
  • support keeping the system completely quiet (for example for bootsplashes)
  • support custom failure messages (debian-live won t have much fun if they receive distribution specific bugreports)
  • allow customization of the messages so every system can use its own look and feel for the boot messages
• provide status bars wherever possible:
  • when searching for the squashfs file this can take a while (quoting a Grml user: cdrom -> ie -> activex -> fast ethernet -> OOB -> IDE -> Grml ), so optionally display which device is scanned
  • toram is annoying without any status information (displaying progress is possible e.g. using rsync)

If you re interested in adopting live-initramfs in your distribution/system feel free to contact me (mika [at] debian.org). If you do have any further wishes for the redesign please let me know so I can forward them to upstream.

I suffer from an in ability to successfully monitor multiple sources of information. For example, I rarely check on lists that I have procmailed out to their own folder. If its a list I need to stay on top of, I have to dump it to my primary inbox. For one list, I even dump messages to my inbox *and* keep a copy in a subfolder. That way I can keep on top of what's going on, but also keep a low-barrier-to-delete since I know I have an archival copy. I do think its important for me to check e-mail regularly, but there is some part of my brain that considers e-mail to be a time sink, and prevents me from going beyond what it considers the bare-minimum: Inbox messages. Another instance of this disorder struck me with RSS. There are web pages that I check every day, and not all of them have RSS feeds. I played with a few different RSS readers a while back, and decided that straw was my favorite. But I could not get myself in the habit of bringing up a second application. Later I started using Firefox, and I thought I'd have better luck with something like Sage. But even that was easy to avoid because it requires actually opening up the sage panel. I would either never check it or, in times of boredom, check it too often. Since then I've given up on RSS readers. These days I've stolen an idea from Alex Chiang and just keep a bookmark folder called "daily" and one called "monthly". Every morning I hit the "Open All in Tabs" item in the daily folder, and quickly ctrl-w through pages w/ no new content. My daily folder includes things like bug reports I'm monitoring for activity, gitweb views of files where I'm waiting for a fix, blogs, parcel tracking, comics, wiki watch lists, etc. Since a few of these pages are rather important, I always remember to do it and therefore force myself to browse the others as well. Most days I spend less than 10 minutes "wasting time" going through them. Its strange to both be aware of poor working habits, yet know from years of experience that I'll be more successful if I work around them rather than trying to retrain myself.

I get lots of spam, and the normal techniques get rid of it. I also get lots of DSNs, which are a mail server's way of telling me it accepted my mail but can't deliver it for some reason. DSNs are ok, but suffer from the problem that someone can fake addresses and get the DSNs sent to another address. Spammers, for example. The procmail people like to claim that if a person if filtering spam with procmail, then he/she has already lost. By this they mean that accepting spam at smtp-time is a bad idea. Most systems filter mail at smtp-time, and reject the spam right then. This way, they never take the mail and never have to send a DSN. A simple bit of reasoning might be: Never accept mail unless:

1. You actually want it
2. You have somewhere to put it

Qmail users, on the other hand, appear to have a nasty habit of accepting anything then bouncing it back. Thats nice for the warm friendly internet that qmail was written for (joke) but its less good in these days of spammers. So, if you run qmail, or any mail server, reject at smtp time, don't bounce. The temptation to compose a standard mail saying "I didn't send this mail, stop bouncing like a moron" and binding a key to send it in mutt is great.

Lately, while using the Twitter web interface with Javascript turned on, I've been redirected to a Privoxy error page whenever I click on an external link:

Request for blocked URL

Your request for http://twitter.com/link_click_count?url=http%3A%2F%2Fexample.com&linkType=web&tweetId=1234567890&userId=12345678&authenticity_token=f5920ebf56bfa111c54bb9f86814cafa76de00fa was blocked.

Block reason: Path matches generic block pattern.

Looking a little closer at the blocked URL, I noticed that for every external link you click, Twitter logs the destination URL, the originating tweet and your user ID.

