Today, in a fit of fool-Hardy-ness, I upgraded one of my computers to the most recent Ubuntu development release, codename Hardy Heron. Amongst the several other bugs I encountered (the kernel not booting was a rather noticable one…) was this adorable little bug in tracker. (Some background info: Tracker is a file alteration monitor - like Apple’s Spotlight, and …whatever the Vista knockoff is called. ImageMagick is an image processing utility, invoked with the command “convert”.) So - picture this situation: Tracker is searching along, and encounters a graphics file. Being a graphics file, Tracker realizes it wants a thumbnail. Tracker calls convert. Convert creates a temporary file. Tracker notices a file has been created. It notices that this file is an image file, and therefore wants a thumbnail. Tracker calls convert… You can guess what happens from here on. This lovely bug reminds me quite a lot of a story I read a while ago which had been uploaded by Eric Smith to his wonderful PDP-6/PDP-10 resource and folklore website, “I/O Deja Vu, A Farce in One Act“. Worth a read. Update: Within ten minutes, the very helpful Saleem Abdulrasool (”compnerd” on IRC) helped me debug it and comitted a change to upstream, so it’s fixed in the next release (expected in a few days). Filed a bug on the Ubuntu package. I love FOSS.

One of the interesting things about Google's Android project is the mix of cultures. There are a number of people like me, firmly grounded in the open source world, who are happy to get something that 1) works, 2) looks to have legs in terms of popularity, and 3) will be open source. Think of a lot of your favorite open source projects when they first launched. "Polished" isn't a word you would probably use to describe them, although it usually happens in later releases (Ubuntu looks better and better, for example). There are also a lot of people who come from a 'commercial' background, who expect to see everything ready and waiting on a plate for them, which isn't a mistaken expectation if you're used to using products from big companies who are staking their reputations on them. They want nice, thorough docs for everything, almost all bugs worked out, and lots of easy to use tools. Android lies in a middle ground somewhere between these two camps, which I think at times makes people uneasy. It's not open source yet. You can't hack it as much as you may want. You can't rebuild it from the ground up. You don't get access to the communication between the developers working on it, and cannot participate in that development. However, there is a promise to open source it that would reflect very, very poorly on Google were it not met and is therefore pretty credible. The developers and many people involved with it certainly seem to "get" open source, and are taking good steps to create a community around Android (a few even hang out in the #android IRC channel on Freenode) that will most likely not take too long to start assimilating interested outsiders once the code is open. In terms of quality, it wasn't bad when it came out, but it was very definitely an "early look", put out there to solicit feedback and change according to it, something that's part and parcel of a release early, release often open source model. On the other side, Android looks to be a big effort from a big company to get into a big market in a big way - it's not a "under the radar" type of strategy that the open source world is often constrained to follow for lack of monetary and marketing resources to do it any other way. This has attracted a number of developers who either don't see or don't really get some of the "open source" aspects of what we have so far: it's still changing! The docs aren't complete! The emulator is still ugly in places! And from their point of view, it must seem odd to getting something that's obviously not a finished product, without crystal clear direction and goals and a roadmap, and without actual hardware only available in the distant (well, in internet terms! - 8 months or so) future. That kind of thing probably isn't done very often in their world, or where it's done, is certainly kept quieter and perhaps restricted to registered developers. They came over to have a look at something that was ready to go, and it isn't, yet. This has caused some disappointment for people who expected to see something ready to go out of the box. Perhaps Google needed to manage their initial communications slightly better in order to manage the second group's expectations more carefully. In terms of us open source folks, I think that what we want is more access, as soon as Google is willing to hand it out. More source code access, but also access to the development process and people. "Real" open source isn't just about the code, it's about being more or less equal participants in a community. Luckily, I think the people at Google get this, which is one of the reasons I'm enthusiastic about Android, even if I wish we didn't have to wait so long for the source code.

Searching for an alternative for our old Cisco Border Router we are evaluating some software routing suites on “normal” server hardware.
First we tried Vyatta, but the routing software frequently crashed completly. Maybe this is fixed with VC4 Alpha 1, but we didn’t test that.
Next try was the development version (0.99.9) of quagga from Debian testing, but it looks like a peering with one of our cisco router fails after the hold timer expires. (more…)

