Search Results: "andy"

25 July 2010

Russell Coker: Links July 2010

David Byrne gave an interesting TED talk about how changes to architecture drove changes to musical styles [1]. I think he does stretch the point a little. To a certain extent people develop the most complex instruments and the largest music halls that can be supported by the level of technology in their society people with a hunter-gatherer civilisation play drums because they can build them and can carry them. The NY Times has an interesting article about paternity leave in Sweden [2]. The Swedish government pays for a total of 13 months leave that can be split between parents for every child. Of those 13 months 2 months can only be taken by the father and that is likely to increase to a minimum of 4 months of paternity leave after the next election. Dan Meyer gave an interesting TEDX talk about how the current math curriculum in the US (as well as Australia and lots of other countries that do the same thing) is totally wrong [3]. His main point is that maths problems should be based on real-world use cases where not all needed data is immediately available and there is also useless data that must be discarded. He believes that the most important thing is developing mathematical problem solving skills basically the things that I did for fun when I was in primary school are skills that need to be taught to high-school students The Atlantic magazine has an amusing article by Daniel Byman and Christine Fair about the incompetent Islamic terrorists [4]. In Afghanistan half the suicide bombers kill only themselves and the US government has a lot of evidence of Taliban soldiers practicing bestiality and collecting porn. Islamic extremist groups are staffed by people who are bad soldiers and bad Muslims. Jon Masters wrote an interesting post titled What Would Jesus Buy about ethical purchasing decisions [5]. Jon references The Church of Stop Shopping which isn t a real religious organisation but a street theatre activist group. ZeroHedga has an insightful article comparing corporations and the US government to street gangs [6]. The conclusion is that when gangs take over a neighbourhood everyone has to join a gang for their own protection. Hillel Cooperman gave an interesting TED talk about being obsessed with Lego [7]. He compares Lego fans to Furries and makes a good case for this comparison. Marian Bantjes gave an interesting TED talk about her graphic art / graphic design work [8]. I ve never seen anything quite like this. Business Insider has an interesting article about oil cleanup, it seems that most people who worked on the Exxon Valdez disaster are now dead [9], s opposed to most people who worked in almost every other occupation at that time who are either still working or enjoying their retirement. The current gulf disaster is bigger, will require more workers for the cleanup, and can be expected to have a higher death toll. Some people claim that measures to reduce oil efficiency will impact the economy, how will millions of people who are chronically ill for the rest of their lives impact the economy? The NY Times has an interesting article on circle lenses [10], contact lenses designed to make the eyes look larger. It s illegal to sell contact lenses in the US without a prescription, but the latest trend is for women to buy them online in a variety of colors. The FDA should probably approve them, it would be better to have the quality controls you expect from a medical supply company instead of having people rely on Malaysian mail-order companies for the safety of their eyes. Don Marti has written an interesting article about the economic decline in the US, he suggests making pension funds invest in local jobs [11]. Companies are supposed to act on behalf of their stock-holders, but US companies often have the majority of their stock owned by the pension funds of workers but they act on behalf of a small number of rich people who own a minority of the stock. Don s article was inspired by Andy Grove s article in Bloomberg about the stagnation in technological development that has been caused by off-shoring the manufacturing [12]. Neil Brown has completed a test release of a new Linux software RAID feature for arrays with multiple redundancy that have bad sectors [13]. When a disk gets a bad sector the current behavior is to kick it out of the array, if you have two such errors on a 3 disk RAID-1 or a RAID-6 array then you lose all redundancy and are at risk of catastrophic failure even though in most cases both disks will still mostly work. With this patch some regions of the disk may be excluded but it can provide redundancy for other stripes. Thanks Neil for your great work here, and all your previous work over the last 10+ years! The RSPCA has a new campaign titled Close the Puppy Factories [14]. Dogs are kept in very poor conditions and forced to churn out puppies for their entire lives to supply pet stores. The RSPCA recommends that people buy puppies from registered dog breeders (not registered dog breeding companies ) and ask to see the dog s parents. They also recommend not buying from classified adverts or pet stores. Animal shelters have to euthenise huge numbers of unwanted animals, you can buy a pet dog or cat from an animal shelter for a small fee that covers the expenses related to housing and spaying it and save that animal from being euthenised! Maureen Dowd criticises the Catholic Church properly in an article for the New York Times [15]. The Catholic Church officially regards ordaining a woman and raping a child to be equally bad offenses. Frank Rich wrote an interesting column for the New York Times about Mel Gibson [16]. He describes the destruction of Mel Gibson s reputation as a symptom of changes in the culture in the US and also links it to the fall of Ted Haggard (who supported Gibson s most notorious movie The Passion of the Christ).

Joey Hess: git source packages: take 2

My patches to convert the 3.0 (git) source format to use git bundles have landed in dpkg's git repository and will be in dpkg 1.15.8. I think this second attempt at 3.0 (git) has worked out much better than the first. (Though the first was a pretty good success overall, since it also led all the other 3.0 formats eventually. ;) Perhaps the intervening years of git experience helped. The code is much simpler, with none of the ad-hoc hacks from the first version. The resulting git bundles can be manually cloned using git-bundle(1) where dpkg-source is not available. There are two handy new features that can be controlled by debian/source/options. git-ref can be used to limit the branches/tags/etc that are included in the source package. And git-depth can cause a shallow clone of specified depth to be created and bundled.
dpkg-source: info: using options from debhelper/debian/source/options: --git-ref=gitsrc --git-ref=master --git-depth=10
dpkg-source: info: using source format  3.0 (git)'
dpkg-source: info: creating shallow clone with depth 10
dpkg-source: info: bundling: gitsrc master
A demo source package is here.
joey@gnu:~/tmp/t>dget http://kitenet.net/~joey/tmp/debhelper_7.9.4.dsc
...
dpkg-source: info: extracting debhelper in debhelper-7.9.4
dpkg-source: info: cloning debhelper_7.9.4.git
dpkg-source: info: setting up shallow clone
joey@gnu:~/tmp/t>ls -l
total 392
drwxr-xr-x 10 joey joey   4096 Jul 25 13:58 debhelper-7.9.4/
-rw-r--r--  1 joey joey   1779 Jul 25 13:58 debhelper_7.9.4.dsc
-rw-r--r--  1 joey joey 388859 Jul 25 13:58 debhelper_7.9.4.git
-rw-r--r--  1 joey joey    738 Jul 25 13:58 debhelper_7.9.4.gitshallow
joey@gnu:~/tmp/t>cd debhelper-7.9.4 
joey@gnu:~/tmp/t/debhelper-7.9.4>git branch -a
* gitsrc
  remotes/origin/HEAD -> origin/gitsrc
  remotes/origin/gitsrc
  remotes/origin/master
Notice that the branch I was in when I built the package is preserved, and the 19 revisions included in the shallow clone (10 per branch) take up very little space of course. This particular git source package turned out 30k larger than the tar.gz. I am considering adding two other features: I hope the next step will be for git source packages to be accepted in the Debian archive.

23 July 2010

Steve Kemp: I'm a CPAN author.

As of this morning I'm a published author on CPAN! Thus far I have only a single module to my name, but that will most likely change in the future:
CGI::Session::Driver::redis
A module for storing (CGI) session data within a Redis database.
A while back I setup a dynamic website which was 100% redis backed, using my redis backports for lenny, and realised I needed somewhere to store the session data too. Hence this module. I'll create a .deb package of the module, and stick it alongside the redis server. ObQuote:I like to keep this handy... for close encounters.