So what can you do to opt out of this tracking?
Disable JavascriptThis is by far the easiest solution. You can simply install an extension like Noscript and use Twitter with Javascript turned off. That's what I do most of the time since the website is mostly usable without it.

A very fortunate side-effect of using Twitter without Javascript is that you can avoid a number of the worms which propagate through that service from time to time.
Use Privoxy to disable the link counterFor those times when I have to enable Javascript on the site, I use Privoxy, a great privacy-enhancing web proxy, to alter the Javascript code executed when clicking on external links. This effectively disables the extra tracking and takes me directly to the intended URL.

First of all, make sure you have this line in your /etc/privoxy/config:

filterfile user.filter

then, add this filter to /etc/privoxy/user.filter:

FILTER: twitter-link-count Disable the Twitter link tracker
s@twttr\.countClick=function@twttr.dsbldCountClick=function@Uig

and finally turn this filter on for the affected URLs (/etc/privoxy/user.action):

  +force-text-mode +filter twitter-link-count   
.twimg.com/.*/javascripts/twitter.js

Switch to IdenticaIf you want to avoid similar privacy problems in the future, you can also switch to an Open platform which respects your basic freedoms.

The main contestant in this space is Identica. It's a great alternative to Twitter and has a lot of interesting features (like groups and XMPP integration) which are not yet available on Twitter.

The StatusNet developers have kindly released their source code under the AGPL and their goal is to build the most open micro-blogging system out there.

So go over there now and claim your username!

Funny how working on a program immediately inspires to do more. Remember that the initial motivation for debtree was to find out why a package was installed? It can now show that in the dependency graphs! I'm not quite ready to do a new release, but the new version is available from the git repository. Let's start with a simple example (all graphs are based on Lenny).

$ debtree -I --rdeps-depth=3 apt

Only installed packages are displayed here; if the -I option is omitted, debmirror will display all, but that does tend to explode the graphs, especially for common libraries. As for forward dependencies, the color of the arrows indicates Pre-Depends, Depends and Recommends. The reverse dependencies are shown three levels deep (one is default). The graph will always include all direct reverse dependencies (both on the package itself and all virtual packages provided by it. For indirect reverse dependencies there's a cut of that is set at five by default. Example is debconf, that apparently has 9 reverse Pre-Depends and 58 reverse Depends installed on my system. The next one is simply beautiful.

$ debtree -I --rdeps-depth=20 --no-conflicts libcairo2

Because of the --rdeps-depth=20 this shows the full recursion! I was surprised that this graph remained a reasonable size. Apparently no packages depend on the virtual package libcairo, at least none that I have installed. The final one is extreme, and I must confess that I have cheated a bit by suppressing the least interesting reverse depends (which explains why it does not match the numbers from the apt graph).

$ debtree -I -R --no-recommends --no-conflicts debconf

The most interesting thing here is how it shows the debconf-2.0 transition. Most packages depend on 'debconf debconf2.0'; tex-common instead has 'debconf cdebconf', while tasksel and exim4 have both combinations (probably one explicitly in debian/control and the other added by debhelper. ucf is missing the alternative; apparently does not use debhelper (no prizes for guessing who the maintainer is :-). Notice anything about iamerican and ibritish? Yes, they really have a double dependency on 'debconf debconf2.0'. The one thing missing is the version info for versioned dependecies. Not sure yet if I want to add that for reverse dependencies. P.S. SVG versions of the images are available in the same directory as the JPGs.

In response to Andrews request for a feed of RC buggy packages there is currently a 3 times per day changelist on http://bts.turmzimmer.net/. Converting that list to an RSS feed shouldn't be an issue if it's helpful to people. (And if you want it, just sent me an example how the two current top entries should look like as rss feed.)