Matt Bottrell writes about the Oracle Linux offerings presented at LCA 2008 [1] The one thing that Oracle does which I really object to is the “unbreakable” part of their advertising. They have pictures of penguins in armour and the only reasonable assumption is that their system is more secure in some way. As far as I am aware they offer no security features other than those which are available in Red Hat Enterprise Linux, CentOS, and Fedora. The unbreakable claims were also made before Oracle even had their own Linux distribution, which gave them even less reason for the claims. If someone is going to be given credit for making Linux unbreakable then the contributors list for the SE Linux project [2] is one possible starting point. Another possibility is that credit could be given to Red Hat for introducing so many security features to the mainstream Linux users before any other distribution. In terms of improving the security of databases it’s probably best to give credit to Kaigai Kohei and the PostgreSQL team for Security Enhanced PostgreSQL [3]. I believe that NEC also deserves some credit for sponsoring Kaigai’s work, I am not sure whether NEC directly sponsored his recent work on SE-PostgreSQL but they certainly sponsored his past work (and are credited on the NSA web site for this). Oracle’s Linux distribution is based on CentOS and/or Red Hat Enterprise Linux (RHEL). The situation with RHEL is that the source is freely available to everyone but binaries are only available to people who pay for support. CentOS is a free recompile of RHEL and a good choice of a distribution if you want a server with long-term support and don’t want to pay Red Hat (I run many servers on CentOS). While Matt gets most things right in his post there is one statement that I believe to be wrong, he writes “One of the craziest statements I heard during the talk was that Oracle will only support their products running under a VM if it’s within Oracle VM“. My knowledge of Xen causes me to have great concerns about reliability. My conversations with MySQL people about how intensive database servers are and how they can reveal bugs in the OS and hardware are backed up by my own experience in benchmarking systems. Therefore I think it’s quite reasonable to decline to support software running under someone else’s Xen build in the same way as you might refuse to support software running under a different kernel version (for exactly the same reasons). Matt however goes on to make some very reasonable requests of Oracle. The demand for native packages of Oracle is significant, I can’t imagine official Debian package support appearing in the near future, but RPM support for RHEL etc would make things easier for everyone (including Oracle). A better installation process for Oracle would also be a good thing. My observation is that most Oracle installations are not used for intensive work and use database features that are a sub-set of what MySQL offers. I’ve seen a few Oracle installations which have no more than three tables! The installation and management of Oracle is a significant cost factor. For example I used to work for a company that employed a full-time Oracle DBA for a database with only a few tables and very small amounts of access (he spent most of his time watching videos of fights and car crashes that he downloaded from the net). Adding one extra salary for a database is a significant expense (although the huge Oracle license fees may make it seem insignificant).

• [1] http://matt.bottrell.com.au/item/163/


• [2] http://www.nsa.gov/selinux/info/contrib.cfm


• [3] http://www.kaigai.gr.jp/index.php?sepgsql

Share This

I have not heard of them until last week but I like their name, Frog Design, and they have an issue dedicated to Health Care including an intriguing article The Paradox of Choice
A capitalist case for universal health care. For those just into tech, they also have a piece by OLPC.

Following the first phase, the second and final phase of the Penny and Martin adventure ended last Friday at Wellington airport. I am now 11 500 metres high on my way from Bangkok to Zurich, looking back at seven days on the New Zealand South Island, another in Wellington, and a night in Melbourne. Here s the summary of the 2200km we travelled, with selected photos inline. Penny has more pictures in her Flickr album.

• Thursday: ferry from Wellington to Picton and on to Amberley, where we stayed with Penny s sister Janey.
• Friday: via Christchurch to Lake Tekapo for a lovely swim in turquoise water, before we set up the tent at Lake Pukaki with Mount Cook in the distance. Camping with a car isn t all bad.
• Saturday: via Wanaka en route to Haast Pass with a stopover at the Gates of Haast for some rock hopping and full body immersion in the icy water (yes, Penny went in all the way, too). From Haast, we took the beautiful road to Jackson Bay and back, before heading into Cascade Valley for another night of camping, this time with millions of sandflies forcing us to dress appropriately. NB: please, no new offers for fashion modeling contracts, I am already fully booked. Penny might appreciate them though, especially if she gets to wear white socks.
• Sunday: fled the valley as if running for life (think final scene of Hitchcock s Birds) to prevent further sandfly attacks and headed north to the Fox and Franz Josef Glaciers, where we got soaked in heavy rain. Reached Greymouth in time for the tour of the local Monteith brewery and spent the night recovering from the camping in the Charles Court Motel. Monteith s Munich-style Golden lager beer is actually quite reminiscent of Munich-style lager! I also got to take three girls to the men s toilet to see the world s coolest urinal.
• Monday: the bad weather followed us up the west coast to Punakaiki but didn t deter us from taking a short hike to the pancake rocks, nor from visiting the seal colony at Cape Foulwind later in the day. I found out how much Penny loves Nikau trees. From there, headed west for Lewis Pass and passed up on camping due to the heavy rainfall. Instead, we booked into the Maruia Springs Resort Hotel and indulged in hot springs recreation and camping-stove-cooked pasta in the room.
• Tuesday: the weather in Kaikoura, which we reached around noon the next day, wasn t any better, which foiled our diving plans, so we continued on to Picton and decided to cut our road trip short by one day to give us more time tying up loose ends in Wellington.
• Wednesday: got up early to rent diving equipment for two dives at Karaka point, where we inspected (and swam through) an old ship s wreck. We also collected around 20 scallops, which we brought to Penny s parents and enjoyed them cooked in ginger and garlic for a late lunch. The ferry took us back to Wellington that night, where I got to see Eagle vs. Shark, a Kiwi movie starring Jemaine Clement from the Flight of the Conchords and music composed by local bands, foremost of which The Phoenix Foundation. I have to side with Penny: it s an enjoyable flick but probably not worth watching multiple times.
• Thursday: following breakfast at the Olive cafe, we went on shopping sprees (I found a store selling Icebreaker gear at 50% ), chilled in the afternoon, fetched excellent Sushi at the Wasabi Sushi Train, and finally saw The Phoenix Foundation play a free concert at Frank Kitts Park.

