A while back, I wrote about this GObject-based Object/Relational mapper that I wrote, which is called 'GNoDbify'. It isn't complete yet, but parts of the library work; I use it for a project that I'm supposed to commercially support. For those who don't know what that is: an O/R mapper builds objects out of database tuples; so I can run a 'lookup' function on the object class and get one (or more) objects representing data from the database, then perform some modifications on that object, and store it back in the database; my O/R mapper does all the SQL magic. Last week, I've been working on another object that takes an array of GNoDbify objects, and presents them using the GtkTreeModel interface, for easy viewing in a GtkTreeView:

my @customers = Vpbs::Db::Customer->get_all();
my $model = GNoDbify::ListStore->new_from_array(@customers);
my $view = Gtk2::TreeView->new_with_model($model);
my $renderer = Gtk2::CellRendererText->new();
my $column = Gtk2::TreeViewColumn->new_with_attributes("Name", $renderer, "text", $model->get_column("name"));
$view->append_column($column);

And there you have it: a treeview showing all the names of all the customers in the database. On the classical approach, one would have to use DBI or some such to fetch data from the database, create a GtkListStore or something similar, and then append the data one row at a time to that. Of course that still happens here, in a manner of speaking, but it all happens behind the scenes. It also means that in an application which wants to show a load of data, I don't have to do the same thing all the time. The magic happens in the second line, and in the second-to-last line. GNoDbify::ListStore->new_from_array is pretty much self-explanatory, really. It takes an array of GNoDbify objects, and returns a GNoDbify::ListStore. The second-to-last line shows how to add a column to a GtkTreeView. With GtkListStore and GtkTreeStore you basically define yourself what column gets what number; however, with GNoDbify, that isn't as easy (it depends on the implementation of the GNoDbify subclass), so the ->get_column returns the number of a column as represented by the model, and wants the name of the field that you want the column of. Everything else is really the same. It won't stop here, though. The original plan for GNoDbify was that it could detect changes in the database, and update the tree model accordingly. Most of that has already been implemented in GNoDbify (though not yet in the ListStore thing), but just needs some debugging. The fun thing is, the above six lines of code would not have to change at all for that. Of course all this juicyness comes at a price. In order to generalize this much, I had to do a lot of extra stuff; so there's some performance loss. Especially in perl; most of GNoDbify is written in C, and converting perl arrays to and from C arrays is a process that can only be done by looping over the perl array (or the C array) and creating the other side of the equation. Obviously, that's a costly approach, performance-wise; an obvious optimization of the above example could be to have a subroutine that returns Customer objects already in a GtkTreeView in one API call. We'll see.

Regarding the ballot currently before the Developers, Christian Perrier writes:

Moreover, the proposal is worded and was pushed in a way that all (but one) options that would allow us to release lenny will need a 3:1 majority, which is obviously very hard to achieve (and as, there are several such proposals, the vote will be spread out among all of them). So, those folks who make the release of lenny their priority are now facing an interesting tactical choice: how the ..... should we vote for this to happen? I personnally did choose to vote this way: 5462371.

I agree with Christian's goals, but in my opinion, the ballot he has cast actually makes less likely that the winning option will allow us to release lenny. In Debian, we run a two-round election using a single ballot. In the first round, any options that need a 3:1 majority must defeat the default option by a 3:1 majority. Options which fail this test are eliminated and dropped from further consideration. In the second round, a winner is chosen from the remaining options using a Condorcet method as usual. The upshot of this is that the votes for the 3:1 majority cannot be spread out, unless people habitually place only one of the 3:1 options over Further Discussion. Furthermore, voting everything below Further Discussion benefits the options that don't require a 3:1 majority over the ones that do. For a real example, let's say that we have a ballot like this:

[ ] Choice 1: Omelette [3:1]
[ ] Choice 2: Quiche [3:1]
[ ] Choice 3: Toast
[ ] Choice 4: Further Discussion

Suppose that we don't like the ballot at all, but we want an egg-based breakfast. What happens if we vote like this?

[2] Choice 1: Omelette [3:1]
[3] Choice 2: Quiche [3:1]
[4] Choice 3: Toast
[1] Choice 4: Further Discussion

This ballot can be read as: I don't think that omelettes or quiche should pass the 3:1 majority requirement. But if they do, I prefer them to toast. Unless 75% of the remaining voters vote omelette and quiche above toast, those two options will be thrown away, and the vote will be determined by whether half the voters placed toast over further discussion. If you want to make sure that toast doesn't win, you have to vote (insincerely) like this:

[1] Choice 1: Omelette [3:1]
[1] Choice 2: Quiche [3:1]
[3] Choice 3: Toast
[2] Choice 4: Further Discussion

Sadly, there is no way to vote against the vote without effectively also voting for toast!

---

I wonder if it was a mistake to combine the supermajority vote and the Condorcet vote on a single ballot. Maybe it would be better to write both ballots out explicitly:

Some options on this ballot must be approved by a 3:1
supermajority of the electorate.  Please enter 'Y' next to the
options that you approve of and 'N' next to those you disapprove
of.  Ballot options on which 75% of voters vote 'Y' will proceed
to the next round (below).
[ ] Choice 1: Omelette [3:1]
[ ] Choice 2: Quiche [3:1]
Rank the ballot options below:
[ ] Choice 1: Omelette [3:1]
[ ] Choice 2: Quiche [3:1]
[ ] Choice 3: Toast
[ ] Choice 4: Further Discussion

That would allow people who want to vote against the vote without privileging any of the options over the others to do so: vote Y to all 3:1 options, then vote 2221 on the rest. On the other hand, I suspect people would be confused in different ways by a voting system that was this complicated, voting Y in places where they should write a number and writing numbers where they should write Y or N. I guess all this mess is why we still use First Past the Post for votes in the real world...

I agree, this vote is one of the worst formulated I can remember. I think votes should be as easy as possible to understand, so that the voter is absolutely clear about what he s going to vote. The current vote is the perfect example how not to design such a vote. Reading and understanding the ballot is very exhausting, the wording sounds polemic and given the options, it somehow feels like a trap. Example: The first option is Reaffirm the social contract . Sounds nice, of course we want that, but in the footnotes it says

[ ] we will delay the release of Lenny until such point that the work to free the operating system is complete (to the best of our knowledge as of 1 November 2008).