Some people seem to believe that the problem with copyright law is the inability of people on the free culture side of the debate to compete with the large amounts of money that are being spent but the RIAA et al. I think that a significant part of the problem is that many intelligent and well-meaning people are simply unaware of or unconvinced by the arguments. For example the Reid Report post titled Paul Porter speaks truth to Black radio [1] includes the quote Only the United States, North Korea and Iran don t pay royalties for performers on free AM/FM radio . This point actually sounds quite reasonable and will convince many intelligent and well-meaning people who have an interest in politics such as Ms Reid. Cory Doctorow has written an interesting article titled Internet rapshoot: How Internet Gatekeepers Stifle Progress [2]. He describes how the big entertainment companies are failing to properly represent their customers or the artists who produce the content, and in the process creating monopolies out of companies such as Apple and Google. Cory starts by raising the issue of cultural discourse, monopolies in the distribution of popular art will lead to control over the political process. Ironically the article that Ms Reid cited [3] mentions the issue of pay for play which led to a steady diet of misogyny, violence and drug culture on the airwaves. Brendan Scott has written about a similar issue in Australia where the music copyright holders are trying to get massive increases in license fees from restaurants and other small businesses [4]. The expected result of this is greater use of classical music (which is out of copyright) and more interest in purchasing licenses from small musicians who aren t affiliated with the music cartels. One of his main points is that playing music in public places (including public radio frequencies) is the major form of advertising for musicians. Michael Tiemann writes about a Brazilian band that has been quite profitable by skipping the recording industry, providing the fans what they want, and selling CDs direct to fans [5]. This is one of many examples to illustrate the fact that the current music factory system is not required for musicians to make a profit. Amanda Palmer has written an interesting blog post about how the Warner music group wasn t getting as much money from Youtube as they wanted so they demanded that HER music videos be removed [6] (among many others). So we have a music studio that doesn t even pay the artist (below a certain number of sales the artist gets no payment, selling 30,000 albums is not enough to get a cent) demanding that the music videos be made unavailable to fans when the artist wants them published. This is a travesty and if similar licensing schemes are implemented for radio stations then we can expect that some radio stations will be financially discouraged from playing music even when the artist would be happy to have it played for free! In Australia we have an organisation that secretly taxes all viewing of material that they think is under copyright with a suitable license (they give no detailed information on how they determine the copyright and license status they probably violate my license by taxing universities for copying posts from my blog). Educational institutions and other organisations that sign up get to pay them some money based on what they are deemed to have used. The money is then distributed to the creators in proportion to the amount of use their material received. The distribution rules state that any amount less than $50 per year for an Australian resident or $200 per year for a non-resident will be instead redistributed to other people [7]. Usually analysis of The Long Tail [8] comprises the majority of the sales if users are given enough opportunities to search for a product that is a good match for their requirements. This is the entire basis of businesses such as Amazon.com. The Australian Copyright Agency (Copyright Agency Limited CAL) seems to have a business model of taking all the revenue that might be earned by the creative people in the long tail and give it all to the top performers. If a similar system was implemented for the US music industry then it would be great for Michael Jackson s estate, but bad for the vast majority of musicians. It seems likely to me that the current situation with the music industry is fairly optimal for making a few very popular musicians very rich. The proposed changes for the US will make things even better/worse (depending if you are among the rich few or the majority of the population). One thing we need to ask ourselves is whether we want laws that will make a few people rich or laws that will give many people an adequate income for work they enjoy and which also enriches our culture. This correct decision seems obvious to me. Can anyone think of other good points that should be raised when discussing such issues with people who don t consider copyright to be a big issue?