Aliens

20 July 2010

Russell Coker: Digital Video Cameras

I ve just done some quick research on Digital Video Cameras for some relatives. It seems to me that the main feature that is necessary is Full HD (1920*1080) resolution as everyone seems to be getting 1920*1080 resolution monitors (getting smaller doesn t save enough money to be worth-while). Resolutions higher than 1920*1080 will probably available in affordable monitors in the next few years, so the ability of programs like mplayer to zoom videos will probably be required even for Full HD video soon. Saving maybe $300 on a video camera while getting a lower resolution doesn t seem like a good idea. The next feature is optical zoom, most cameras are advertised with features such as advanced zoom to try and trick customers, cameras which advertise 60* or better zoom often turn out to only have 20* zoom. I think that about 20* optical zoom should be considered the minimum, not that there is anything special about 20* zoom, it s just that there is a good range of cameras with better zoom capacity. Image stabilisation is a required feature, no-one can keep their hand perfectly steady and the typically a DVC only gets hand-held use most people who own them don t even own a tripod! Digital image stabilisation is apparently not nearly as good as optical image stabilisation, and image stabilisation that involves moving the CCD is apparently somewhere in between. Finally it s good to have the ability to take quality photos as few people will want to carry a Digital Camera and a Digital Video Camera. I did a search for DVCs on the web site of Ted s Camera store (a chain of camera stores in Australia that generally provide good service at a competitive price but not the cheapest price). The best of the Ted s options seems to be the Panasonic SD60 HD Video [1] which does 25* optical zoom, 1920*1080i video, 5 megapixel still photography, and optical image stabilisation it costs $750 from Ted s. The next best option seems to be the Sony Handycam HDR-CX110 HD [2] which does 25* optical zoom, 1920*1080i video, 3.1 megapixel 2048*1536 still photography, and digital image stabilisation. The Panasonic seems to be a better option due to having optical image stabilisation and a higher resolution for still photographs. It is also $750 from Ted s. Now there s the issue of how well the cameras work on Linux. A quick Google search indicated that the Sony cameras present themselves as USB card readers and can be mounted on a Linux system, I couldn t discover anything about the Panasonic. If I was going to buy one I would take my Netbook to the store and do a quick test. I don t have enough information to recommend either of those cameras, they may have some awful defects that are only apparent when you use them. But in terms of features they seem pretty good. The Panasonic SD60 HD Video should be a good benchmark when comparing cameras in the store. If nothing else the camera store staff seem to not be very helpful if asked generic questions such as which camera is best , but if asked questions such as how is this other camera better than the one I m looking at they can usually give good answers. If anyone has any other advice for purchasing a DVC then please let me know. Either generic advice or specific examples of Linux-friendly DVCs that have been purchased recently.

29 June 2010

Russell Coker: Play Machine Online Again with Xen 4.0

My SE Linux Play Machine [1] has been offline for almost a month (it went offline late May 30 and has just gone online again). It s the sort of downtime that can happen when you use Debian/Unstable. For a while I ve been using a HP E-PC (a SFF desktop system with 256M of RAM and a P3-800 CPU) to run my SE Linux Play Machine. I run it under Xen to make it easier for me to watch what happens. I ve had some problems with increased memory use in the Xen Dom0 in Squeeze [2]. The latest installment of the memory problems is when I discovered that I can t run two copies of tcpdump (for tracing separate interfaces) at once on a Xen Dom0 that has ~110M of RAM this seems unreasonable, I m sure that back when a big server had 128M of RAM I could have done such things! So now I m using a Thinkpad T20 with 512M of RAM for my new SE Linux Play Machine, it uses less power than most systems (probably even less than the HP E-PC) and is very quiet. I was forced to install on a new system when I broke my GRUB configuration. GRUB-2 in Debian currently has no support for generating a configuration that will boot a Xen Dom0. You can manually edit the GRUB configuration to get this working, but if you get it wrong then you can make GRUB not even display a prompt and force a reinstall (as I did). As an aside it would be really handy if someone would create a CD or USB bootable image that does nothing but install GRUB. Such an image would ideally allow replacing the configuration of an existing GRUB, overwriting an existing GRUB installation (all files in /boot/grub get replaced), or formatting a spare partition (default swap space) and installing GRUB there. My current solution to the GRUB problems is to use the old version of GRUB in the grub-legacy package. The old version of GRUB has always done everything I want so I don t seem to be missing anything by not using the new version. I m happy to refrain from using Ext4 for /boot and have no desire to have /boot on an LVM volume. Most of the month of down-time for my Play Machine was caused by bugs in the SE Linux policy I m developing for Squeeze, while they weren t difficult bugs I haven t had much time to work on them consistently. I m still running the Play Machine on Lenny, but the Dom0 is running Unstable.

27 June 2010

Matt Zimmerman: Navigating the PolicyKit maze

I ve written a simple application which will automatically extract media from CDs and DVDs when they are inserted into the drive attached to my server. This makes it easy for me to compile all of my media in one place and access it anytime I like. The application uses the modern udisks API, formerly known as DeviceKit-disks, and I wrote it in part to learn get some experience working with udisks (which, it turns out, is rather nice indeed). Naturally, I wanted to grant this application the privileges necessary to mount, unmount and eject removable media. The server is headless, and the application runs as a daemon, so this would require explicit configuration. udisks uses PolicyKit for authorization, so I expected this to be very simple to do. In fact, it is very simple, but finding out exactly how to do it wasn t quite so easy. The Internet is full of web pages which recommend editing /etc/PolicyKit/PolicyKit.conf. As far as I can tell, nothing pays attention to this file anymore, and all of these instructions have been rendered meaningless. My system was also full of tools like polkit-auth, from the apparently-obsolete policykit package, which kept their configuration in some other ignored place, i.e. /var/lib/PolicyKit. It seems the configuration system has been through a revolution or two recently. In Ubuntu 10.04, the right place to configure these things seems to be /var/lib/polkit-1/localauthority, and this is documented in pklocalauthority(8). Authorization can be tested using pkcheck(1), and the default policy can be examined using pkaction(1). I solved my problem by creating a file in /var/lib/polkit-1/localauthority/50-local.d with a .pkla extension with the following contents:
[Access to removable media for the media group]
Identity=unix-group:media
Action=org.freedesktop.udisks.drive-eject;org.freedesktop.udisks.filesystem-mount
ResultAny=yes
This took effect immediately and did exactly what I needed. I lost quite some time trying to figure out why the other methods weren t working, so perhaps this post will save the next person a bit of time. It may also inspire some gratitude for the infrastructure which makes all of this work automatically for more typical usage scenarios, so that most people don t need to worry about any of this. Along the way, I whipped up a patch to add a --eject option to the handy udisks(1) tool, which made it easier for me to test along the way.

22 June 2010

Craig Small: Book: Do Androids Dream of Electric Sheep?

Actually they're more interested in freedom, to be no longer slaves to humans. I don't think it's any spoiler to mention that an electric sheep does appear in the book.

This is a classic science fiction story of a dark not-so-distant future. In fact given that it's over 40 years old it could be set in some alternate now. Some disaster has occurred and many have either left earth or died. Some andriods, or andys have escaped and bounty hunters are after them.

You may not know the book by its correct title, but you may of heard the movie that is based upon it, called Blade Runner. Like most movies based on books, it takes some of the concepts and ideas of the book but in my opinion is a pale imitation.

I'm glad I read this book. It hasn't aged that much and it's very though provoking. Sci-Fi often uses some alternate reality to put a mirror up to what happens in the real world and this book is no exception.

And a token link to Debian, if you want you own electric sheep you can install the screensaver electricsheep package which draw pretty fractals on your screen.