So you re actually voting on delaying the release of Lenny until some technical details are cleared. This is really crap, why not name the option Delay Lenny until foo in the first place? I guess to motivate people a bit more to rank this option above all others. I m very disappointed. Next vote, fever options and clearer wording please.

Now we have seen what per-process namespaces and shared subtrees are and how to operate them, we can try to combine these two features. We ll be using our newns tool from this earlier post to create new namespaces. And for practical reasons, let s say you have a terminal with a 1$ prompt and a second terminal with a 2$ prompt (that will allow me to skip go to the second terminal phrases). In the kernel, per-process namespaces are a bit like bind mounts, such that shared subtrees work with namespaces like they do with bind mounts. As with standard bind mounts, the default shared subtree mode is private, which means mounts done on either namespaces will be private to the namespace. Only mount points active at the time of the new namespace creation will be in both namespaces:

1$ ./newns
1$ mount /dev/sda1 /mnt
1$ ls /mnt
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
2$ ls /mnt
2$ mount /dev/sda1 /cdrom
2$ ls /cdrom
config-2.6.26-1-amd64 grub initrd.img-2.6.26-1-amd64 System.map-2.6.26-1-amd64 vmlinuz-2.6.26-1-amd64
1$ ls /cdrom
1$ umount /mnt
1$ exit # Exit from newns
2$ umount /cdrom


shared mode allows both namespaces to share subsequent mounts. As with bind mounts, and for obvious reasons, you need to change the subtree mode before creating the new namespace:

1$ mount --make-rshared /
1$ ./newns
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6


Like with shared bind mounts, the new mount point can be unmounted from either namespace:

2$ umount /mnt
1$ ls /mnt
1$ exit # Exit from newns

A slave subtree will have mount points under its master (shared) subtrees propagated, while propagation won t happen in the other direction. Again, very much like bind mounts:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
1$ mount --make-rslave /
1$ mount --bind /usr /mnt
1$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
2$ ls /mnt
2$ mount --bind /usr /cdrom
2$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ ls /cdrom
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
2$ umount /cdrom


Contrary to shared and slave, unbindable doesn t add value when used in two different namespaces. This is only something that will have impact on the current namespace:

1$ mount --make-rshared / # For completeness, we already did that earlier
1$ ./newns
2$ mount --make-runbindable /
2$ mount --bind /usr /mnt
mount: wrong fs type, bad option, bad superblock on /usr,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg tail or so
1$ mount --bind /usr /mnt
bin games include lib lib32 lib64 local sbin share src X11R6
1$ exit # Exit from newns
1$ mount --make-rprivate # Set back to default

Now we ve seen what can be done with namespaces and shared subtrees, let s see what nice features can be implemented with both. As Russell revealed, pam-namespace is able to polyinstanciate some directories following rules set in /etc/security/namespace.conf (see namespace.conf(5)). The sad thing is that it apparently can t just create a new namespace without polyinstanciating a directory, which could be useful if you only want separate namespaces, but no polyinstanciated directory. Russell s recipe goes as follows:

• At boot time, / is put in shared mode and /tmp in private mode.
• When opening a session, pam will create a new namespace, and bind mount /tmp-inst/$USER to /tmp.

What this means is that in the newly created namespace, a user reading in /tmp will actually be reading in /tmp-inst/$USER without the user knowing. Also, if root mounts something on the parent namespace, it will be propagated (/ being shared) to the user namespace. This means that mounting USB storage, for example, will be propagated to the user namespace. This also means that something mounted from the user namespace will also be propagated to the parent namespace. In both cases, this only applies to mounts occuring outside of /tmp, for which mounts don t get propagated. Note that without setting /tmp as private, when PAM would be mounting /tmp/inst/$USER, it would propagate as well, setting /tmp to /tmp/inst/$USER for everyone. So setting /tmp as private is mandatory. There is, however, a flaw in Russell s recipe: If any of the user mounts something under a submount of /, under /var for example, if /var is mounted, it won t be mounted to a user that already had a session opened. For that to be possible, you have to use --make-rshared instead of --make-shared in Russell s recipe. Some nice setup that can be done with all these, is the following: Add the following to /etc/security/namespace.conf:

/tmp tmpfs tmpfs root

Add the following to /etc/pam.d/common-session:

session required pam_namespace.so

Until here, it is pretty much the same as Russell s, except /tmp is a tmpfs instead of a real directory in /tmp-inst/, which can have some advantages. It doesn t seem to be possible to give pam-namespace a size for the tmpfs, though. Add the following to /etc/rc.local:

mount --make-rshared /
mount --bind /tmp /tmp
mount --make-private /tmp

Here again, this is the same as Russell s except for the correction for --make-rshared as seen above. If /tmp is already a mount point (on my systems, it is a tmpfs), you can remove mount --bind /tmp /tmp from above. Add the following to /etc/security/namespace.init:

mount --make-rslave /

Now, this is where it gets interesting: we re setting the whole tree as slave in the user namespace which means that if a user mounts a file system anywhere, it will only be seen in his session. Which means the user can more safely mount encrypted volumes: they won t be available to other users (root can still go wandering in /dev/kmem, though). And you don t even need SE linux for that. The caveat is that if you open a root session with su, from the user session, you are still inside the user boundaries, and don t have access to the virtual filesystem as it is for init. And if you mount something as root then, while it will appear in the user namespace, it won t appear neither in other users namespace nor in init s, which can be a good thing in some cases, but a burden in others. It means you may need to setup a special user that won t get a new namespace in /etc/security/namespace.conf. An alternative model would be to only set the user s home as slave, which means anything mounted by the user in his home directory would stay private in his namespace, while anything mounted outside would be shared with other namespaces. For that, you may want to replace the lines we added to /etc/security/namespace.init with the following:

HOME=$(getent passwd $3 cut -d: -f6)
mount --bind "$HOME" "$HOME"
mount --make-rslave "$HOME"


Either way, the remaining problem is that a root session opened with su from the user session won t get access to the original /tmp. As we saw, there are various use cases for namespaces and shared subtrees. I ll follow-up again on these features soon, as I ll be using them in yet another way to achieve a very different purpose.