• [1] http://blog.reidreport.com/2009/06/paul-porter-speaks-truth-to-black-radio.html
• [2] http://www.internetevolution.com/document.asp?doc_id=178058
• [3] http://ebonyjet.com/culture/index2.aspx?id=13434
• [4] http://brendanscott.wordpress.com/2009/06/15/artists-should-pay-cafes/
• [5] http://opensource.org/node/444
• [6] http://blog.amandapalmer.net/post/66586355/the-man-strikes-again-youtube-wars
• [7] http://www.copyright.com.au/assets/documents/distribution_rules_0809.pdf
• [8] http://en.wikipedia.org/wiki/The_Long_Tail

Earlier this evening, I rolled up a new version of RQuantLib. It has been pushed to CRAN and Debian, and source and binary version should appear on the respective mirror networks in due course. This version, the first in a new '0.3.*' release series, contains all the work that Khanh Nguyen did during his Google Summer of Code participation which I had mentioned a while back and for which I acted as mentor. And Khanh did great. We now have a lot more Fixed Income functionality; I include the full ChangeLog entry below. I also added some simple calendaring support and the odd fix here or there while mentoring. All of this had been available while technically 'in progress' thanks to support provided by the R-Forge project hosting where SVN checkouts as well as nightly binaries are provided. A few more details are on the RQuantLib page and I hope to add a few more examples. As promised, the ChangeLog entry:

2009-09-05  Dirk Eddelbuettel  
	* DESCRIPTION: Release 0.3.0 reflecting all the excellent
	  Google Summer of Code 2009 work by Khanh Nguyen as well
	  as other small enhancements
	[ Changes by Khanh Nguyen below ]
	* R/bond.R: Added pricing functionality for various new instrument
	* R/discount.R: Idem
	* src/bonds.cpp: Idem
	* src/discount.cpp: Idem
	* src/utils.cpp: Idem
	* man/Bond.Rd: Added documentaiont for new functions
	* man/CallableBond.Rd: Idem
	* man/ConvertibleFixedCouponBond.Rd: Idem
	* man/ConvertibleFloatingCouponBond.Rd: Idem
	* man/ConvertibleZeroCouponBond.Rd: Idem
	* man/Enum.Rd: Idem
	* man/FittedBondCurve.Rd: Idem
	* man/FixedRateBond.Rd: Idem
	* man/FixedRateBondCurve.Rd: Idem
	* man/FixedRateBondPriceByYield.Rd: Idem
	* man/FixedRateBondYield.Rd: Idem
	* man/FloatingRateBond.Rd: Idem
	* man/ZeroCouponBond.Rd: Idem
	* man/ZeroPriceByYield.Rd: Idem
	* man/ZeroYield.Rd: Idem
	* rests/RQuantLib.R: Added tests for new functions
	* rests/RQuantLib.Rout.save: Added tests ouput for new functions
	[ Changes by Dirk Eddelbuettel below ]
	* man/BondUtilities.Rd: Added documentation for new function
	* R/calendars.R: Add support to access QuantLib calendars from R
	* src/calendars.cpp Idem
	* man/Calendars.Rd: Idem
	* src/bonds.cpp: Small C++ fixes to suppres g++ warnings
	* INDEX: Updated via 'R CMD build --force'
	* inst/QuantLib-License.txt: Updated to version from QL 0.9.7

One thing that often seems to cause problems for people who work over many different areas of the Linux kernel is the process of making sure that patches actually get reviewed and applied. Where the relevant subsystem is actively maintained it s not a problem but that s not always the case. Sometimes maintainers are busy or on holiday and miss things, sometimes there are other problems. In these cases the onus is on the patch submitter to spot the problem and make sure that something is done to ensure that the patch doesn t get forgotten. There s a few workflows for dealing with this. My preferred one is to track the appearance of my patches in Stephen Rothwell s linux-next tree, which tracks individual development trees destined for merge into Linus tree. I create a git branch based on the current state of this tree then apply the patches I m submitting on top of that. This lets me spot any potential merge conflicts that they ll create but the main function is to allow me to come back to the branch later and track which of the patches has shown up in one of the trees that Stephen tracks. To do this I rebase the branch onto the current state of linux-next:

git rebase --onto next/master old-master

where old-master is the last linux-next commit in the branch. This will flag up any merge issues that have come up due to changes in other trees and will also handle patches that are already present in one of the trees in -next by dropping my local version. The end result is a branch based on the new linux-next with all the patches that were not yet applied in it. I can see what still needs to be looked at by examining the log

git shortlog next/master..

and take any appropriate action, such as following up with the relevant maintainer or trying to find out what s going on with the subsytem if it looks like the subsystem maintainers are inactive. One possible problem with this approach is that a patch may be applied and then subsequently dropped this is rare but it can happen. I deal with that by also keeping a normal unrebased development branch whch has the changes in Linus tree merged into it periodically and incremental patches for any review updates that occur during the submission process. By looking at the diff between that and other trees I can see any changes that have got lost along the way.