<script defer="defer" src="http://static.zemanta.com/readside/loader.js" type="text/javascript"></script>

16 June 2010

Christoph Berg: Cool Unix Features: /dev/full

I've always thought about collecting random bits of useful/interesting/cool Unix features and the like. Before I let that rot indefinitely in a text file in my $HOME, I'll post it in a series of blog posts. So here's bit #1: Everyone knows /dev/null, and most will know /dev/zero. But /dev/full was unknown to me until some time ago. This device will respond to any write request with ENOSPC, No space left on device. Handy if you want to test if your program catches "disk full" - just let it write there:
$ echo foo > /dev/full
bash: echo: write error: No space left on device

13 June 2010

Petter Reinholdtsen: Lenny->Squeeze upgrades, removals by apt and aptitude

My testing of Debian upgrades from Lenny to Squeeze continues, and I've finally made the upgrade logs available from http://people.skolelinux.org/pere/debian-upgrade-testing/. I am now testing dist-upgrade of Gnome and KDE in a chroot using both apt and aptitude, and found their differences interesting. This time I will only focus on their removal plans. After installing a Gnome desktop and the laptop task, apt-get wants to remove 72 packages when dist-upgrading from Lenny to Squeeze. The surprising part is that it want to remove xorg and all xserver-xorg-video* drivers. Clearly not a good choice, but I am not sure why. When asking aptitude to do the same, it want to remove 129 packages, but most of them are library packages I suspect are no longer needed. Both of them want to remove bluetooth packages, which I do not know. Perhaps these bluetooth packages are obsolete? For KDE, apt-get want to remove 82 packages, among them kdebase which seem like a bad idea and xorg the same way as with Gnome. Asking aptitude for the same, it wants to remove 192 packages, none which are too surprising. I guess the removal of xorg during upgrades should be investigated and avoided, and perhaps others as well. Here are the complete list of planned removals. The complete logs is available from the URL above. Note if you want to repeat these tests, that the upgrade test for kde+apt-get hung in the tasksel setup because of dpkg asking conffile questions. No idea why. I worked around it by using 'echo >> /proc/pidofdpkg/fd/0' to tell dpkg to continue. apt-get gnome 72
bluez-gnome cupsddk-drivers deskbar-applet gnome gnome-desktop-environment gnome-network-admin gtkhtml3.14 iceweasel-gnome-support libavcodec51 libdatrie0 libgdl-1-0 libgnomekbd2 libgnomekbdui2 libmetacity0 libslab0 libxcb-xlib0 nautilus-cd-burner python-gnome2-desktop python-gnome2-extras serpentine swfdec-mozilla update-manager xorg xserver-xorg xserver-xorg-core xserver-xorg-input-all xserver-xorg-input-evdev xserver-xorg-input-kbd xserver-xorg-input-mouse xserver-xorg-input-synaptics xserver-xorg-input-wacom xserver-xorg-video-all xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati xserver-xorg-video-chips xserver-xorg-video-cirrus xserver-xorg-video-cyrix xserver-xorg-video-dummy xserver-xorg-video-fbdev xserver-xorg-video-glint xserver-xorg-video-i128 xserver-xorg-video-i740 xserver-xorg-video-imstt xserver-xorg-video-intel xserver-xorg-video-mach64 xserver-xorg-video-mga xserver-xorg-video-neomagic xserver-xorg-video-nsc xserver-xorg-video-nv xserver-xorg-video-openchrome xserver-xorg-video-r128 xserver-xorg-video-radeon xserver-xorg-video-radeonhd xserver-xorg-video-rendition xserver-xorg-video-s3 xserver-xorg-video-s3virge xserver-xorg-video-savage xserver-xorg-video-siliconmotion xserver-xorg-video-sis xserver-xorg-video-sisusb xserver-xorg-video-tdfx xserver-xorg-video-tga xserver-xorg-video-trident xserver-xorg-video-tseng xserver-xorg-video-v4l xserver-xorg-video-vesa xserver-xorg-video-vga xserver-xorg-video-vmware xserver-xorg-video-voodoo xulrunner-1.9 xulrunner-1.9-gnome-support aptitude gnome 129
bluez-gnome bluez-utils cpp-4.3 cupsddk-drivers dhcdbd djvulibre-desktop finger gnome-app-install gnome-mount gnome-network-admin gnome-spell gnome-vfs-obexftp gnome-volume-manager gstreamer0.10-gnomevfs gtkhtml3.14 libao2 libavahi-compat-libdnssd1 libavahi-core5 libavcodec51 libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcupsys2 libcurl3 libdatrie0 libdirectfb-1.0-0 libdvdread3 libedataserver1.2-9 libeel2-2.20 libeel2-data libepc-1.0-1 libepc-ui-1.0-1 libfaad0 libgail-common libgd2-noxpm libgda3-3 libgda3-common libgdl-1-0 libgdl-1-common libggz2 libggzcore9 libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnomecups1.0-1 libgnomekbd2 libgnomekbdui2 libgnomeprint2.2-0 libgnomeprint2.2-data libgnomeprintui2.2-0 libgnomeprintui2.2-common libgnomevfs2-bin libgpod3 libgraphviz4 libgtkhtml2-0 libgtksourceview-common libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libiw29 libkpathsea4 libltdl3 libmagick++10 libmagick10 libmalaga7 libmetacity0 libmtp7 libmysqlclient15off libnautilus-burn4 libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5 libparted1.8-10 libpoppler-glib3 libpoppler3 libpt-1.10.10 libpt-1.10.10-plugins-alsa libpt-1.10.10-plugins-v4l libraw1394-8 libsensors3 libslab0 libsmbios2 libsoup2.2-8 libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1 libtotem-plparser10 libtrackerclient0 libxalan2-java libxalan2-java-gcj libxcb-xlib0 libxerces2-java libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3 mysql-common nautilus-cd-burner openoffice.org-writer2latex openssl-blacklist p7zip python-4suite-xml python-eggtrayicon python-gnome2-desktop python-gnome2-extras python-gtkhtml2 python-gtkmozembed python-numeric python-sexy serpentine svgalibg1 swfdec-gnome swfdec-mozilla totem-gstreamer update-manager wodim xserver-xorg-video-cyrix xserver-xorg-video-imstt xserver-xorg-video-nsc xserver-xorg-video-v4l xserver-xorg-video-vga zip apt-get kde 82
cupsddk-drivers karm kaudiocreator kcoloredit kcontrol kde kde-core kdeaddons kdeartwork kdebase kdebase-bin kdebase-bin-kde3 kdebase-kio-plugins kdesktop kdeutils khelpcenter kicker kicker-applets knewsticker kolourpaint konq-plugins konqueror korn kpersonalizer kscreensaver ksplash libavcodec51 libdatrie0 libkiten1 libxcb-xlib0 quanta superkaramba texlive-base-bin xorg xserver-xorg xserver-xorg-core xserver-xorg-input-all xserver-xorg-input-evdev xserver-xorg-input-kbd xserver-xorg-input-mouse xserver-xorg-input-synaptics xserver-xorg-input-wacom xserver-xorg-video-all xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati xserver-xorg-video-chips xserver-xorg-video-cirrus xserver-xorg-video-cyrix xserver-xorg-video-dummy xserver-xorg-video-fbdev xserver-xorg-video-glint xserver-xorg-video-i128 xserver-xorg-video-i740 xserver-xorg-video-imstt xserver-xorg-video-intel xserver-xorg-video-mach64 xserver-xorg-video-mga xserver-xorg-video-neomagic xserver-xorg-video-nsc xserver-xorg-video-nv xserver-xorg-video-openchrome xserver-xorg-video-r128 xserver-xorg-video-radeon xserver-xorg-video-radeonhd xserver-xorg-video-rendition xserver-xorg-video-s3 xserver-xorg-video-s3virge xserver-xorg-video-savage xserver-xorg-video-siliconmotion xserver-xorg-video-sis xserver-xorg-video-sisusb xserver-xorg-video-tdfx xserver-xorg-video-tga xserver-xorg-video-trident xserver-xorg-video-tseng xserver-xorg-video-v4l xserver-xorg-video-vesa xserver-xorg-video-vga xserver-xorg-video-vmware xserver-xorg-video-voodoo xulrunner-1.9 aptitude kde 192
bluez-utils cpp-4.3 cupsddk-drivers cvs dcoprss dhcdbd djvulibre-desktop dosfstools eyesapplet fifteenapplet finger gettext ghostscript-x imlib-base imlib11 indi kandy karm kasteroids kaudiocreator kbackgammon kbstate kcoloredit kcontrol kcron kdat kdeadmin-kfile-plugins kdeartwork-misc kdeartwork-theme-window kdebase-bin-kde3 kdebase-kio-plugins kdeedu-data kdegraphics-kfile-plugins kdelirc kdemultimedia-kappfinder-data kdemultimedia-kfile-plugins kdenetwork-kfile-plugins kdepim-kfile-plugins kdepim-kio-plugins kdeprint kdesktop kdessh kdict kdnssd kdvi kedit keduca kenolaba kfax kfaxview kfouleggs kghostview khelpcenter khexedit kiconedit kitchensync klatin klickety kmailcvt kmenuedit kmid kmilo kmoon kmrml kodo kolourpaint kooka korn kpager kpdf kpercentage kpf kpilot kpoker kpovmodeler krec kregexpeditor ksayit ksim ksirc ksirtet ksmiletris ksmserver ksnake ksokoban ksplash ksvg ksysv ktip ktnef kuickshow kverbos kview kviewshell kvoctrain kwifimanager kwin kwin4 kworldclock kxsldbg libakode2 libao2 libarts1-akode libarts1-audiofile libarts1-mpeglib libarts1-xine libavahi-compat-libdnssd1 libavahi-core5 libavc1394-0 libavcodec51 libbluetooth2 libboost-python1.34.1 libcucul0 libcurl3 libcvsservice0 libdatrie0 libdirectfb-1.0-0 libdjvulibre21 libdvdread3 libfaad0 libfreebob0 libgail-common libgd2-noxpm libgraphviz4 libgsmme1c2a libgtkhtml2-0 libicu38 libiec61883-0 libindex0 libiw29 libk3b3 libkcal2b libkcddb1 libkdeedu3 libkdepim1a libkgantt0 libkiten1 libkleopatra1 libkmime2 libkpathsea4 libkpimexchange1 libkpimidentities1 libkscan1 libksieve0 libktnef1 liblockdev1 libltdl3 libmagick10 libmimelib1c2a libmozjs1d libmpcdec3 libneon27 libnm-util0 libopensync0 libpisock9 libpoppler-glib3 libpoppler-qt2 libpoppler3 libraw1394-8 libsmbios2 libssh2-1 libsuitesparse-3.1.0 libtalloc1 libtiff-tools libxalan2-java libxalan2-java-gcj libxcb-xlib0 libxerces2-java libxerces2-java-gcj libxtrap6 mpeglib networkstatus openoffice.org-writer2latex pmount poster psutils quanta quanta-data superkaramba svgalibg1 tex-common texlive-base texlive-base-bin texlive-common texlive-doc-base texlive-fonts-recommended xserver-xorg-video-cyrix xserver-xorg-video-imstt xserver-xorg-video-nsc xserver-xorg-video-v4l xserver-xorg-video-vga xulrunner-1.9