Michael Arrington of Techcrunch comments on the US vs Europe in terms of startups: Joie De Vivre: The Europeans Are Out To Lunch It's a pretty rough and coarse-grained view of things, but there's a grain of truth there. I've written about this a little bit before. It's something that I feel qualified to talk about, having lived and worked in both the US and Europe (Italy and Austria to be precise), and in that time, generally gravitated towards startups. Here's my quick take on a list of what's good and bad about each. Please note that these are of course not true for everyone, that things are changing, but are still things I think are generally true, even when I could think of several counterexamples for some of them myself. Also, it's very important to keep in mind how diverse "Europe" is, so most of what I write is really about Italy, and to a much smaller degree, Austria. I'd be very curious to hear your own experiences in the comments. Europe Bad

• Less of a startup culture and mentality. It's more typical to get a "job for life" and hang on to it for all you're worth. Many Italians are tremendously creative, industrious, inventive people, but are going to find it more difficult to express that in some form of business.
• The side effects of this mean that there are fewer people to talk with, and network with, fewer potential employees willing to risk a startup, and so on. For instance, people are at times more suspicious of a new company - both clients and suppliers.
• As I mentioned in my other article, it takes a lot more money to get started in many European countries - something like 10,000 Euro in Italy. Other places like the UK are cheaper, and apparently Germany is introducing some legislation to ease the burden on new companies. I really hope this changes in Europe because it's such an easy change to make: don't extract money from companies until they're making it.
• More bureaucracy. I think that higher taxes, once you are profitable, might be worth paying for the social system you get in Europe, but the cost of sorting out paperwork falls inordinately on smaller, newer companies. Big, established firms can hire people to deal with all the rules and regulations, and probably have contacts in the government that can help them out in some cases. Smaller firms are the ones whose time is really going to be wasted running around to different offices trying to figure out what they have to do.
• Smaller, fragmented markets. Localization is not a lot of fun in some ways, and trying to translate everything into all the languages of the European Union is a huge undertaking. In the US, you get a huge market with just English and the US Dollar. Even beyond language issues, the culture changes less in the US from place to place, meaning that you have a more homogeneous target.
• Lack of acceptance of failure, both culturally and institutionally. If you go bankrupt in Italy, it's a very serious problem. Apparently (although this is second hand, I'm not 100% sure of it - maybe someone can confirm whether it's actually true?), you can even lose the right to vote. Plenty of people in the US try several times before they get it right.

Good

• Even if your undertaking fails, you still have health care. Likewise, there are other bits and pieces of social support (that change from country to country) that mean you're probably not going to land quite so hard on your rear if things go wrong.
• Lots of smart, educated people. I never lacked for plenty of smart people to talk shop with in Padova, and didn't miss the California bay area at all from that point of view. Open source is really big in Europe - perhaps, in part, because for many people it's a better avenue for their talents than creating a business, when doing so is difficult and less common.
• Work/life balance. Sorry Mike, but the amount of people who are truly going to strike it rich is pretty small. If they want to work hard, great, but it's nice to have some other options, in terms of good, lasting friendships (rather than everything revolving around work), knowing plenty of people from outside your field, people living in and belonging to a community (how many people spend their whole lives in the bay area?). When I moved from San Francisco to Padova in 2000, I went from a world gone mad with money and the dot com craze to one where there were rich and poor, families, young people, old people, and many people who were not working for some dot com. That's not to say that people don't work quite hard in Italy - two hour lunches are a thing of the past for most anyone I know.
• Smaller fragmented markets can be an advantage, too. By the time some valley-based startup finally gets around to noticing that languages other than English exist, it's possible to capture a smaller market. Ok, so you won't be the next Google that way, but there's good money to be had in doing so.
• In some ways, the staid, established, don't rock the boat way of doing things in some industries may present big opportunities for outsiders to come in and pull the carpet out from under everyone. This is especially true of internet/web companies that can get started quickly and cheaply.

US Bad

• If you're not careful, you can get completely sucked in to work - your life revolves around it, your friends are mostly work friends, and if something happens to your job, a lot of that goes poof. This is especially true in places like the bay area, where so many people are 'transients' - just there for a few years, without any real roots in the area. This is ok if you'll potentially make a big pile of money, but long term it's unhealthy.
• Less of a sense of building for the long term. Personally, I don't want a "job for life", but I think there is some value in loyalty (the genuine sort, not the sort created by legally not being able to lose a job) between employer and employee that has been lost in the US. Being able to count on someone growing with your company, and as an employee, knowing that your company will do what it can to help you out even in tough times are things that capture some value. The US seems to be heading towards a "Coasian" world where everyone is a freelancer, and while that efficiency is hard to deny, I wonder what is lost in the process.
• The competition is tough. Sure, it is in Europe too, but in Europe everyone may compete quite hard during the year, but still all take that one month vacation (although that is becoming a bit less common, especially amongst people my age), whereas in the US almost no one gets that kind of benefit - even if you wanted to take unpaid time off, people would look askance at that kind of behavior. That said, if you need to stay open in, say, August, in Italy, to compete, you are in big trouble, because for many businesses it's simply impossible because it's a chain reaction: all your suppliers and clients shut down, so you really have no choice.

Good

• There are certainly bureaucratic obstacles in the US, but are much more maneageable, and don't hit smaller/newer companies quite so badly.
• It's cheap to get started. As per my other article, the actual state filing fee in Oregon for an LLC is $55, and that's all you really need.
• The culture is definitely there, especially in the right places like the Bay Area, but even in plenty of others.
• You aren't bound to employees for life, and it's easy to find freelancers. I know I'm contradicting myself, but I think it's actually a complex issue, and there are definite advantages to not having people who expect or at least want to find that job for life.
• A large target market. Go online in one state, and you can, for the most part, deal with customers all over the US, in one language.
• Things turn around faster. I have more of a sense that when there are problems, they get fixed. Companies (the debacle of the automakers notwithstanding) are more often allowed to fail, or at least put in Chapter 11. Sometimes this means that when things are bad, they get really bad, but also turn around and get better sooner.