My New Zealand beer top-ten, in reverse order: Monteith s Original, Monteith s Black, Mac s Great White, Monteith s Golden, Monteith s Celtic, Monteith s Pilsener, Emerson s Pilsener, Mac s Hop Rocker, Emerson s 1812 India Pale Ale, and (drum-roll): Mac s Sassy Red. Yum! The Emerson beers get no links because the brewery website uses Flash. Thanks, Penny, for a fabulous two weeks! NP: The Flower Kings: Back in the World of Adventures

Finally I found the URL of a device I’ve been hearing rumours about. The HotPlug is a device to allow you to move a computer without turning it off [1]. It is described as being created for “Government/Forensic customers” but is also being advertised for moving servers without powering them down. The primary way that it works is by slightly unplugging the power plug and connecting wires to the active and neutral terminals, then when mains power is no longer connected it supplies power from a UPS. When mains power is re-connected the UPS is cut off. Modern electrical safety standards in most countries require that exposed pins of a power plug (other than the earth) be shielded to prevent metal objects or the fingers of young children from touching live conductors. The image above shows a recent Australian power plug which has the active and neutral pins protected with plastic such that if the plug is slightly removed there will be no access to live conductors. I have photographed it resting on a keyboard so that people who aren’t familiar with Australian plugs can see the approximate scale. I’m not sure exactly when the new safer plugs were introduced, a mobile phone I bought just over three years ago has the old-style plug (no shielding) while most things that I bought since then have it. In any case I expect that a good number of PCs being used by Australian companies have the old style as I expect that some machines with the older plugs haven’t reached their three year tax write-down period. For a device which has a plug with such shielding they sell kits for disassembling the power lead or taking the power point from the wall. I spoke to an an electrician who assured me that he could with a 100% success rate attach to wires within a power cord without any special tools (saving $149 of equipment that the HotPlug people offer). Any of these things will need to be implemented by a qualified electrician to be legal, and any electrician who has been doing the job for a while probably has a lot of experience working before the recent safety concerns about “working live“. The part of the web site which concerns moving servers seems a little weak. It seems to be based on the idea that someone might have servers which don’t have redundant PSUs (IE really cheap machines - maybe re-purposed desktop machines) which have to be moved without any down-time and for which spending $500US on a device to cut the power (plus extra money to pay an electrician to use it) is considered a good investment. The only customers I can imagine for such a device are criminals and cops. I also wonder whether you could get the same result with a simple switch that cuts from one power source to another. I find that it’s not uncommon for brief power fluctuations to cause the lights to flicker but for most desktop machines to not reboot. So obviously the capacitors in the PSU and on the motherboard can keep things running for a small amount of time without mains power. That should be enough for the power to be switched across to another source. It probably wouldn’t be as reliable but a “non-government” organisation which desires the use of such devices probably doesn’t want any evidence that they ever purchased one… Now given that such devices are out there, the question is how to work around them. One thing that they advertise is “mouse jigglers” to prevent screen-lock programs from activating. So an obvious first step is to not allow jiggling to prevent the screen-saver. Forcing people to re-authenticate periodically during their work is not going to impact productivity much (of course the down-side is that it offers more opportunities for shoulder-surfing authentication methods). Once a machine is taken the next step is to delay or prevent an attacker from reading the data. If an attacker has the resources of a major government behind them then they could read the bus of the machine to extract data and maybe isolate the CPU and send memory read commands to system memory to extract all data (including the keys for decrypting the hard drive). The only possible defence against that would be to have multiple machines exchanging encrypted heart-beat packets and configured to immediately shut themselves down if all other machines stop sending packets to them. But if defending against an attacker with more modest resources the shutdown period could be a lot longer (maybe a week without a successful login). Obviously an attacker who gets physical ownership of a running machine will try and crack it. This is where all the OS security features we know can be used to delay them long enough to allow an automated shut-down that will remove the encryption keys from memory.

• [1] http://www.wiebetech.com/products/HotPlug.php

Share This

I've gone over the design for "dammit" again, and I think I can even get away with non-specialised nodes for the various compilation tasks in the work tree, which will make support for additional input languages pluggable, an idea I tossed in the beginning for fear that it might not be doable. So I finally get to solve one thing I found annoying with automake. :-) The other big feature I'm excited about is having two different modes of importing stuff from libraries, with and without reexporting the ABI. Depending on that, any newly built library will incorporate the SONAME of the dependent library into its own, and its development package will depend on the other -dev package (obviously, for that to work, I'll have to add package building to it as well :-P )

Update: I managed to find out why the wpa_action stuff was needed. Please ignore the lines written like this; they are there just for reference.

One more update: it seems that the firmware needs to be in sync. I ended up using the wireless-2.6 kernel from the everything branch.