31 May 2010

Dirk Eddelbuettel: JPM Chase Corporate Challenge 2010

It's Memorial Day weekend so it was time for the Chicago's JP Morgan Chase Corporate Challenge on Thursday. The weather was glorious, the usual 20-some thousand runners participated and a good time was had. Work had arranged for a nice tent, food, music --- and a bunch of people showed up and enjoyed it. Nice one. This time we all got chip-timing via a small (rfid ?) strip tagged to back of the bib number. Which is handy as I managed to not stop my time by hand correctly. Given that I am still nursing a sore Achilles tendon and don't train well or much, the time of 23:51 (or 6:48 min/mile) was ok compared to the other seven previous times I have run this.

Stefano Zacchiroli: document your team - redux

wiki.d.o/Teams to the rescue About 3 years ago (too bad I've actually missed the 3-year anniversary by a few days!), Raphael set up http://wiki.debian.org/Teams. In my recent encounters and contacts with people interested in contributing to Debian, I've found that page to be of invaluable help. In particular, people find it very useful in understanding the macro-structures of Debian and in understanding where they can start to contribute. Approaching a team is most likely "less scary" than contacting a larger forum, and that page offers a good service of team indexing. Of course, the usefulness of wiki.d.o/Teams is directly proportional to how much complete it is and to how much individual team pages are current. So, in case you didn't know about the page or that you just remembered that years ago you set up a page there and then forgot about it, this is probably a good moment to add or update your team information there. To eat my own dog food, I've recently set up Teams/DPL, which is probably not terribly useful, but it contains interesting stuff such as where the daily activity bits are stored. (Yes: I'm just a one-person-team, but given the index is useful to document Debian "parts" in general, I believe we should allow for a slightly semantic abuse of the name.) Incidentally, that shows another way in which wiki team pages can come to the rescue: improve the documentation of our processes. For instance, we are grown accustomed to the fact that d-d-a is an authoritative information source. Well, of course it is, but when you need to find out a 4-year old d-d-a post of some core team, since it is the only documentation of some still current (is it?) procedure, let's be fair and acknowledge that a mailing list archive it's not that handy. So, summarizing relevant d-d-a posts in team pages (with references to the originals) is another way, accessible to everybody, to help in keeping docs current. I've been doing that recently for a handful of teams, and people seem to appreciate (of course it's your responsibility to check that they do appreciate).

29 May 2010

Matt Zimmerman: Extracting files from a nandroid backup using unyaffs

I recently upgraded my G1 phone to the latest Cyanogen build (5.x). Since the upgrade instructions recommend wiping user data, I made a nandroid backup first, using the handy Amon_RA recovery image. I ve gotten pretty familiar with the Android filesystem layout, and was confident I could restore anything I really missed (such as my wpa_supplicant.conf with all of my WiFi credentials). It wasn t until I finished with the upgrade that I realized the backup wasn t trivial to work with. It s a raw yaffs2 flash image, which can t be simply mounted on a loop device. After messing around for a bit with the nandsim module, mtd-utils and the yaffs2 kernel module, I realized there was a much simpler way: the unassuming unyaffs. It says that it can only extract images created by mkyaffs2image, but apparently the images in the nandroid backup are created this way (or otherwise compatible with unyaffs). So I downloaded and built unyaffs:
svn checkout http://unyaffs.googlecode.com/svn/trunk/ unyaffs
cd unyaffs
gcc -o unyaffs unyaffs.c
and then ran it on the backup image:
mkdir g1data && cd g1data # unyaffs extracts into the current directory
~/src/android/unyaffs/unyaffs /media/G1data/nandroid/HT839GZ23983/BCDS-20100529-1311/data.img
At which point I could restore files one by one, e.g.:
adb push /tmp/g1data/misc/wifi/wpa_supplicant.conf /data/misc/wifi/
After toggling WiFi off and then back on, all of my credentials were restored. I was able to restore preferences for various applications in the same way.