Conclusions An interesting example of all this from my own experience was Linuxcare. The company was, culturally, a Bay Area startup, with the headquarters in San Francisco, founded by very startup oriented guys (one of whom, Dave Sifry, went on to do technorati, and is currently working on yet another venture). However, most of the actual open source talent was in our satellite offices, in Australia, Italy and Canada, places where, perhaps, people were not so distracted by the prospect of "make money fast!!! hurry!!!" that they had time to work, learn, and create some really great open source code. To be honest, I find myself torn. Business-wise, I prefer the US. However, outside of that, there's a lot to be said for Europe. I also think that some of what's good about business in the US is coming to Europe, albeit slowly in some cases, in Europe. People my age here can see what's going on elsewhere, and try and copy what they like. A lot of what's good about Europe, though, might be more difficult to import into the US, especially the livability of the cities. In any case, I can conclude that it's a complex, difficult topic best discussed over a glass of wine.

Linux has had this neat feature for quite some time now: since 2.4.19 according to the docs. Yet, it is neither very known nor very used. I couldn’t even find a program that would create a new namespace for its subprocesses, similar to what chroot does with the root of the file hierarchy. This neat feature allows each process to have a different set of mount points. While you most of the time want processes to share their mount points, there are some cases where you may want to have some processes have a different set of mount points. Combined with bind mounts, it can allow some useful setups. In case you are not familiar with bind mounts, they allow to “attach” a part of the file hierarchy to some place else. For example:

$ ls /mnt
$ ls /usr
bin games include lib lib32 lib64 local sbin share src X11R6
$ mount --bind /usr /mnt
$ ls /mnt
bin games include lib lib32 lib64 local sbin share src X11R6

Now, take pam-tmpdir, for example. It sets $TMPDIR and $TMP to point to a user-specific temporary directory. Sadly, it is pretty useless for applications that don’t follow the standards of using these environment variables. Without namespaces, if you’d create a temporary directory and bind-mount it to /tmp, this new /tmp would be visible to everyone, to every process. But with namespaces, you can make this new /tmp only available to subprocesses. If pam-tmpdir were to do this, it would also allow applications trying to write to /tmp without resorting to $TMP or $TMPDIR to be using the temporary space, without impacting external processes, that would still be using the original /tmp. On x86-64, you can run both 64-bits and 32-bits applications. 64-bits applications would take libraries from /usr/lib, and 32-bits applications would search libraries in /usr/lib32. But badly crafted 32-bits applications could be trying to load libraries from /usr/lib, where only 64-bits versions are available. With namespaces, the broken 32-bits application could have /usr/lib32 bind-mounted to /usr/lib without the 64-bits applications knowing. You could certainly get a similar result with the following set of commands:

$ mount --rbind / /chroot
$ mount --rbind /usr/lib32 /chroot/usr/lib
$ chroot /chroot $application

(–rbind also attaches submounts, contrary to –bind) The downside, here, is that external processes will see all this setup under /chroot. The whole setup would be invisible to external processes if namespaces were used. Another nice use of namespaces would be to mount encrypted volumes under a different namespace, so that only a limited set of processes would be allowed to read the decrypted data. The sad thing is that you need the admin capability to create a new namespace, so that would need to be done by a setuid root program. There are, as far as a few hours fiddling showed me, 2 system calls that will setup a new namespace: clone(2), and unshare(2). The second is easier to use, though only available since 2.6.16. But while etch ships 2.6.18, the glibc coming with it doesn’t implement unshare(2), so we need to use syscall(2) instead. The following code will run /bin/sh, or any command given as argument after creating a new namespace. The new process and its subprocesses will inherit the new namespace.

#include <sched.h>
#include <syscall.h>
#include <unistd.h> int main(int argc, char *argv[])
  syscall(SYS_unshare, CLONE_NEWNS);
  if (argc > 1)
    return execvp(argv[1], &argv[1]);
  return execv("/bin/sh", NULL);



This tool, once built, is called newns in the following example.

$ mkdir /tmp/abc
$ ./newns
$ mount -n --bind /tmp/abc /tmp
$ touch /tmp/a
$ ls /tmp
a
<in another terminal>
$ ls /tmp
abc
$ ls /tmp/abc
a


When using namespaces, it is better not to have mount fill /etc/mtab, using the -n argument. /proc/mounts will contain the proper mount information about the namespace of the process reading it. /proc/PID/mounts will contain the mount information for the given process. As bind mounts also work on files, you can override some files. The following will run dash instead of bash (in subprocesses, too, obviously):

$ ./newns sh -c "mount -n --bind /bin/dash /bin/bash; /bin/bash"

Back to the idea of having encrypted volumes only available to some processes, the following should work (unverified):

$ ./newns sh -c "encfs /tmp/crypt-raw /tmp/crypt; /bin/bash"

Only the opened bash, and its subprocesses, would have access to /tmp/crypt. The newns tool used above could, to allow normal users to be able to fiddle with namespaces, be improved to be a setuid root program that would drop its privileges right after unshare(2) to take the same privileges as the calling process. As you can see, per-process namespaces have a wide range of possible uses ; it’s astonishing that it’s not more used yet, considering its age. Additionally to per-process namespaces, there are also a bunch of other (more recent) features that allow to implement vserver-like features with a vanilla kernel, such as networking netspaces (work under progress, though), PID namespaces and utsname (see uname(2)) namespaces. Actually, these features are designed to be used by vserver and openvz. I am looking forward to having unprivileged mounts implemented, so that users could fool around with bind mounts. Unprivileged namespaces would be a nice addition.

There is again some ongoing debate about Ruy gems and how to integrate them cleanly into the operating system. Let s put aside the fact such tools are useful on Windows and MacOS which don t have decent packaging systems. This is not a reason to dictate stupid requirements for other operating systems. Still, even without that, gems, eggs and the like are great tools for development; tools that developers can t work without today. They allow to easily setup a development environment with everything needed, at the latest versions. However they were not meant for integration and production environments, and will never be suitable for them. We re living in another world indeed: a world where servers must be up 24/7, where security issues flood your inbox every day, where you need dozens of servers running the very same software. This world is the Earth. Python eggs and Ruby gems were designed for the same target audience and with similar requirements; as such, they share the same deficiencies when it comes to other audiences:

1. They replace the operating system s packaging tool. This is very nice to not wait for the packagers when you want the latest development version, but you lose track of what is actually installed. In production, you need to know exactly what s installed and at what version. You also need to know what you will need to update in case of a security issue.
2. They install packages automatically on the system. This is really the biggest WTF; there are some reasons to do that to begin with, but they are all wrong.
3. They use a specific file format. This requirement comes mostly from the Windows world, and it really makes no sense on Unix. It makes it much harder to integrate complex applications using components in different languages.
4. They ship all files at the same place, happily violating the FHS and making it even harder to integrate with other things.