Steinar H. Gunderson, sesse, has written an interesting article about TCP performance. I didn t find your blog s comment function, so I am commenting with a trackback. (note: which didn t work either, The auto-discovered trackback URI does not match our target URI ) I frequently use mobile internet, using various of the German GSM/UMTS network operators, out of a moving train. As you have written, this frequently causes packet loss which is not only not caused by congestion, but sends the congestion avoidance algorithms on a false path. For example, when the train passes through the 3575 m long Distelrasentunnel between Frankfurt and Fulda, my network link is broken for like two minutes. Passing through other parts of Germany sometimes gives me a ping response of hundreds of thousands of microseconds by virtue of the rather huge send buffer the UMTS equipment has. In these circumstances, ssh sessions frequently take tens of minutes to notice that the network is back before the session is useable again. Frequently, it doesn t come up again before an hour has passed. And I have not found a way to work myself around this. Can you explain what s happening here, and do you have any ideas to solve the issue?

Jetstar has announced some new changes to the way they manage their IT infrastructure [1]. Some parts of it are obvious things that people have been doing (or wanting to do) for a long time such as using thin clients with no moving parts (not even cooling fans). But the really interesting part is their plan for managing laptops. They are using a virtual machine image on a flash storage device that can run on any system. So deploying a new system will only require installing the virtual machine software and inserting a storage device. Moving a user s environment to a different system (EG due to hardware failure) will merely require inserting the storage device in a new system. That raises the issue of ownership of the device. It seems that Jetstar are considering using systems that are owned by employees, Stephen Tame said In two years time a laptop should be a condition of employment, and this includes bringing your own laptop . When introducing that I expect there would be some resistance by employees who don t want to spend the money. However
I have previously estimated the costs of running a car [2] which works out to more than $1,650 per year for insurance, registration, basic maintenance, and the interest that would have been received if the car had not been purchased and the money had been invested. Laptops can be purchased for significantly less than $1000 (currently the EeePC 701 is on sale for $219) and can be expected to last for three years or more if you are careful to avoid damage and don t run demanding software. So a job that demands ownership of a laptop is asking for a much smaller financial investment than one which demands ownership of a car. But I expect that many employees won t see it that way. The up-side for employees to bring their own laptops is that they can choose a model that suits their preference. Everyone has preferences regarding the size of keys on a keyboard, the distance that they travel and the pressure required to register a key-press. For desktop machines it s easy to swap keyboards but for laptops there is no such option. Then there s the issue of the trade-off between physical size and weight vs display resolution, personal preferences in this regard will depend to some extent on the body mass and strength of the employee. Now there are a number of security issues related to personal laptop use. Obviously if the laptop has a Trojan-horse program installed then it could sniff any data that goes past on the network. The most trivial case of this could be addressed by running VPN software inside the emulated environment. This would force a Trojan to compromise the virtual environment (EG by modifying the address space) or to compromise the files on disk (insert a Trojan inside the filesystem for the virtual environment). The former would be tricky to get right while the latter would be trivial. Both attack methods have been used in the past and proven to work. This is why many companies prohibit their employees from connecting their own systems to the corporate network. One example of a system that is based around running virtual machines for all desktop operations is the NSA NetTop project [3]. NetTop involves a SE Linux system that runs multiple instances of VMWare for different desktop environments. Each VMWare instance runs at a particular sensitivity level and uses a VPN connection to a back-end network running at the same level. The aim of NetTop is to prevent applications in the different VMWare instances from communicating with each other. The significant difference between a typical NetTop installation and what JetStar might be doing is that NetTop runs on a secure base it s hardware that has been purchased and installed by a military organisation and is run in a secure facility. While personal laptops that are owned by employees can be expected to be infected with viruses and Trojan-horse programs. In the past I have suggested that an employment package for any skilled employee should include some budget for buying things that facilitate the work [4]. It seems to me that a company like JetStar could best achieve their goals by assigning a budget to each new employee to buy a machine for their use. The employee then gets to choose a machine up to that budget which would only be for work purposes. Then when the employee leaves or the machine becomes due for replacement it could be sold at auction. When considering all the costs involved in hiring a new person, spending something less than $1,000 to buy a laptop is nothing. Finally if buying machines for work purposes, you really don t want employees using them for surfing porn. Porn sites tend to be particularly bad for malware distribution. To reduce the incidence of such problems I think that work machines should have their sound hardware disabled and laptops should not be purchased with overly large displays. There is no need to make work machines totally unsuitable for porn surfing (which would also make them less effective for work), but making them less suitable than a $500 budget PC should dramatically reduce the scope of the problem.