---

I just managed to get my wlan from my laptop to work with WPA2-PSK with AES with the free Broadcom driver (now named b43, formerly bcm43xx).

0b:00.0 Network controller: Broadcom Corporation BCM94311MCG wlan mini-PCI (rev 01)

0b:00.0 0280: 14e4:4311 (rev 01)

In order to do this I needed linux 2.6.24-1 from unstable and the b43 driver.

bounty:/home/eddy# lsmod   grep b43
b43                   119976  0
rfkill                 12816  3 rfkill_input,b43
mac80211              132236  1 b43
led_class              10120  1 b43
input_polldev           9872  1 b43
ssb                    39428  2 b43,b44
pcmcia                 45720  2 b43,ssb
pcmcia_core            46500  2 b43,pcmcia
firmware_class         15232  2 b43,pcmcia

The final trick was to convince wpasupplicat to reload the config with:

bounty:/home/eddy# wpa_action wlan0 reload
wpa_action: reloading wpa_supplicant configuration file via HUP signal

This is the wpasupplicant.conf file that I used:

bounty:/home/eddy# cat /etc/wpa_supplicant/wpasupplicant.conf   grep -v '^\s*#'   sed 's/psk=.*/psk=aaabbb___ENCRIPTED_SEE_wpa_password___cccddd/'
ctrl_interface=/var/run/wpa_supplicant
ap_scan=1
network= 
ssid="toblerone"
scan_ssid=1
proto=RSN
key_mgmt=WPA-PSK
pairwise=CCMP
group=CCMP
psk=aaabbb___ENCRIPTED_SEE_wpa_password___cccddd
 

and this is the relevant interfaces area:

auto wlan0
allow-hotplug wlan0
iface wlan0 inet dhcp
wpa-driver wext
wpa-conf /etc/wpa_supplicant/wpasupplicant.conf
wpa-ap-scan 2

This is what it looks like when is working:

bounty:/home/eddy# iwconfig wlan0
wlan0     IEEE 802.11g  ESSID:"toblerone"
Mode:Managed  Frequency:2.412 GHz  Access Point: 00:1B:FC:45:33:70
Bit Rate=48 Mb/s   Tx-Power=27 dBm
Retry min limit:7   RTS thr:off   Fragment thr=2346 B
Encryption key:1337-0000-C121-d73D-0207-RE41-0000-3210 [2]
Link Quality=98/100  Signal level=-36 dBm  Noise level=-68 dBm
Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
Tx excessive retries:0  Invalid misc:0   Missed beacon:0

And here's the result of a scan (relevant section):

  Cell 02 - Address: 00:1B:FC:45:33:70
ESSID:"toblerone"
Mode:Master
Channel:1
Frequency:2.412 GHz (Channel 1)
Quality=93/100  Signal level=-42 dBm  Noise level=-68 dBm
Encryption key:on
IE: IEEE 802.11i/WPA2 Version 1
   Group Cipher : CCMP
   Pairwise Ciphers (1) : CCMP
   Authentication Suites (1) : PSK
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
         24 Mb/s; 36 Mb/s; 54 Mb/s; 6 Mb/s; 9 Mb/s
         12 Mb/s; 48 Mb/s
Extra:tsf=0000000072ff542d

and here is proof it works:

bounty:/home/eddy# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.77.0    0.0.0.0         255.255.255.0   U     0      0        0 wlan0
0.0.0.0         192.168.77.254  0.0.0.0         UG    0      0        0 wlan0

bounty:/home/eddy# ping debian.org
PING debian.org (192.25.206.10) 56(84) bytes of data.
64 bytes from gluck.debian.org (192.25.206.10): icmp_seq=1 ttl=36 time=201 ms
64 bytes from gluck.debian.org (192.25.206.10): icmp_seq=2 ttl=36 time=199 ms
64 bytes from gluck.debian.org (192.25.206.10): icmp_seq=3 ttl=36 time=200 ms

--- debian.org ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 199.691/200.519/201.046/0.786 ms

Woooohooo! :-)

Thanks to all people involved in b43 development and all the ones made this possible (Debian developers).

Posted from bed, via wlan.

---

Update: You need the firmware blob, which can be extracted from a Windows driver with bcm43xx-fwcutter (now called b43-fwcutter); I already had it from my previous attempts to configure wlan with bcm43xx. I am not sure if I should use the new tool. You really need the firmware and driver to be in sync.