Python tools (setuptools and easy_install) have shifted their philosophy and brought a few small improvements which allow us to easily work around issues 1-3. These tools now include all you need to build a development environment in any directory that will not have an impact on the system packaging, making a clear distinction between the two targets. Furthermore, the metadata is shipped separately and can safely be included in a distribution package. Similarly, modules will not be installed automatically on your system. I have yet to see such a move from Ruby developers. However, what we are still missing is something along the lines of dh_make_perl: starting from a CPAN module, it will generate a clean and working Debian package in a few minutes. There have been some similar attempts for Python, but nothing as efficient. And I am certainly guilty of not having done something in this area, as one of the most knowledgeable of issues we encounter while packaging Python modules. As a note, I should add the underlying issue behind all of this is still the same: the NIH syndrome. Developers are reinventing the wheel, engine and transmission. Which is not that bad per se, but by not looking at existing solutions for the problem of making a car move, they are inventing a square wheel, a steam-powered engine and a superconductor-powered magnetic transmission. For example, while trying to fix the 4th of items listed earlier and they are really willing to fix it and several more general issues, setuptools developers forgot to look at the existing solutions:

• API versioning in /usr/include/package-X.Y
• ABI versioning of libraries
• Build/install-time requirements gathering using an extensible format with pkg-config
• Automated generation of config.h containing all system-specific macros (including paths), with autoconf
• The Mono Global assembly cache which solves some of the specific issues of interpreted languages

Certainly, the existing tools are everything but perfect, and not necessarily suitable for Ruby and Python, but some of the design ideas behind them are clearly the good solutions to some of the issues of software development and integration. Adapting these ideas to radically different languages is going to take more time than just throwing other layers of symlink farms.

As I mentioned in my last entry, the end of the semester is one of overwhelming, seemingly unstoppable entropy. People and Professors are tired and to help move us through this thickness, I try to pick fun readings. Today I also had the opportunity to have a group of NYC-based Anonymous come to class today to give us a window into the politics of protesting Scientology and this of course worked magnificently against the end-of-semester-entropy. In a nutshell: they did not fail or in their own lingo, it was an Epic Win. They provided a really nice set of presentations (and then also proceeded to collectively draw the lulzy image featured above) about their origins, their purpose and some of the tensions within the group. Then we had a class discussion about a number of topics, including their argot and “offensive” (offensive) [I am not sure whether to put " " or not] online language. While I am still ambivalent about their use of “fag” and “nigger”, I greatly admire Anonymous for their politics of pleasure and aesthetic audacity (not to mention creativity). They insist that protest must be fun, must be wild, must go beyond simply rational discourse. If you are interested in this topic, check out Stephen Duncombe’s excellent (and very readable) book Dream, which I happened to be (somewhat randomly) reading right now and it helped give me a new fresh perspective about the politics driving Anon.
Duncombe is a professor at NYU Passionate (with a Capital P) about politics with a lot of real world political experience who examines the importance of desire, fantasy, and pleasure for progressives and leftists who tend to shy away or even denigrate such impulses. And it is certainly the case that Anonymous is experimenting, consciously and unconsciously, with these very questions and impulses which helps explain why many people jumped on board. I hope to post the audio from the class a little later on.

Normally, those would not be the search terms I would plug into Google, first thing in the morning. But they were appropriate, today. Because that was what was happening. When I was younger, I used to have asthma and, as part of that, I would invariably contract bronchitis periodicially. Over the past years, even though my asthma has receeded, I would still get bronchitis at the interface between seasons. It did not matter if the season change was hot to cool, or cool to hot. Whatever the change, I would get it. I've been used to this. It is, in it's own way, comforting. I can watch the seasons change, and notice that are changing earlier. It's like I have an in-built global warming detector! This latest bout came on about 3 weeks ago. So, as usual, I thought nothing of it, bought my normal supply of strepsils and went about my life. It was not until I was doing some training, and was left exhausted and wondering why that I decided to head to the doctor. He could not hear anything wrong with my lungs. We did a few peak flow tests; my best of 3 being 250. Typical values for a health person are 600+. His conclusion: Your asthma has recurred. . A week later and I am still short of breath, but also coughing up blood. So after some searching on the interwebs, it appears that this can be normal with excessive coughing. And that the best ways to control excessive coughing are: codine¹ (paracetamol / panadol) and chocolate ² So, I've been indulging myself in both. I'm off to get a chest X-Ray just in case this is more serious and the blood re-appears tomorrow. But now you know that chocolate is good for you (and your cough).

I have not sat behind the helm of teaching for very long but I already have a few tricks up my sleeve. One of them is that I assign some of my favorite readings at the end of the semester so as to counter the downtrodden and tepid spirit and mood (not to mention attention) of my students, which drops precipitously with each passing day. Let’s face it post Thanksgiving, we are all a little tired and I try to find the readings, which uplift, intrigue, and challenge cherished assumptions about marriage and sex. So far it seems to pay off and I often can tell because the conversational pitch and excitement in class is high and the student writings are good, great, even exceptional, which, again, is hard to produce/induce this late in the semester. Readers of this blog would probably be most interested in one of these lively readings, Ben Nugent’s American Nerd (and it might be interesting to hear how the European Nerd story would diverge or converge with this one). One of my students, an audio geek and Free Culture President/Free Software junkie, by the name of John Randall produced a very nice little response (not research) paper on the Nugent reading as well as a short piece by Sarah Seltzer from Bitch Magazine
The(Girl) Geek Stands Alone (and thanks to Joe> for cluing me into this piece). Seltzer piece basically argues, in her own words, the following:

Imagine this scene from a comedy: a group of female friends sit around smoking a bowl and working on the Wikipedia page for Lord of the Rings. Their fashion sense is decidedly iconoclastic and several sport thick-rimmed glasses. Without a trace of self-consciousness, they have a hilariously ribald discussion on the relative traits of elves and orcs.
Awesome as it is, you’ll never see this scene onscreen. No mainstream movie or TV series would dare group so many female nerds together, or celebrate them so unabashedly