Russell Coker: Logging in as Root

Martin Meredith wrote a blog post about logging in as root and the people who so strongly advocate against it [1]. The question is whether you should ssh directly to the root account on a remote server or whether you should ssh to a non-root account and use sudo or su to gain administrative privileges. Does sudo/su make your system more secure? Some years ago the administrator of a SE Linux Play Machine used the same home directory for play users to login as for administrative logins as for his own logins he used newrole to gain administrative access (like su or sudo but for SE Linux). His machine was owned by one of his friends who created a shell function named newrole in one of his login scripts that used netcat to send the administrative password out over the net. He didn t immediately realise that this was a problem until his friend changed the password and locked him out! This is one example of a system being 0wned due to having the double-authentication of course if he had logged in directly with administrative privs while using the same home directory that the attacker could write to then he would still have lost but the attacker would have had to do a little more work. When you login you have lots of shell scripts run on your behalf which have the ability to totally control your environment, if someone has taken over those scripts then they can control everything you see, when you think you run sudo or something they can get the password. When you ssh in to a server your security relies on the security of the client end-point, the encryption of the ssh protocol (including keeping all keys secure to prevent MITM attacks), and the integrity of all the programs that are executed before you have control of the remote system. One benefit for using sshd to spawn a session without full privileges is in the case where you fear an exploit against sshd and are running SE Linux or some other security system that goes way beyond Unix permissions. It is possible to configure SE Linux in the strict configuration to deny administrative rights to any shell that is launched directly by the sshd. Therefore someone who cracks sshd could only wait until an administrator logs in and runs newrole and they wouldn t be able to immediately take over the system. If the sysadmin suspected that a sshd compromise is possible then a sysadmin could login through some other method (maybe visit the server and login at the console) to upgrade the sshd. This is however a very unusual scenario and I suspect that most people who advocate using sudo exclusively don t use a SE Linux strict configuration. Does su/sudo improve auditing? If you have multiple people with root access to one system it can be difficult to determine who did what. If you force everyone to use su or sudo then you will have a record of which Unix account was used to start the root session. Of course if multiple people start root shells via su and leave them running then it can be difficult to determine which of the people who had such shells running made the mistake but at least that reduces the list of suspects. If you put PermitUserEnvironment yes in /etc/ssh/sshd_config then you have the option of setting environment variables by ssh authorized_keys entries, so you could have an entry such as the following: environment= ORIG_USER=john@example.com ssh-rsa AAAAB3Nz[...]/w== john@example.com Then you could have the .bashrc file (or a similar file for your favorite shell) have code such as the following to log the relevant data to syslogd:
if [ "$SSH_TTY" = "" ]; then
logger -p auth.info "user $ORIG_USER ran command \"$BASH_EXECUTION_STRING\" as root"
else
logger -p auth.info "user $ORIG_USER logged in as root on tty $(tty)"
fi I think that forcing the use of su or sudo might improve the ability to track other sysadmins if the system is not well configured. But it seems obvious that the same level of tracking can be implemented in other ways with a small amount of effort. It took me about 30 minutes to devise the above shell code and configuration options, it should take people who read this blog post about 5 minutes to implement it (or maybe 10 minutes if they use a different shell or have some other combination of Bash configuration that results in non-obvious use of initialisation scripts (EG if you have a .bash_profile file then .bashrc may not be executed). Once you have the above infrastructure for logging root login sessions it wouldn t be difficult to run a little script that asks the sysadmin what is the purpose for your root login and logs what they type. If several sysadmins are logged in at the same time and one of them describes the purpose of their login as to reconfigure LDAP then you know who to talk to if your LDAP server stops working! Should you run commands with minimum privilege? It s generally regarded that running each command with the minimum privilege is a good idea. But if the only reason you login to a server is to do root tasks (restarting daemons, writing to files that are owned by root, etc) then there really isn t a lot of potential for achieving anything by doing so. If you need to use a client for a particular service (EG a web browser to test the functionality of a web server or proxy server) then you can login to a different account for that purpose the typical sysadmin desktop has a dozen xterms open at once, using one for root access to do the work and another for non-root access to do the testing is probably a good option. Can root be used for local access? Linux Journal has an article about the distribution that used to be known as Lindows (later Linspire) which used root as the default login for desktop use [2]. It suggests using a non-root account because If someone can trick you into running a program or if a virus somehow runs while you are logged in, that program then has the ability to do anything at all of course someone could trick you into running a program or virus that attempts to run sudo (to see if you enabled it without password checks) and if that doesn t work waits until you run sudo and sniffs the password (using pty interception or X event sniffing). The article does correctly note that you can easily accidentally damage your system as root. Given that the skills of typical Linux desktop users are significantly less than those of typical system administrators it seems reasonable to assume that certain risks of mistake which are significant for desktop users aren t a big deal with skilled sysadmins. I think that it was a bad decision by the Lindows people to use root for everything due to the risk of errors. If you make a mistake on a desktop system as non-root then if your home directory was backed up recently and you use IMAP or caching IMAP for email access then you probably won t lose much of note. But if you make a serious mistake as root then the minimum damage is being forced to do a complete reinstall, which is time consuming and annoying even if you have the installation media handy and your Internet connection has enough quota for the month to complete the process. Finally there are some services that seek out people who use the root account for desktop use. Debian has some support channels on IRC [3] and I decided to use the root account from my SE Linux Play Machine [4] to see how they go. #debian has banned strings matching root. #linpeople didn t like me because Deopped you on channel #linpeople because it is registered with channel services . #linuxhelp and #help let me in, but nothing seemed to be happening in those channels. Last time I tried this experiment I had a minor debate with someone who repeated a mantra about not using root and didn t show any interest in reading my explanation of why root:user_r:user_t is safe for IRC. I can t imagine that good the #debian people expect to gain from denying people the ability to access that channel with an IRC client that reports itself to be running as root. Doing so precludes the possibility of educating them if you think that they are doing something wrong (such as running a distribution like Lindows/Linspire). Conclusion I routinely ssh directly to servers as root. I ve been doing so for as long as ssh has been around and I used to telnet to systems as root before that. Logging in to a server as root without encryption is in most cases a really bad idea, but before ssh was invented it was the only option that was available. For the vast majority of server deployments I think that there is no good reason to avoid sshing directly as root.

26 May 2010

Nico Golde: fail2ban + dns = fail

fail2ban is used by many people to prevent certain types of DoS attacks. I use it myself to reduce trackback spam a little bit.

While this tool becomes quite handy in such situations it is also not generally recommend because you can shoot yourself in the foot. If one of the used filters has a bug and results in incorrect parsing your fail2ban installation might end up banning arbitrary IP addresses or even your own IP range (not even mentioning IP spoofing).
There existed at least two bugs of this kind to my knowledge and since regex might not always be easy I'm sure there will be more in the future.

Since I didn't want to look for a specific regex bug in one of the filters I thought about IP spoofing again and looked at fail2bans filters. What I needed was a filter processing log entries of a service listening on a UDP socket as TCP/IP spoofing over the internet doesn't really work well these days. Finding such a filter would mean an instant win situation. To my surprise there is such a filter: config/filter.d/named.conf

This filter is used to parse log entries consisting of denied DNS queries produced by bind. Interestingly there is even an article at debian-administration describing how to setup fail2ban to mitigate a DNS DDoS attack. This is of course a bad idea and I have no idea why this filter is shipped in a default fail2ban installation. DoSing abritary IP addresses with this filter in use becomes as easy as firing up scapy and querying the server with a forged source IP:

>>> send(IP(dst="81.169.172.197",src="xx.46.63.71")/UDP()/DNS(rd=1,qd=DNSQR(qname="foao.modprobe.de")))
.
Sent 1 packets.

This ends up as:
May 26 22:32:22 modprobe named[30245]: client xx.46.63.71#53: query 'foao.modprobe.de/A/IN' denied

in the bind logs which in turn results in:
2010-05-26 22:32:05,551 fail2ban.actions: WARNING [named-refused] Ban xx.46.63.71

In this example the spoofed IP was xx.46.63.71 which is not under my control.