Update: it seems the b43 driver page (the entire linuxwireless.org site) went down sometime yesterday evening, since yesterday afternoon I was browsing through the site without any issues. (Note: I live in Europe, for reference)

I don't think the first trip ever made a mention in either of our blogs. Funny how an exhausting trip tends to stem the care factor to write about it afterwards... Anyway, Sarah was in a fair bit of pain last night when she went to bed, and despite taking 800mg of Ibuprofen, some amount of Oxycodone, and some sleeping tablets, she was up again under 2 hours later, in agony. The main concern was that the staph infection she'd apparently had in the incision a few weeks prior hadn't been kicked fully by the antibiotics, and was coming back. So off we trotted to Stanford's ER, getting there around 1am. Fortunately it was very quiet (not that it matters when you mention the magic words "chest pain") and Sarah got straight in. They did the usual battery of tests and decided to keep her in for observation, so I trundled off home for some sleep at about 5am. They told her she could go home at about 1:30pm. Apparently the problem was muscle spasms, which can happen in some people after having heart surgery (even this long after the surgery). The solution? Valium. The poor girl's going to rattle soon with all these pills. They did some blood work and there's no sign of the staph infection. Whatever pain medication they gave Sarah intravenously today made her extremely nauseous, and she was still concerned about the state of the incision around the area that had been weeping previously, so we trekked back in to Stanford this afternoon to see the cardiologist, who wasn't concerned about the incision at all. In fact, he said the surgical doctor had been a bit generous with pronouncing a staph infection in the incision two weeks previously, saying that the swab they took at the time probably just picked it up off Sarah's skin, where it's quite common to be found. So she may never have had a staph infection in the first place.

A few days ago, I asked how to fork a debian package privately. I got some repsonses by comments, e-Mail and other blog posts, and I want to summarize the tools that were suggested. I have not really tried them, just looked at the webpages, the documentation or the sourcecode. I m only including Debian-specific solutions, as using Gentoo might be nice, but is out of scope here :-)I also deleted half the text before saving it, and I hate rewriting stuff, so it might be a bit terse.debtooEddy Petri or tells me about his three year old project debtoo, which wants to bring a Gentoo-like experience to Debian. While it probably provides what I need, it feels too big in that it has a more general aim than what I m looking for. It is not in Debian and not actively developed in the last two years.srcinstEddy also tells me about srcinst, which is a small haskell program written by jgoerzen in 2005. This is more a proof-of-concept that builds a package and all necessariy build-dependencies without using a binary package, but does not allow for patches to be applied. It is in Debian, actively maintained, but not developed, and barely documented (just an IRC log).apt-buildA similar tool and also in Debian is apt-build. This package is created to compile packages for optimization (as it asks half a dozend compiler-flag-questions with DebConf during the installation). It allows the user to apply a patch to the source, but it has to be passed as a command line option, and patches seem not to be tracked. Not much development in the last year, and not much documentation.debpatchNot to be confused with the program in the debdelta package is the debpatch tool by Victor Hsieh which Carsten Hey told me about. Also written in 2005, this comes closest to what I want. For every package you want to modify, you can configure it to apply patches to the source, to add patches to the debian/patches directory or to statically replace files in the generated binary and puts it in a local apt repository. No code yet to track new versions of the packages and no support for pbuilder though. This perl script is not yet in Debian, but is available as a Debian package and seems to have seen some development in the last years. Quick Googleing does not return any user reports; has any already tried this?customdebSomewhat in this direction goes the script that I wrote two weeks ago for a totally different project, customdeb, but it is aimed at binary debian files exclusively, and debpatch already supports replacing files in the binary package.Summary I found a few projects that go in a similar direction, and one that seems to fit my needs quite well. All of them are not widely used and in a very early state of development. I m actually surprised that this is not a itch more people had to scratch! I will have a closer look at debpatch when I find the time and maybe, if found useful, see if it can be included in Debian probably after a name change, since we already have a debpatch binary.

A few days ago, I asked how to fork a debian package privately. I got some repsonses by comments, e-Mail and other blog posts, and I want to summarize the tools that were suggested. I have not really tried them, just looked at the webpages, the documentation or the sourcecode. I m only including Debian-specific solutions, as using Gentoo might be nice, but is out of scope here :-)I also deleted half the text before saving it, and I hate rewriting stuff, so it might be a bit terse.debtooEddy Petri or tells me about his three year old project debtoo, which wants to bring a Gentoo-like experience to Debian. While it probably provides what I need, it feels too big in that it has a more general aim than what I m looking for. It is not in Debian and not actively developed in the last two years.srcinstEddy also tells me about srcinst, which is a small haskell program written by jgoerzen in 2005. This is more a proof-of-concept that builds a package and all necessariy build-dependencies without using a binary package, but does not allow for patches to be applied. It is in Debian, actively maintained, but not developed, and barely documented (just an IRC log).apt-buildA similar tool and also in Debian is apt-build. This package is created to compile packages for optimization (as it asks half a dozend compiler-flag-questions with DebConf during the installation). It allows the user to apply a patch to the source, but it has to be passed as a command line option, and patches seem not to be tracked. Not much development in the last year, and not much documentation.debpatchNot to be confused with the program in the debdelta package is the debpatch tool by Victor Hsieh which Carsten Hey told me about. Also written in 2005, this comes closest to what I want. For every package you want to modify, you can configure it to apply patches to the source, to add patches to the debian/patches directory or to statically replace files in the generated binary and puts it in a local apt repository. No code yet to track new versions of the packages and no support for pbuilder though. This perl script is not yet in Debian, but is available as a Debian package and seems to have seen some development in the last years. Quick Googleing does not return any user reports; has any already tried this?customdebSomewhat in this direction goes the script that I wrote two weeks ago for a totally different project, customdeb, but it is aimed at binary debian files exclusively, and debpatch already supports replacing files in the binary package.apt-srcAlso a related tool Carsten Hey told me about is apt-src. This tool wants to provide apt-like features for source packages. It allows you to install sources somewhere, upgrade the source and build binary packages from them. It does not really hide the sources from the user and seems to be created for people who want to work with the source somehow. If you have local changes to the sources, it can try to merge them with the new version, but these changes are not kept as a separate patch but only as implicit changes. If that were different, it would seem be a very nice tool. It s written by Joey Hess he abondonned it in 2004. Since then, not much development has happened.debnestYet another approach is taken by debnest, which Peter Makholm took over. Here, you create a full debian source package with a debian/ directory containing a control and rule file etc., but besides the debian/ directory, it contains just the packed sources (.dsc et al) from another package. In your debian/rules, you can specify your changes. I can see no support for tracking new versions of the inner package, but at least this project is maintained and in Debian.Summary I found a few projects that go in a similar direction, and one that seems to fit my needs quite well. All of them are not widely used and in a very early state of development, and it seems to be something people start to work on and quickly lose interest. I m actually surprised that this is not a itch more people had to scratch! I will have a closer look at debpatch when I find the time and maybe, if found useful, see if it can be included in Debian probably after a name change, since we already have a debpatch binary. Or maybe I should try to add support for what I need to apt-src, which seems to be the most advanced of all these programs, although it s unmaintained longer than the others exist.Update: Added apt-src.Update 2: Added debnest;