So John’s whole response paper is here and here is the pdf. In the paper, he makes a number of excellent points but what I loved most about it was his very geeky move at the end of the paper to prove Sarah (somewhat wrong) by listing all the girl geeks that do and have appeared in mainstream (and not-so mainstream) entertainment venues/shows, etc. They are as follows and in his own words:

I will now showcase my own geekiness through my knowledge of geeky female characters. Why? Because I can. But also because I want to demonstrate that if you look hard enough for representations of female geekyiness in pop culture, you will find plenty. Moreover, if you pick the right ones, you can make them support your argument about gender relations, whatever that argument might be. Some of these charters and personalities are hardly gendered, some are hyper-sexual. Some are incredibly attractive but completely asexual. Some undergo a transformation into/out of geekiness, while others to not. Some are powerful, while some are powerless. Some (most?) celebrate their geekiness, others are tortured by it. They are all geeks take your pick: Aeon Flux, a sexy geek who’s technological gadgets give her super powers (Comic drawings then Charlize TheronAeon Flux) Wonder Woman, attractive pilot of an invisible plane Lara Croft, a female Indiana Jones in short shorts, wielding guns and cracking computer codes (CGI and then Angelina Jolie in Tomb Raider) She-Ra, who was way smarter than He-Man (Masters of the Universe cartoons) Gadget Hackwrench, beautiful chipmonk technician for Chip and Dale (Rescue Rangers cartoon) Velma, featuring eyeglasses, awkwardness and brains (Scooby Doo), Hermonie Granger, a geek who is temporarily rejected because she is a geek, remains a geek, and finds love and happiness (Harry Potter) Barbarella, who, through comic strips and a 1968 film, helped introduce science fiction and sex to young women (Barbarella) La Femme Nikita, a skillful, savvy, and very feminine girl who doubles as a covert spy Kate Libby, aka ‘Acid Burn’, uber-sexualized hacker (played by Angelina Jolie in Hackers) Kathryn Janeway, smart and powerful captain of the USS Voyager (Star Trek Voyager) Starbuck (Battlestar Galactica), Dana Scully, FBI agent with encyclopedic media knowledge. The bizzare subtex of non-realized sexual tension was part of the magic The X-Files. Willow Rosenberg, geeky sidekick turned geeky supervillian (Alyson Hannigan in buffy the Vampire Slayer) Michelle Flaherty, hyper-sexual band geek (Alyson Hannigan in American Pie series) Dr Ellie Sattler, heroniene scientist (Jurrasic Park) Ellie, scientis hero (played by both Jenna Malone and Jodi Foster in Carl Sagan’s Contact) Dawn Wiener (Heather Matarazzo in Welcome to the Dollhouse Enid and Rebecca (Thora Birch and Scarlett Johanson in Ghost World) just about every charater ever played by Jenna Malone (Donie Darko, The Dangerous Lives of Altar Boys, The United States of Leland, Saved!, etc) half of the charaters played within the last decade by Jodi Foster (Panic Room, The Dangerous Lives of Altar Boys, Flightplan, The Addams Family half of the charaters played by Christina Ricci (Mermaids, The Addams Family, Little Red Riding Hood, The Ice Storm, Buffalo ‘66, Prozac Nation, Pumpkin, Speed Racer) half of the characters played by Natalie Portman (The Professional, Mars Attacks!, Star Wars, V for Vendette, The Darjeeling Limited, Mr. Magorium’s Wonder Emporium, Garden State) Molly Ringwald. characters played by Molly Ringwald. Rock musician Ani DiFranco and geeky Riot Grrls everywhere. Sarah Vowell, NPR commentator celebrating her geeky life. Voiceover for geeky cartoon characters. Rachel Maddow, for being Rachel Maddow.

First, awesome list, though he forgot a few (like one of my favorites, Bionic Woman and a more recent one, Juno) and it is nice to have it in one compact place. But, I have to say, I still agree to some degree with Sarah Setlzer, though I also agree with John. On the one hand there are representations and it is as important just to strut this stuff publicly as it is to claim that there is not enough female geeky representations in mainstream media. This is what John has done quite nicely. One the other hand, as he himself says ” if you look hard enough for representations of female geekyiness in pop culture, you will find plenty.” I think those words, “if you look hard enough” also speaks volumes of the continued disparity that does exist. One should not have to look “hard,” and the only blockbusters, so to speak, which feature a female geek, is Tomb Raider, which for being so hyper-sexualized is not so geeky to me, no matter how good she is with the gadgets. That said, what I find so important, and have emphasized in different contexts, is the need for what I think of simultaneous positive and negative form of critique, the former being about pointing to already exisitng examples to get people jazzed and excited and to put things in perspective. The later form of critique, negative critique, identifies a lack, a void to fill, just the type of excellent commentary in the Seltzer piece… But now for the most important question, who has John overlooked?

Two days ago, I arrived from Choron which is one of the most beautiful beaches of Venezuela. There, It was held the "II Congreso de Fisicoqu mica Te rica y Computacional" (Congress of Theoretical and Computational Physical Chemistry). The congress was really nice because it was a meeting which included quantum chemists from Venezuela and from another countries. I went there in a bus that was assigned by La Universidad del Zulia for me and other attendees. What does this have to do with the title of this post? Well, I had the chance to share time with people (my co-workers) that in some way they live the life in a simpler way than me. For example, they don't care using Linux, Windows, or Mac. They don't care listening to Salsa or whatever other music. They don't care using semi-empirical methods or Ab Initio ones. They don't care studying organic compounds or inorganic ones... So I had a reflexion: should I have to be a little bit more flexible with my points of view? Should I stop being that critic with every field that I study or I am part of? By the moments, looking at what I have been able to achieve being how I am, I think I shouldn't turn. But I accept it was good to see and share time with people that live life a little bit simpler (and I am aware that I have to improve some stuff about me).