Mission statement: don't use fail2ban unless you really want to shoot yourself in the foot or know pretty well what you're doing :-)

27 April 2010

Matthew Garrett: Radeon reclocking

Alex released another set of Radeon power management patches over the weekend, and I've been adding my own code on top of that (Alex's patches go on top of drm-next, mine go on top of there). I've left it stress-testing for a couple of hours without it falling over, which tells me that it's stable enough that I can feel smug. This is a pleasing counterpoint to the previous experiences I've been having, which have been rife with a heady mixture of chip lockups or kernel deadlocks. It turns out that gpus are hard.

There's a few things you need to know about gpus. The first is that if they're discrete devices they typically have their own memory controller and video memory. The second is that there's an impressive number of ways that you can end up touching that memory. The third is that they tend to get upset if something tries to touch that memory and the memory controller is in the middle of reclocking at the time.

The first and most obvious use of video memory is by the gpu itself. Accelerated operations on radeon are carried out by sending a command packet to the command processor. This is achieved by sharing a ring buffer between the cpu and the gpu, with the gpu reading packets out of that ring buffer and performing the operations contained within them. Many of these operations will touch video memory (that being the nature of most things you want a gpu to do), and if that happens bad things occur. Like the card locking up and potentially taking your PCI bus with it.

So, obviously, we don't want that to happen. The first thing we do is take a mutex that blocks any further accelerated operations from being submitted by userspace. Then we wait until we get an interrupt from the gpu telling us that the display engine has gone idle. The problem here is that we don't have a terribly good idea of how many more operations there are to complete and we don't know how long each of those operations is going to take, but this is less bad than some of the alternatives[1]. Jerome Glisse has some ideas on how to improve this to require less waiting, but the effects should still be pretty much invisible to the average user.

So we've stopped the command processor touching ram. Everything's good, right?

Well, not really. The obvious problem is that users typically want to display something, so there's a separate chunk of chip that's repeatedly copying video memory over to your monitor. That's got to go too. Thankfully, there's a convenient bit in the crtc registers that lets us turn that off, but the pretty unsurprising downside is that your screen goes blank while that's happening. So we don't want to do that. Instead, we try to perform the reclock while there's nothing being displayed on the screen - that is, while we're in the screen region where a crt's electron gun would be scanning back from the bottom of the screen to the top. It turns out that rather a lot of display assumptions depend on this happening even if there's no crt, no electron gun and no thick sheet of glass with a decent approximation of vacuum behind it, so we get to do this even if we're displaying to an LVDS. And we have about 400-500 microseconds to do it - an almost generous amount of time.

So we ask the hardware to generate an interrupt when we enter vblank and then we reclock. Except the hardware has an irritating habit of lying - sometimes we get the interrupt a line or two before vblank, sometimes we get it after we've already gone out the other side. Vexing, and not entirely solved yet - so sometimes you'll still get a single blank frame during reclock. But there are plans, and they'll probably even work.

At this point the acceleration hardware isn't touching the memory and the scanout hardware isn't touching the memory. Except it still crashes under some workloads. This one took me longer to track down, but the answer turned out to be pretty straightforward. Not all operations are accelerated. When they're not accelerated they have to be done in software. That means that the CPU has to write to the video memory itself. I'm sure you can see where this is going. This was fixed without too much trouble once I'd finished picking through the driver to work out every location where objects might be mapped into the CPU's address space, at which point it's a simple matter of unmapping them and blocking the fault handler from remapping them until the reclock is finished. Linux, thankfully, has lots of synchronisation primitives. And now everything works.

Except when it doesn't. This took a final period of head scratching, followed by the discovery that ttm (the memory allocator used by radeon) has a background thread that would occasionally fire to clean up objects. And by clean up objects, I mean change their mapping - which means updating their status in the gart, which means touching video memory. So, let's block that. And that tripped me off to the fact that even if it couldn't submit new commands, the CPU could still create or destroy objects - with the same consequences.

So, once all of these are blocked, video memory is quiescent and we can do what we want. And we do, at least once I'd sorted out the bits where I was taking locks in the wrong order and deadlocking. Depending on the powerplay tables available on your card we'll chose different rates and so your power savings will vary heavily depending on the values that your vendor provided, but the card I'm testing on sees a handy 30W drop at idle. Right now we're only changing clocks and not dropping voltage so there's potentially a little more to come.

While getting this stable was pretty miserable, the documented entry points for clock changing made a lot of this easier than it would otherwise have been. It's also probably worth noting that Intel's clock configuration registers are entirely missing from any public documentation and the dirver Intel submitted to make them work in their latest chips appeared to have been deliberately obfuscated, so thanks to AMD for making all of this possible.

[1] It's possible to insert various command packets that either indicate when they've passed or stall until a register value gets updated, but these either cause awkward problems with the cp locking or mean that the gui idle functionality never goes idle, so they're not ideal either.