• [1] http://www.australianit.news.com.au/story/0,24897,26021336-15306,00.html
• [2] http://etbe.coker.com.au/2008/06/16/cost-owning-car/
• [3] http://en.wikipedia.org/wiki/NetTop
• [4] http://etbe.coker.com.au/2009/02/01/employment-packages/

While git is a completely distributed revision control system, sometimes the lack of a central canonical repository can be annoying. For example, you might want to make your repository published publically, so other people can fork your code, or you might want all your developers to push into (or have code pulled into) a central "golden" tree, that you then use for automated building and continuous integration. This entry should explain how to get this all working on Ubuntu 9.04 (Jaunty). Gitosis is a very useful git repository manager, which adds support like ACLs in pre-commits and gitweb and git-daemon management. While it's possible to set all these things up by hand, gitosis does everything for you. It is nicely configured via git; to make configuration changes, you push the config file changes into gitosis repository on the server. Gitosis is available in Jaunty, but unfortunately there is a bug in the version in Jaunty, which means it doesn't work out of the box. Fortunately there is a fixed version in jaunty-proposed that fixes the main problem. This does mean that you need to add the following to your sources.list:

deb http://gb.archive.ubuntu.com/ubuntu/ jaunty-proposed universe

Run apt-get update && apt-get install gitosis. You should install 0.2+20080825-2ubuntu0.1 or later. There is another small bug in the current version too, as a result of git removing the git-$command scripts out of /usr/bin. Edit /usr/share/python-support/gitosis/gitosis/templates/admin/hooks/post-update and replace

git-update-server-info

with

git update-server-info

With these changes in place, we can now set up our gitosis repository. On the server you are going to use to host your central repositories, run:

sudo -H -u gitosis gitosis-init < id_rsa.pub

The id_rsa.pub file is a public ssh key. As I mentioned, gitosis is managed over git, so you need an initial user to clone and then push changes back into the gitosis repo, so make sure this key belongs to a keypair you have available to the remote user you're going to configure gitosis. Now, on your local computer, you can clone the gitosis-admin repo using:

git clone gitosis@gitserver.example.com:gitosis-admin.git

If you look inside the gitosis-admin directory, you should find a file called gitosis.conf and a directory called keydir. The directory is where you can add ssh public keys for your users. The file is the configuration file for gitosis.