There was a poster section where there were lots of interesting Physical Chemistry works that are being carried out in different parts of Venezuela. My poster was related to the linear and non-linear optical response of the nitrogen basis of DNA, RNA and their tautomers in Gaseous phase . It was interesting to see that most of the computational calculus servers, Grids, and clusters were running Debian instead of systems based on Red Hat which have been for long time widely used in the world of sciences in Venezuela I hope to see more and more laboratories of my country using Debian with the pass of the time. However, the implementation of Debian has increased a lot in this field. In the laboratory that I am part of, almost all the machines uses Debian as environment to carry out quantum calculus.

On the 26th of November 2008, there was a double blow. It had been raining almost all night in Chennai and we put on the TV to figure out what the weather was going to be like only to find out that there had been attacks with guns and bombs in multiple areas in Mumbai. The attacks in Mumbai and the rain in Tamil Nadu continued over the next 36 hours or so --- with disastrous effects all around. All this was more than a week ago and so it feels as if one can write about it with a modicum of objectivity. The cyclone that hit Tamil Nadu was not man-made, but many of its consequences were. The attacks in Mumbai were carried out by people who were human beings once upon a time, but they had their humanity stripped by those who run the camps which trained them. So to some extent it feels as if we have suffered from a natural disaster --- but one which could have been mitigated by humans. The Indian state and people seem to be returning back to "normal" and this is said be a sign of our resilience. On the other hand that may only be because we suffer a thousand cuts every day --- self-inflicted. Indeed, each one of us is a minor terrorist carrying out little acts of rebellion against the state; acts that also threaten the well-being of our fellow citizens. Some examples follow:

• we throw plastic bags and paper cups into the canals and drains around our cities.
• we evade taxes and even pride ourselves on reducing government power as a consequence.
• we throw lavish "rave" parties where drugs and alcohol flow freely.
• we destroy public roads and public spaces for our own private needs.

The list could go on and on ... All of these acts weaken our state and our people to the point where we cannot act swiftly in an emergency:

• garbage blocks the canals, which leads to floods during heavy rains.
• the lost taxes means reduced training and equipment for our police and other emergency forces.
• the drugs and alcohol that are distributed at the "rave" parties are bought from the same smugglers who also bring guns and RDX.
• public roads are in no shape to supply things required during emergencies.
• public spaces are not available for relief efforts since they are illegally occupied or damaged beyond use.
• our under-paid police force has its hands full dealing with the thousands of little violations that we commit.
• our police force is so used to looking the other way while our top brass and gold-laden classes are violating the rules that they can be forgiven if they cannot distinguish them from the "real" terrorists.

This is what makes us a "soft target for terror". If the Indian government were to indeed go after all those who are weakening it and terrorizing its people, then a good percentage of our citizenry and an even larger percentage of our well-off citizenry would find itself in the cross-hairs. To paraphrase what an assistant commissioner of police once said: If 100% of our citizens are 2% terrorists then it is very hard to catch the 2% of the citizens who are 100% terrorists.

Joe Wikert swears off business books: http://jwikert.typepad.com/the_average_joe/2008/11/business-book-breakdown.html and in the process, he highlights one of the reasons for Squeezed Books to exist: most business books are pretty high on the fluff/content ratio. Even a lot of the good ones which present a noteworthy idea need to pad out those ideas to make a book out of them, as the basic idea can usually be described in a few pages. The part of Squeezed Books that I really hope to get going is the discussion of books, because I think that can add a lot of value for people. Reading a book is part of learning, but you often internalize and consider things more deeply when you actually discuss the ideas in the book, subjecting them to critical examination, and applying them to situations you have experienced. Incidentally, I also rejigged the site's look and feel, using the blueprint CSS 'framework'. I'm not much of a designer, so I have to aim for simple and not unpleasant, rather than beautiful and flashy.

If you don’t know about this great project, you should. The nitty gritty details are to be found here. FLOSS Manuals Release Circumvention Book, How To Bypass Internet
Censorship December 4, 2008, Amsterdam A new book released by FLOSS Manuals, How to Bypass Internet Censorship,
describes circumvention tools and explains why you might want to use
them, and honestly describes the risks you must consider before
circumventing blockers or monitors. Blockers and monitors restrict
access to areas of the Internet, and this book describes simple
techniques for bypassing those restrictions. The book can be read or
downloaded for free as a PDF from flossmanuals.net, or you can purchase
a high-quality printed copy of the 200 page book through Lulu, an
on-demand printer, at http://www.lulu.com/content/4904448 for 10.83
($14.00). The growth of the Internet has been paralleled by attempts to control
how people use it, motivated by a desire to protect children,
businesses, personal information, the capacity of networks, or moral
interests, for example. Some of these concerns involve allowing people
to control their own experience of the Internet (for instance, letting
people use spam-filtering tools to prevent spam from being delivered to
their own e-mail accounts), but others involve restricting how other
people can use the Internet and what those other people can and can’t
access. The latter case causes significant conflicts and disagreements
when the people whose access is restricted don’t agree that the blocking
is appropriate or in their interest. Problems also arise when blocking
mechanisms and filters reduce access to useful business, health,
educational, and other information. Because of concerns about the effect of internet blocking mechanisms,
and the implications of censorship, many individuals and groups are
working hard to ensure that the Internet, and the information on it, are
freely available to everyone who wants it. There is a vast amount of
energy, from commercial, non-profit and volunteer groups, devoted to
creating tools and techniques to bypass Internet censorship. Some
techniques require no special software, just a knowledge of where to
look for the same information. Programmers have developed a variety of
more capable tools, which address different types of filtering and
blocking. These tools, often called “circumvention tools” help Internet
users access information that they might not otherwise be able to see.
This book documents simple circumvention techniques such as a cached
file or web proxy, and also describes more complex methods using Tor,
which stands for The Onion Router, involving a sophisticated network of
proxy servers. How to Bypass Internet Censorship was written by eight writers in a
FLOSS Manuals ‘book sprint’ - a week-long intensive writing session, and
it also includes content from many different authors’ previous works on
the subject.
How to Bypass Internet Censorship will always be available for free from
the FLOSS Manuals Website. Each sale of the book generates $2.50 (USD).
100% of this income goes back into the development of more manuals about
free software. About FLOSS Manuals
http://www.flossmanuals.net
FLOSS Manuals is a non-profit foundation and community creating a
collection of manuals that explain how to install and use a range of
free and open source software. The manuals are friendly and simple, and
they are intended to encourage people to explore the wide range of free
and open source software. FLOSS stands for Free, Libre Open Source
Software, and FLOSS Manuals intends to provide free manuals for free
software. The manuals on FLOSS Manuals are written by a community of
people, writers, editors, and technicians do a variety of things to keep
the manuals as up to date and accurate as possible. The way in which
FLOSS Manuals are written mirrors the way in which FLOSS software itself
is written: by a community who contribute to and maintain the content. FLOSS Manuals produces printed books, PDF books, and HTML output. Each
chapter from each manual can be recombined with other chapters to create
a new manual, which we call remix capability. An embed API lets you use
FLOSS Manuals to write the content and then embed the content into your
website. For more information contact:
Adam Hyde
Founder, FLOSS Manuals
adam@flossmanuals.net