24 April 2010

Russell Coker: Is the NBN a Good Idea

Since writing my post about whether the National Broadband Network can ever break even [1] I ve had a number of people try to convince me of it s merit. He is my summary and rebuttal of some of the arguments for the NBN: The FUD Claims are made that Australia may fall behind the rest of the world, children may be disadvantaged in their education, or many other bad things may unless a faster net access is provided to everyone. That is FUD. If we are going to spend $43,000,000,000 then we should have some evidence that it will do some good. One thing to note is that rural areas will not get anything near the 100Mb/s speeds that FTTH will deliver to people in the cities. So if faster net access is actually essential then it would probably make sense to start by delivering ADSL2+ speeds to rural areas something that is not planned to be part of the NBN. Some people claim that having slow net access (ADSL2+) is going to preclude unknown future uses of the Internet. However the NBN is only going to be 100MB/s so any such claim is essentially that unknown things will happen in the future to make 24Mb/s too slow, but those unknown things won t make 100Mb/s too slow . I started using computer networks when a 1200/75 modem was considered fast. Over about the last 25 years typical net access speeds have increased from 1200b/s to about 12Mb/s, that s a factor of 10,000 speed improvement! Now the people who believe that we only need to multiply the current speed by a factor of 4 to address all future needs could be correct, but it seems unlikely and doesn t seem like a good idea for a $43,000,000,000 bet. If they were talking about 1Gb/s net access then things would be different in this regard. Technological Development Some people compare the NBN to the Apollo Program and suggest that the scientific research involved in implementing a FTTH network might result in useful developments in other areas. The Wikipedia page about Fiber to the premises by country indicates that Hong Kong had 1Gb/s available in 2006. It seems that a service which is rolled out 4 years later and 10 times slower than in Hong Kong is not going to involve a huge amount of research. Certainly nothing like the Apollo Program. It would allow multiple HDTV channels to be viewed at the same time According to the Australian Bureau of Statistics in 2001 the average Australian household had 2.6 people (3.0 in NT) [2]. The incidence of every member of a household wanting to watch a different live TV channel at the same time is probably quite low, it seems that young people nowadays spend as much time watching Youtube as they do watching TV. Based on the Wikipedia bit-rate page it seems that an ADSL2+ link could stream two HDTV channels. I could use fiber speeds today There are some people who claim that they need faster speeds for their data transfers right now. The problem is that the latency of data transfer is a bottleneck in transfer rates. In some quick tests between servers that have reasonably fast connections to the Internet I was only able to get one international transfer in excess of ADSL2+ speed (24Mb/s or 3MB/s). I was able to transfer data between London and Germany at a speed of 11MB/s which was possibly limited by the 100baseT Ethernet connection in the data center in Germany. Now if the people who pay for that German server were to pay more then they would get a higher speed. So anyone who downloads anything from my web site in it s current configuration would get a significant performance boost by using an NBN connection if they live in Europe! But if they live in Australia then they will probably get a fraction of that speed (a quick test indicates that my ADSL2+ connection gives me about 500KB/s from my web server. I need to have at least three transfers going at the same time to get more than 600KB/s when downloading files from other countries, and it s rare to have a single download run at a speed higher than 100KB/s. It would be handy if I could download at higher speeds from my ISP s mirror (which seems to be the only way someone in Australia can even use full ADSL2+ speeds). But it s certainly not worth the $5,000 per household installation cost of the NBN to get that. I m sure that there are some people who really do have usage patterns that could take advantage of fiber net access, one possibility would be downloading large files from a local source such as a major web site that uses a CDN. It seems likely to me that the majority of people who fit this category are using major porn services. Fiber would be good for Video-Conferencing To be better than ADSL for video-conferencing a NBN connection would need a faster upload speed. Internode is already selling NBN connections for the trial areas [3]. The cheapest fiber plans that they offer are at the 50/2 speed, that s 50Mb/s download and 2Mb/s upload in theory ADSL2+ should have a higher upload speed. In my tests the best result I ve got from sending files over my ADSL2+ link to another country is about 110KB/s (880Kb/s). The fact that the theoretical speed of a fiber connection is better than the measured speed of an ADSL2+ connection in this regard doesn t mean much, let s not assume that a fiber connection will get it s theoretical maximum speed. Not that you necessarily need higher speeds for video-conferencing, Youtube is one of many services that uses a lot less bandwidth than the upload speed of an ADSL2+ connection. Also video-calls which are supported on most 3G mobile phones use even less bandwidth again. I want an NBN connection to run a server at home The fastest connection for uploading that Internode offers to home users is the Home High plan at 100/8 speed, that is maybe a bit more than twice as fast for uploading as ADSL2+. They also offer a SOHO plan that supports 16Mb/s upload speed (at extra expense) and suggest that customers who want higher speeds contact their business sales department. But they include both sending and receiving data in the bandwidth quota for the fiber connections. Transmitting data at 16Mb/s isn t that great for a server. The cheapest virtual server plan on offer from Linode [4] includes 200GB of data transfer per month and has significantly higher transmission speeds. You could get a Linode virtual server plus an Internode ADSL2+ connection for about the same price as an Internode fiber connection to the home. There are two down-sides to virtual servers, one is that they are limited in the amount of RAM that they have (I can easily afford to buy 8G of RAM for a home system but renting an 8G virtual server is going to be expensive) and the other is that the storage is limited. Shared storage on virtual servers can be slow and is limited in size. If you need to run a server with a few terabytes of data storage (which is cheap on commodity SATA disks but expensive on server-grade disks) and you don t need to transfer much of it then a home server on the NBN might do well. Otherwise it s probably not going to work well for server use. The NBN will avoid people leaving their PC on to do downloads and save electricity To save electricity you would have to have a significant incidence of situations where a download can complete fast enough over the NBN to allow the user to turn their PC off before going to bed but be slow enough over ADSL to require that it be left on overnight. That would probably only apply to downloads from a CDN or from a local ISP mirror. From the Internode mirror I can download a test file at a speed of 850KB/s (I guess this means that my ADSL connection is not delivering full speed I suspect poor quality wiring in my home and would try to fix it if the current speed was too slow). In 5 minutes spend brushing my teeth I could download 250M of data, in the same time if I had a 100/4 connection on the NBN I might be able to download almost 3G of data. So in the unlikely event that I wanted to download a CD or DVD image and turn off my PC immediately before going to bed then the NBN would be a good thing. But then of course I would want to burn the CD or DVD image to disc and that would take long enough that I would leave it on overnight My ADSL connection gives really low speeds or I m out of range for ADSL Some people who live only a short distance from an exchange are unable to get ADSL2+. Some people live a long way from exchanges and are outside ADSL range. The ideal solution to these problems is not to provide fiber access to the majority of the population, it is to provide ADSL to everyone who is near an exchange and maybe provide fiber access to some people who are a long way from exchanges. I find it rather ironic that some people in the country are essentially saying because net access in the country is so slow we need fiber in the cities . The NBN is not going to give fiber to rural areas, satellite is one of the options that will be used. Really High Speeds I have been informed that to get the distances needed for the NBN they have to use Single Mode Fiber, this permits scaling up to higher speeds at some later time by changing the hardware at the end points. So we could end up with a Hong Kong speed network at some future time with the same fibers. This is a good thing. But I don t think that we need to get fiber installed right now so that we can use 100Mb, we could wait until there is enough need to get the faster transmission rates from the start. At the moment it s just a waste of money.

15 April 2010

Jan Hauke Rahm: MiniDebconf in Berlin, T 8 weeks

To give a short update on where we stand now with the amazing plan of having a Mini Debconf in Berlin this year. There are just 8 weeks left which means there is lots of stuff to do and it needs to be done soon. But luckily Of course, all this is written in the wiki and you can put yourself in it at any time to offer your help! And if you have questions or want to join more real time ;), point your IRC client to OFTC and
/join #debian-miniconf-berlin
Help is still needed with video and audio stuff. If you think you know how to move a camera, or you can even work a sound mixer, get in touch with us. We need a few volunteers to cover the whole two days. Also, more generally help is needed in order to have people to talk to at all times both for speakers and visitors. No special knowledge is necessary although it might prove handy to know what Debian actually is. :) Interested? As a visitor or helper? Anyways, get in touch with us and it s going to be awesome! </commercial>