The problem with the Internet is that it never goes to sleep. And if you study the Internet as I do, that means spending a lot of time starting at the screen tagging, copying, pasting, downloading, watching, and assessing. I have taken a step or two back away as I have moved from life as a postdoc to working full time but ever since Anonymous declared war on Scientology last month, I have been spending more time online again (more than I want to at least), tracking and following some of their developments, including spending time on some of their IRC channels, downloading lots and lots of videos as well as all sorts of great flyers. Well today there was an IRL action loosely coordinated by Anonymous to protest the CoS and I have to say, I am simultaneously surprised and unsurprised at what I think was a pretty vigorous response and turnout. I was not too surprised as the attack against and criticism of Scientology is one of the older wars spurred on in part by the net and net ethics and it always seems to crop of from time to time. But I think the depth of smack talking I witnessed on IRC, (often clearly youthful in nature as this example reveals—>, [mizzanon] I will have my full license in approx. 3-4 weeks, as soon as I do, i will be driving around my entire region with tons of
anti-propaganda) led me to believe that they could not pull of this global day of action. But they did and perhaps with the exception of New Zealand (where there are probably better things to do anyway), they seemed to garner a fair bit of participants. It will be interesting to see how long they will continue to generate this type of support. The next day of action will be around the middle of March.

Today, I orphaned AUB -- my very first Debian package and the first free software project whose maintenance I took over. I had been helping and doing work in Debian and the free software community for some time but AUB was the first package I uploaded into Debian with my own name in the maintainer field and with my key in the Debian keyring. AUB is a program for working with Usenet binaries. As late as 2002 perhaps, it was a pretty useful tool for a variety of things. Today, however, it doesn't seem to be useful for much more than indiscriminately downloading large amounts of porn and spam. The software is crusty and written in Perl 4 which, today, seems almost unforgivable. Like Usenet, AUB's day has come and gone. During my maintenance of the package, I ended up taking over upstream development and writing and integrating quite a few new features and patches. In fact, there still seem to be a few users! Unfortunately, I am not one them and I officially gave up on upstream maintenance a few months ago and contacted the submitters of all pending bug reports. Today I'm orphaning the Debian package and completely letting go. None of this is particularly noteworthy, I suppose. If AUB was ever important, it hasn't been for a long time. I think its worth mentioning because it's symbolic of the completion of the life cycle of a free software project that was important in my own growth. Languages, the world, and even I have moved on. In the process, I've grown hugely as a developer, programmer, and free software activist and advocate. Minor as it be, AUB played an important role in this whole process. If you are interested in taking over AUB, please let me know. Otherwise, I'm just as happy to let it disappear.

Today I've been mostly unwell. Although I have managed to write some minor new code, and watch a little bit of Doctor Who on DVD. Recently several people have been ranting about Ruby on Rails. I like it, but I wouldn't use it for personal development in a hurry. Deployment is fiddly, and upgrades are annoying. But one thing that I utterly condemn Rails for is helping to spread bad paging throughout the online world. So, what is "bad paging" and why is it important? Well cool URLs don't change, right? "Bad paging" is any user-interface which presents you with a limited view upon a changing list of items which is non-bookmarkable. Consider the following "list". Assume it represents your view of a collection of items numbering 100+. You may only view ten items at a time; clicking "next", or "previous", to navigate your viewport:

1.  first item
2.  second item
..
10. tenth item
[see next: /start/1] [see prev]

Whats wrong with this picture? It is subtle, but this list is broken. The issue is that when the list grows new items are prepended to the front, yet the navigation is linked to the starting page number. If that description wasn't clear consider what happens if you want to bookmark the page containing item 11. How can you? Right now it is at /start/1. If a ten new items are appended to the head of the list then it will instead become /start/2 - as items that are currently numbered 1-10 will be shifted forward to become items 11-20, and and they will be on page /start/1 instead. The solution is simple enough once you consider what you want to happen:

• Either append items to the end of the list.
  • Such that /start/1 always gives the items 11-20.
• Number the links in the reverse order.