No software is perfect, and most users happen to have some itches they would like to scratch on them. I don’t know anyone who hasn’t thought some day “why can’t that software do <some feature>”. But not everybody is able to scratch these itches. For a starter, most people aren’t developers, or aren’t able to modify source code to reach some known goal, be it fixing a bug or implementing a missing feature. But even when they are able to do so, most applications can’t be fixed or improved easily: most widespread applications are still proprietary software where access to the source code is either impossible or prohibitively expensive. That’s the good thing about open source and free software: you are able to itch these scratches yourself ; and as a free software user and developer, I often do so in the software I use. I must say it’s even frustrating when you are used to this possibility but end up on damn stupid bugs or limitations you can’t fix in proprietary software. I have quite a bunch of such examples, the most recent ones being with VMware ESX, but that’s another story. Mobile phones are everywhere nowadays. In some countries, there are even more mobile phones than people. A huge amount of people are using them daily. Or maybe should I say “endure”. When you go to shop for a laptop, digital camera, or digital portable music player, you can find demonstration models you can fiddle with, see what the user interface looks like, how it behaves, see if whatever feature you like on such devices is present and how easily you can do what you want. With a mobile phone, you don’t have all that (at least in France and Japan, where I experienced this). You’re lucky if one of the sellers owns the exact model you’d like to test and lends it to you for a minute. Most of the time, the “thing” to watch is a plastic model, not even remotely related to the real thing in colour, weight… and obviously, it has as much use as a brick (not even so, actually, as you can’t, for instance, break windows with it). And most of the time, you end up regretting the choice you made, because the UI is so unuseable, or so slow after a while, or so buggy, etc. More and more phones nowadays have multimedia as their main feature. While it can be nice, especially when you see how some are pretty good at it, and when you consider it avoids you to carry both a phone and a multimedia device. Sadly, they usually forget to be good phones, too. Sometimes even, multimedia(-related) features are crippled by the carriers. As an example, my phone, while able to read mp3 music, has been limited by the carrier to refuse to use them as ring tones, while, according to the maker and to various forums, the phone is perfectly able to do so. It’s even worse than that, because even converted as 3gp, which it otherwise allows as ring tones if you download them at a ridiculous price, it still doesn’t allow to put your music as a ring tone. You got it, features in phones are also limited for big money-making. Fortunately, there is a hole in my phone where I can set a 3gp as ring tone if I do it from the music player instead of the file browser. Most articles I read about Android, or the iPhone SDK, relate how they are great opportunities to enable developers to provide nice applications for users, using the provided frameworks. But the thing is : they’re only applications. An application is not the core of the phone. An application won’t take care of ring tones, or vibration types. And that’s what open source in mobile phones should also allow users to do. That’s what it all should be about. As a user and free-software developer, I would like to enhance my phone like I can enhance my laptop. For instance, my phone will only allow crappy polyphonic tones for SMS or e-mail reception. Digital music is only available when you receive a call. Why ? There is obviously nothing preventing digital musing when receiving SMS or e-mail, except a stupid software restriction that could be fixed if the firmware were open-source. Very few phones in France appear to allow japanese input, let alone proper display of japanese characters in e-mail or on the web. My previous phone was able to display japanese correctly. My current phone doesn’t. Neither of them is able to input japanese (which is not unexpected in France, actually). I know the iPhone does both. Anyways, these are informations very hard to get a hand on before buying a model, and something that open-source would allow me to fix. Even better, it would allow me to take the pieces from the asian version of the same (or similar) phone which probably has the functionality. The phone I had when I was living in Japan had a nice feature that I haven’t seen in any phone in France (but again, this kind of information is very hard to get): different vibration types. For example, you had a vibration type making short vibrations, another one long vibrations, yet another one 3 short vibrations, a short pause, then 3 short vibrations again, etc. This is very useful when you disable ring tones during a meeting or some other occasions where you don’t want to bother the people around you with your phone ringing: depending on how the phone vibrates, you know whether you have to take the call or can ignore it, or if it’s only an e-mail, without taking a look at the phone. Again, an open-source firmware would allow me to implement this. I’m sad so much of what open-source can bring to mobile phones is so badly publicized.

I just discovered the nice Survey of Free Math Fonts for TeX and LaTeX (PDF-Version) by Stephen G. Hartke a good overview of the common font packages, with examples, useful for those who have seen enough Computer Modern by now.What I m still missing is a good style guide: When should I use Palatino, when is Utopia a good choice? What are good reasons to use a sans-serif font for the text, and when is that not a good idea? They all look nice to me, but I doubt that the professional typographist leave it all to personal preference.

I just discovered the nice Survey of Free Math Fonts for TeX and LaTeX (PDF-Version) by Stephen G. Hartke a good overview of the common font packages, with examples, useful for those who have seen enough Computer Modern by now.What I m still missing is a good style guide: When should I use Palatino, when is Utopia a good choice? What are good reasons to use a sans-serif font for the text, and when is that not a good idea? They all look nice to me, but I doubt that the professional typographist leave it all to personal preference.

Next time I have to explain why I (really) prefer dogs to cats, I will not provide an argument. Instead, I will point people to this video. While the video is not an instance of joking, it is nonetheless a potent example of humor, at least in the way that the philosopher, Simon Critchley has defined it in his compact and very powerful (and very beautifully written) book, On Humour:

Jokes tear holes in our usual predictions about the empirical world. We might say that humour is produced by a disjunction between the way things are and they way they are represented in the joke, between expectation and actuality. Humour defeats our expectations by producing a novel actuality, by changing the situation in which we find ourselves…