[gitosis]
loglevel = INFO
[group gitosis-admin]
writable = gitosis-admin
members = david@david
[group developers]
members = david@david
writable = publicproject privateproject
[group contributors]
members = george@wilber
writable = publicproject
[repo publicproject]
daemon = yes
gitweb = yes
[repo privateproject]
daemon = no
gitweb = no

This sets up two repositories, called publicproject and privateproject. It enables the public project to be available via the git protocol and in gitweb if you have that installed. We also create two groups, developers and contributors. David has access to both projects, but George only has access to change the publicproject. David can also modify the gitosis configuration. The users are the names of ssh keys (the last part of the line in id_dsa.pub or id_rsa.pub). Once you've changed this file, you can run git add gitosis.conf to add it to the commit, git commit -m "update gitosis configuration to commit it to your local repository, and finally git push to push your commits back up into the central repository. Gitosis should now update the configuration on the server to match the config file. One last thing to do is to enable git-daemon, so people can anonymously clone your projects. Create /etc/event.d/git-daemon with the following contents:

start on startup
stop on shutdown
exec /usr/bin/git daemon \
   --user=gitosis --group=gitosis \
   --user-path=public-git \
   --verbose \
   --syslog \
   --reuseaddr \
   --base-path=/srv/gitosis/repositories/ 
respawn

You can now start this using start git-daemon So now, you need to start using your repository. You can either start with an existing project or an empty directory. Start by running git init and then git add $file to add each of the files you want in your project, and finally git commit to commit them to your local repository. The final task is to add a remote repository and push your code into it.

git remote add origin gitosis@gitserver.example.com:privateproject.git
git push origin master:refs/heads/master

In future, you should be able to do git push to push your changes back into the central repository. You can also clone a project using git or ssh, providing you have access, using the following commands. The first is for read-write access over ssh and the second uses the git protocol for read-only access. The git protocol uses TCP port 9418, so make sure that's available externally, if you want the world to be able to clone your repos.

git clone gitosis@gitserver.example.com:publicproject.git
git clone git://gitserver.example.com/publicproject.git

Setting up GitWeb is left as an exercise for the reader (and myself because I am yet to attempt to set that up).

Whenever I attend Debconf, the first day is always a bit disorienting due to the confluence of jet lag with the sea of male programmers swarming at the venue. I am not sure I should be admitting this but one of the first things that pops to mind is the very cheesy one hit wonder whose video is filled with many bikini clad men, Its raining men. So for a few hours, maybe a day, I sometimes feel out of place but this this first wave of discomfort usually gives way to comfort. This is not only because I connect with friends but because Debconf as well as many other hacker events and this sits in marked contrast to professional academic conferences are remarkably accepting of diversity and difference, at least that has been my personal experience. Most notably, people could care less about how you look, disabilities are consistently accommodated, and some things, like gender changing, which would raise serious eyebrows for instance in most academic conferences, is accepted with next to no gossip. I raise this because this is how I personally have experienced the world of Free Software: overwhelming male but overwhelming accepting of difference as well. So even while I think it is key to confront the problems of discrimination in this world, it is not a simple story, for again, it is an environment that is also accommodates difference and quirkiness to some notable degree. The question of gender in F/OSS is complicated one and here I am not going to ruminate on sources of gender bias except to say that I am sure there are some in operation (as there are in most domains) some of which are internal to Free Software and other s external to Free Software. But what I have been struck by, especially over the course of the summer, is the explosion of sites, blogs, and debates that have confronted gender in Free Software. It has been nothing short of astounding and a really positive turn. The most notable example is this AWEEEEEEEEEEESOME pair: a wiki and a blog that confront gender head on. These are notable because the wiki, for example, catalogs all sorts of controversial events, comments on them, leaving a very visible trace of debate, one that is necessary to change the gender make-up and dynamic within Free Software project. Along with these, the FSF is finally hosting a min-summit, which is great (less great is that participation seems invite only but perhaps they have some good reasons for doing so). And today I just learned of this diversity page coming out the Python project. These are perfect examples of the recursive public in action raised in Chris Kelty s work. And I have long been impressed with the dialogue that has followed from some controversial events in the world of Free Software, including those related to gender and this summer seems to be a watershed of sorts and I look forward to their developments over time. Indeed and this may be controversial as well, but I think my academic field of media, law, and culture has something to learn from these gender politics for there are some very real, though probably unintentional forms of discrimination that are not under that much active discussion. The most glaring problem is the underwhelming presence of female scholars during conferences (and as we know, conferences are exceedingly important for one s professional development and career). What I find most striking about this trend is the number of female scholars is significant. That is, when it comes to scholars and this seems different from the world of tech, there is a sizable community of women scholars and activists so when there is a 5% female participation , as for example, with this event, one has to wonder why is it raining men at these conferences? It also seems that while the debate exists, it is not as vibrant as with what is going on right now in F/OSS. Take for example, this recent mailing list post which unapologetically highlighted the lack of female presence in the up and coming Free Culture event at the Berkman Center. While the post generated a handful of thoughtful responses, including this supremely classic, biting, and quite clever response from Georgetown professor Julie Cohen, the debate did not linger on (however short, the posts and discussion were quite fruitful). What to do? Frankly, blame and finger pointing are pretty counterproductive, mostly because the discrimination is quite unintentional and I believe change can be brought about via more constructive paths. More important is we need to make the issue visible, identify some possible sources, and then create projects that can remedy the problem. Along with Elizabeth Stark, who has also been keen to note and change the gender problems, I am currently whipping together a wiki with a list of female scholars, leaders, and technologists as a resource for folks organizing conferences. We already have a base list (with a remarkably long list of folks) and will hopefully in the course of the next month throwing it up on the wiki. I don t think it will ever be as cool as the Geek Feminism Wiki but it will hopefully do some good!