So why does nobody do that? (As a counter example look at my website: Rather than the 'Show previous' items linking you to the changing link /start/1, it instead links you to /start/569 (for example).

... are still there, even if I don't blog about every single bit all the time. Most of the packages I care about are in good state, I even did jump on board of irssi co-maintaining and got its bugcount down a fair bit (though I won't rest at this stage, there are still some to go) and did jump onboard of the pkg-games Team. ... which brings me to wesnoth. For quite a while I am tracking the stable releases (1.2.x) of wesnoth in unstable while the development releases (1.3.x) are followed in experimental. With the upcoming stable release 1.4 this though will change. The development branch is feature frozen and thus will be (propably) compatible with the next stable release, and furthermore the current stable release isn't expected to receive any further update. My plan is thus to upload the next development release directly to unstable. If you want to give it some additional testing before that happens pull the package from experimental now and give your feedback, thanks. Furthermore I am also tracking some packages for backports.org. I usually do the packaging of it almost synchronous to its upload into unstable although it is only allowed onto backports.org when it entered testing. For the timegap in between you can usually find it on my website repository. Directories that aren't empty there have some upload to backports pending and you can feel free to test the packages and send me feedback on them. Currently this includes bacula, slony1 and postgresql-8.3. One last note, finally it happened: apache1 isn't anymore. There were two packages left in testing until recently which got their removal requests adjusted. Thanks to everyone involved in keeping track of this and helping cleaning up the archive.

Cannot help but laugh and share.
I've been triaging and trying to reproduce some oldish bugs on pkg-perl's packages. Some bugs are no longer there, some have to be forwarded upstream, and so on. Usual tasks, yes.
Until I stumbled with #406227. I just have to laugh and share! Hope nobody feels ashamed - The bug is the result of different people coding maybe under pressure and with quite different mindsets :)
For some reason I fail to understand, the submitter's test case (rot13 implemented over a HTTP proxy) is invoked in the report as ./rot13 2>/dev/null. Of course, when trying to debug a bug report, the first thing to do is not to ignore STDERR. So, off goes the 2>/dev/null. What happens next? 0 gwolf@mosca[2]/tmp$ perl ./rot13 &
[1] 4394
0 gwolf@mosca[3]/tmp$ GET -p http://localhost:8080/ http://www.debian.org/
Can't locate object method "filter" via package "UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)" (perhaps you forgot to load "UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)"?) at /usr/share/perl5/HTTP/Proxy/FilterStack.pm line 126.
500 EOF when chunk header expected WTF... Well, at least the program name gives me a clue... Lets try to "decrypt" the error message... gwolf@mosca[4]/tmp$ echo 'UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)' rot13
HTTP::Proxy::BodyFilter::simple=HASH(0x604160) hrm... How comes the filter is filtering its own code and only then refusing to find itself!? Ok, time to open up the manpage - Remember, I'm only group-maintaining this pacakge, I am not yet at all familiar with it! Ok, so the core of the filter is when the submitter states: my $proxy = new HTTP::Proxy();
$proxy->push_filter(response => new HTTP::Proxy::BodyFilter::simple(sub tr/a-zA-z/n-za-mN-ZA-M/; )); While the manpage states it should be invoked as: my $filter = HTTP::Proxy::BodyFilter::simple->new( sub $ $_[1] =~ s/foo/bar/g; );
$proxy->push_filter( response => $filter ); Of course, once looking at it, the answer is simple: The submitter left out which element to act on in the anonymous function body - The $ $_[1] =~ part. Adding it makes gur svygre jbex nf rkcrpgrq... Err, sorry - makes the filter work as expected. Now, bonus points: For the non-Perlers out ther: How come we get the namespace translated as well? Oh, that's very simple: In Perl, as in Python (and concievably other languages I'm unaware of), the object is passed to any of its methods as the first argument. Functions in Perl receive their arguments via @_ (read: the default array). And, of course, the tr (regex-based transliteration) takes by default the first thing it sees - the object itself. And what happens when you apply a (string-oriented) regex to an object? Of course, it gets stringified - which, by default, in Perl means converting it to the closest possible description: "a hash reference blessed as an object of the class such-and-such at this memory location". That string gets worked on, and we get UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160). This proxy does not die on very-very-short web pages, where the whole content fits on one iteration of the code (although it does not work correctly - the text remains unaltered, of course, as it was not worked on), but if the request spans several chunks, the second time the filter is called, it will be... just gibberish. Oh, and what about the extra $ (...) around $_[1]? Oh, simple: The string is passed as a scalar reference, so it can be modified in place. Yes, it's the Perl way of pass-by-reference instead of pass-by-value (the default behaviour): Of course the parameter is only passed as a value. Only that the value is incidentally a reference - but who cares? ;-) Anyway... Many oddities. I would implement the module in a completely different way, and it looks quite backwardish in my book. But then again, TIMTOWTDI.