11 April 2010

John Goerzen: Final comments on our trip to Europe

I wrote a lot about our trip to Europe here, and I had a few more comments to share. I had a great time there. It was fun to stay with people, and it was also fun to explore cities on our own. I am eager to be able to go back. Communication
I ll admit I wasn t sure how I d do there. I speak only a little German, and no Czech at all. I have never been in a situation in which I don t speak the dominant language, and this is probably typical for Americans. (I m not going to count the few exceptions of eating at small Mexican restaurants in the USA where the staff speaks little English, as it s not really the same experience to be in that situation for an hour or two.) I was most apprehensive about our time in Berlin and Prague. In those cities, we didn t know anyone. And, although I speak a little German, I speak no Czech at all. In the end, though, it all worked out fine. I never saw anyone get frustrated with us for our lack of language knowledge, and we also never got rattled. With patience and a bit of ingenuity, we figured things out in every different situation. I feel a sense of accomplishment from that, and I think it s left me more ready to travel in the future. And, I d also have to say, that was one of the most interesting lessons of the trip: how two people that don t share a common language can still communicate. It might be slow, but it s also rewarding and easier than I might ever have thought. I remember particularly buying a couple of fragile carved wood souvenirs at the Zeidler Holzkunst (wood art) shop in the Altes Rathaus in Leipzig (Seiffener Volkskunsterzeugnisse was on the window). The shopkeeper spoke no English. We were interested in some rather fragile items, and I wanted to ask her if she could pack it in a box. I didn t know the German words for pack or box . So after a couple seconds thought, I realized I knew how to tell her, in German, that we re from America. And then I asked, Can you? (in German) and gestured for a square box, figuring maybe she d put it together that we d need to pack it well to take it home with us. Success. She quickly produced a box, and asked if that s what we wanted. A few minutes later, a bit of pointing towards the glass case communicated what we wanted to buy. It took a little longer than it would have from someone that spoke English, but this was more rewarding in the end. The train station in Prague was another challenge. It didn t have nearly as much English signage as other train stations we d been in. We did a little wondering around, and some educated guesses, and a brief English conversation in a bank, we eventually found an ATM, a place to change the big bills for smaller ones, and a Metro ticket shop that was open. Clothes Many Americans, and American travel books, suggest not wearing jeans and tennis shoes in Europe. Many commented that people dressed more formally in Europe. That advice appeared to be rather wrong, especially in L beck, where it appeared that many people dressed less formally than in the USA. As we went south and east, we saw fewer jeans, but still they were rather common. Our biggest blunder here was probably the shoes that we brought for Terah. She brought some shoes that looked nice, but weren t very good for walking. She wound up with some painful blisters on her feet, and wished she had just brought her regular tennis shoes. Luggage and Packing We try to travel light when we can. All of our luggage for the entire trip fit into two carryon-size suitcases, though we sometimes separated some items out into a backpack for ease of use in airports/airplanes. This worked out about right. We did laundry once in Germany so we didn t have to pack enough clothes for the entire trip. As far as electronics go, we brought along an international GSM phone from onesimcard.com, my Droid (which could use Wifi but not GSM), Terah s iPod Touch, a GPS, my digital camera, and a laptop. That also was about right. We used the Droid to call back to Indiana to check on the boys, using SIP over WiFi for free calling via Google Voice. The laptop is a small one, so didn t add a lot of weight or bulk. It was nice to have to check out maps and Facebook. The GPS was somewhat less useful than I had anticipated. I had pre-loaded it with street-level maps of most of Europe, and also put on it points in Berlin that had been suggested to us. The transit maps were really more useful most places, especially when combined with a detailed street-level map. In Berlin, though, the detail on the street-level map from our hotel was somewhat lacking, so the GPS came in handy. It was also nice to quickly be able to see where the nearest S-Bahn and U-Bahn stops were, then cross-referencing with our transit map to figure out how to get where we wanted to go. One night in Leipzig, after a concert at the Gewandhaus, we made a couple of wrong turns on our way to a tram stop. The GPS would have saved us 15 minutes of walking had we brought it along, but we figured it out with our street map and it wasn t really a problem. Rick Steves is a big advocate of money belts when traveling. These are a belt with a zippered pouch, and are worn under your pants (though over your shirt, if it s tucked in). The idea is that it s hard to pickpocket. He suggests having a days worth of cash in a front pocket, and passports and larger bills in the money belt. We brought one but never used it. I kept small cash in my pocket, and we kept passports and my wallet (with larger bills) in Terah s purse, which was on a strap around her neck, zippered shut, and held under her arm. We had no problems. I tend not to keep my wallet in my back pocket even when traveling in the USA. Also, the hotels we stayed in had safes, and the residences were of course plenty safe, so we had no problem leaving valuables there. I brought only a single lens for my Digital Rebel XTi, a 28mm fixed lens that is small and light. That was just fine, and I was happy to have a fixed lens for photography in dark churches. Also, I wouldn t have wanted to carry around a bulky zoom lens all over. We sometimes took the camera with us, and sometimes not. In Berlin in particular, we just left it in the hotel room. I figured (correctly) that there would be plenty of photos on Flickr of the sites we were visiting, and we could just enjoy the time a little better if we weren t worrying about a camera too. But I was glad to have it along. Transportation The transportation systems in the cities we visited felt more, well, balanced than they often are in the USA. It s not that there weren t busy car-filled avenues, but more that there were also quiet shopping streets where cars were banned. Cars often seemed to be more of an option than a necessity, and not always the best option at that. Public transportation was common, as were pedestrian routes and bicycle lanes. The only American city I ve visited that felt even close to this approach was Portland, OR. I wish we adopted it more often here. I also admire the German intercity rail service, operated by Deutsche Bahn. You can get all over the country pretty quickly. The trains we rode on were quiet, smooth, and timely. I wish we had that kind of service in more parts of the USA.

8 April 2010

John Goerzen: Face to Face With Destruction

IMG_2641 Seeing these church bells in L beck wasn t easy for me. They melted and fell to the ground after an air raid in 1942, and have been left exactly as they fell. I wasn t alive in 1942, and even my parents hadn t yet been born. My grandfather was relocated by the American government because he refused to fight in the military for religious reasons. And yet, I still felt a sense of embarrassment, being an American standing there in Germany next to those bells. My country* did things like this. Why? Even if there s a war on, and whatever the other side may be doing, do we really have to bomb all their churches? Then, we went to the Dom (cathedral). It has a small gallery of photos of the destruction in 1942, and how it took 40 years to restore (though some original works are simply irreplaceable.) Burning L beck Cathedral after an air raid in 1942 I had just been walking through the beautiful Dom, and then saw pictures like that. It was very sad. I imagined the people in 1942, seeing the smoking remains of so many buildings that had been important to the town for centuries. Places where, no doubt, some of them worshiped, and their parents and grandparents had too. I imagined my sadness if a country bombed one of the churches that my ancestors helped start or build. I felt ashamed of what the democracy in which I live (and its allies) did to the Dom, to Marienkirche, and to the other churches and civilians there. Then, a few days ago, Wikileaks posted a video from an American helicopter in which our soldiers begged Come on, let us shoot! at people, most or all of which were completely unarmed. They killed a bunch of people. Then a van came to try to get the wounded to the hospital. Then the soldiers in helicopter killed those people, and wounded some children. Even if they thought their lives were in danger, I d expect to hear some quiet sadness at what they thought was a regrettable need to use force. Instead, you d hear them cheering whenever they killed someone, as if they had just won a round on some video game. They killed civilians, and considered it a fun experience and a mission accomplished. There was no sadness for knocking a man to the ground, leaving him writhing. Just jokes. There was no more care for human life here than there was 60 years ago. It saddens me that every year we celebrate our military on independence day celebrating its ability to kill, not its ability to feed. I wish that we could rather celebrate the times Americans have saved lives, whether in Berlin or in Port-au-Prince, or helped to topple dictatorships. Military power shouldn t be our first choice so often. L beck wasn t attacked for any strategic purpose; the British did it to destroy the morale of the enemy civil population , as the Americans did in Dresden or the Germans in London. In other words, those bells fell to the ground for no reason other than that they were German. People lost their lives for the same reason in Germany and in London. The British had no reason to believe that those civilians meant them any harm, that they were anything but caught between two strong powers. And the same held true in Iraq. When we went to Berlin, we walked through the replica of Checkpoint Charlie, with the big sign announcing that you are leaving the American sector. There is little positive to be said about the Cold War, but there is something the British and American military did of which I am not the least ashamed: the Berlin Airlift. Although I didn t see it, I feel a sense of the USA having been a force for good when I read about the Berlin Airlift Monument at Tempelhof, which has the names of the 70 British and American men that lost their lives in the airlift (due to accidents), above the inscription They gave their lives for the freedom of Berlin. That s the spirit I wish we d see more often in the world today: people giving their lives not just for their own security, but for strangers in need on a different continent. We Americans have been, compared to many countries in Europe, relatively sheltered from the ravages of war in our own midst. I wish that more of us would have the opportunity to gaze at fallen church bells, to wonder through a magnificent old church and then to see photos of it on fire, or to see a monument to our soldiers in a far away land. Perhaps then we could better learn from history, and see firsthand that some of our most positive contributions to the world have come in the form of coal and candy bars instead of incendiary devices. A small post script Many historic buildings or locations we saw in Germany had plaques on their exterior with a brief history, often in German and in English. I was interested to note that some (though not all) of these plaques had language such as destroyed by fire in 1942 , with no mention that the cause of the fire was a bombing. I was even more interested to note that same sort of description at several sites in Prague Castle, mentioning that the original building was lost in the fire of 1142. It was only on the third or fourth building in the Castle that we learned that the fire of 1142 was caused by a military siege of Prague Castle. * I know it was the British at L beck, but the Americans did similar things elsewhere. I also acknowledge that, at a macro level at least, the Berlin Airlift wasn t purely an altruistic act, as there were geopolitical factors in play. But I am speaking of the actions of the airmen here, who took on considerable risk to help others.

7 April 2010

Kees Cook: Debian maintainer scripts diagrams

Since the Debian Women Wiki is on hiatus, I found myself without the handy Maintainer Scripts diagrams today. So, I recovered it from Google s cache, and put it up on the main Debian wiki: MaintainerScripts. I used a great tool to go from HTML back to MoinMoin syntax: html2wiki

Next.

Previous.