Listening to Martin Krafft s talk at Debconf (related to his PhD) shed some new light on the idea that I expressed last year I wanted that each maintainer regularly answers a questionnaire so that he has to ask himself whether he does a good enough job with his packages. When thinking of this idea, I only saw the QA side of ensuring good maintenance on all packages, however I believe that the root problem lies further and this project would not be enough: we are interdependent but we are not equipped to deal with this reality. Martin s only merit has been to mention that we are interdependent, but it s worth analyzing a bit. Our organization is centered around individuals acting as package maintainers, and in theory each package maintainer can work on his corner and all goes well. We know that this model doesn t hold any more: transitions to testing require coordination of uploads and timely fixes of RC bugs, keeping up with the work frequently requires several volunteers that have to coordinate, etc. More and more of the work requires a level of availability that a single individual can t offer, yet in our day-to-day work we mainly interact with individuals. Wouldn t it be better if we could immediately know what we can expect from any Debian developer:

• mean time to reply to Debian mail (reading every day or once a week is not the same);
• amount/periods of time spent on Debian (knowing that they spend up to 4 hours mainly on Saturday can be useful);
• current availability for Debian (if they are currently busy with life, we should be able to know it, if they know when it will end, it would also be good to share);
• best way to get in touch for issues (they might have preference between IRC or mail);
• kind of relationship they have with packages where they are listed in Maintainer/Uploaders (an active maintainer that uses the software daily is not the same than a passive maintainer that only packaged the software because it was a build-dependency for some other software that they care about);
• any other information that the maintainer wants to share (about his habits/constraints/values/goals/whatever).

All this information should be shared by all Debian maintainers (some of it is already available but either not publicly or not in any machine-parseable way) and we should actively use it. Here are some examples of use: for each RC bug report, you could look up if at least one maintainer is available and you could ping him explicitly if needed. When you plan an NMU, you could look up if the maintainer is likely to respond in the next day or not, and possibly adjust the number of days spent in the DELAYED queue. When organizing a large-scale transition, you could extract a list of packages whose maintainers are not available and arrange immediate NMUs. Furthermore there are many cases where the project s usual expectation exceed what the maintainer is ready to do. Documenting what part of the job is done (or not) by the maintainer makes it clear for volunteers whether their help is needed and whether they could/would be a better maintainer for a given package. Designing solutions to all these problems is going to be the scope of the DEP2 that I reserved some time ago. It s likely to be some sort of dedicated web interface. I would welcome supplementary drivers for this DEP, so if you re interested, get in touch with me. Partagez cet article / Share This