So a few folks left some interesting comments in response to my link to the article on the rise of the alpha-girl based on the research of Harvard psychologist, Dan Kindlon. My response to both Joe and Karl is that it is worthy to lower the barriers to entry not because girls will change the cultural ecology of geekdom in positive ways (though they may) or because geekdom is inherently “omg totally awesome!!!!!!!!!!!!!!!!!!!!” but for a much more mundane reason: it may allow girls to follow interests and eventually discover a passion. I think it is a great idea if more women were involved in geekdom and open source development not because it is inherently great but because I am sure there a lot of women out there who would enjoy it (and by extension, I am sure a lot who would not). By highlighting this article I am not advocating some forced hacker-female-labor-migration-policy but pointing to the fact that social conditions outside of geekdom play a role in ensuring more participation among women. But let me explain a few things before I argue my position a little further. First a little clarification, especially now that I have read the article. By alpha the author does not mean dominant, aggressive, and totally jerky, which is what might immediately come to mind when you read/hear alpha (especially if one knows any alpha-geeks or alpha-lawyers for that matter, who are much worse, imho). And I certainly don’t want any more alpha-anything (alpha-women, alpha-dogs, alpha-cats, alpha-hamsters ) given our world is already chock-full of alpha-jerks. By using the term, the author basically means confidence, which apparently is on the rise among girls, leaving them much more likely to be go-getters, undaunted by explicit and implicit barriers and obstacles and thus more likely then ever to enter arenas that have been thought of as traditionally male or in fact totally dominated by males. If this trend is indeed in place, I think it is great and I hope that this eventually translates into more girls/women populating traditionally male areas whether it is neurology, movie directing, hacking, or surfing. What I appreciate about the article is that his research can help us question the idea that women are naturally averse to competition due to their estrogenic hormones while boys, brimming with testosterone, just love it and exude it. I never identified with that conventional well-worn script, in part because I guess I am fairly confident and somewhat competitive. Being in academia for the last 10 years, I have witnessed a lot of really confident women that have helped inspire me and keep me going, especially when times got rough. What is fascinating about the article (and by extension probably his book) is that gender parity and equity and changes in the psychological makeup of women have not changed overnight but have taken a much longer time to settle in place. We are only now bearing the fruits of structural and educational changes first instituted decades ago and that tackled some serious forms of discrimination. As a result, we are seeing girls and women donning a deeper confidence that may help them participate with more success in the arenas they want to whether it be sports or in the workplaces (though there are certainly still major barriers and issues, which are addressed in the article). So why would someone want to participate in the world of free software and hacking in particular? My first answer is there may be any number of reasons why anyone, female or male or transgender or whatever, may want to do so for the love of technology, to feel an intense belonging to a community who share your passions and who work together to create something with a lot of value, to enjoy the challenge of learning, to spread freedom to every corner of the earth, etc… It is not that geekdom is inherently fun and exciting but that it will be interesting to some slice of the population men or women (or other) and what is the harm in lowering the barriers to entry, especially if it brings enjoyment and frankly a lot of economic security too? There are a number of girls/women who already find it worthwhile and I am sure many more who would. And the point is not to create some policy to make sure that we shuttle women into hackerdom but as a society we should equip them with the necessary psychological tools so that if they think this is worthwhile, and discover that they love it, etc, they will dare to venture in there and more importantly, stay if they want to. In terms of Karls point that a lot of people are professional geeks in part because they d have trouble being anything else; like being gay, it s not a choice, I think that is far too narrow of an assessment, not to mention an outdated caricature of geeks. While there is certainly a class of socially awkward geeks (if that is what you mean??), I would say they are in the minority though they may certainly stand out precisely because they are the odd ducks and because the stereotype is so entrenched. Many geeks I have met, while they may pretty darn focused on geekdom, also have full and rich lives/personalities that cannot be easily collapsed into one immutable personality type. Yes they may be obsessed with tech but aren’t doctors, academics, musicians, lawyers sort of fanatical too? I spend like my whole week working on academic stuff (part of necessity, part out of love). And at least hacking has way better conferences and economic perks, which may help explain why people stay Finally, I think you assume a little to strongly that we do what we do because we have a pre-formed existing desired to do so. While I think this is the case for many things (and I knew the minute I learned about anthropology, I wanted to be one, which was odd but it proved to be correct), I think desire is also formed as much through experience and hence the importance of exposure to different worlds and experiences. I know that there are many things I could have never imagined I would have loved–karoake and sailing are two things that come to mind—until I tried them about both took some degree of courage. In the later case, it took a lot of guts to move onto some ship at the age of 18 instead of going to college and I am so glad I did. This is an instance where confidence and an initial curiosity led to discovering a love and passion I never knew I had. So if desire can be formed and not just expressed, I think it is key to make sure people have all sorts of opportunities to cultivate the passions they never knew they had.