How not to obtain a copy of Hackers or Firewall in Birmingham at 10pm:

• Consult the Tesco website, find the nearest one on a map.
• Go down the wrong street, end up quite a long way past the Tesco, which, incidentally, is basically right next to your hotel.
• Ask at a service station where the nearest Tesco is.
• Traipse for miles down a dual carriageway.
• Get to a train station you don't recognise, realise that there's no roundabout on this road (the directions including 'turn right at the roundabout'), realise you can just take this road and go back home in defeat.
• Stop at every service station and newsagent along the way.
• Receive advice that the Costcutters (which is next to your hotel, and definitely doesn't sell DVDs) will definitely sell DVDs.
• Go to the convenience store right across the road from your hotel (and very close to the Tesco), get told that the Tesco's right near Five Ways will sell it. Realise that Five Ways was the name of the train station you saw earlier. Kick self.
• Try the offlicence you walked past right as you left the hotel again, realise that they do in fact rent DVDs, but are hidden. Offer boatloads of money for Firewall. Get knocked back. Attempt to sign up. Must be a UK resident (not me), and must be carrying bills with your home address (not mjg59). Further attempts at cutting a deal foiled by the shop attendant's inability to speak anything more than very basic English.
• Go back to your room, wet, tired, and thoroughly defeated.

Hey folks, we released some minutes ago finally Debian-Edu/Skolelinux 3.0r0 “Terra” which is based on Debian 4.0 with some modifications to work out-of-the box. Here are the releasenotes: Oslo - July 22., 2007 Skolelinux 3.0 is ready. This is an community release with comprehensive support from regional and national projects in Germany, Spain, France, Greece and Norway. The Skolelinux project is now a part of Debian under the name Debian-Edu. Several other projects have made additional functionality to Skolelinux tailored for national needs. Skolelinux now supports more than 50 countries.

Whats new in Skolelinux 3.0:

• based on Debian 4.0 “etch” and therefore compatible to LSB 3.1, using kernel 2.6.18 and KDE 3.5.5
• Full support for networked Thin clients, LowFat (diskless) clients, Workstations and Laptops. With the LowFat clients users got full PC functionality with extremely low maintenance cost. The use of LowFat clients gives full support for sound, video, USB memory stick’s and DVDs without the need for a local installation.
• Skolelinux now got more than 80 applications selected for pedagogic uses, supporting more than 50 languages. Many new applications are introduced in addition to popular classic as GCompris, KDE-Edu, Iceweasel (unbranded version of Firefox) and OpenOffice.org.
• Installation is a breeze: Both the installation and source code for all software are now distributed on a single DVD now supporting three different processor platforms as i386, PowerPC and AMD64. This makes it more easy to choose hardware, and to study the recipes behind the software. Those interested can exercise their freedom to learn, participate and share knowledge more easily. Installation CDs are also available, but requires a working Internet connection for installation.

About Skolelinux Skolelinux is a complete tailored software solution for the needs of any educational institution or school. It is a ready computer system were the school does not need to piece together the components. Skolelinux is the result of the work of the Debian Edu project and Debian Edu is an official Debian subproject. It is installed in a great number of schools in Norway, Germany, France and other countries. Municipalities and Commercial Service Providers run Skolelinux across multiple schools, operated and maintained centrally. Service providers report that the “lowfat clients” require half the maintenance cost of other desktop alternatives. The next milestone of Skolelinux development will be to merge the Debian-based LinEx distro into Debian Edu. Currently LinEx is used by more than 250,000 students and public employees in the region of Extremadura in Spain.

In depth “Lowfat clients” is also known as Diskless workstations. They run applications locally on the client. All software comes from the server instead of locally from the client hard drive. Recommended minimum requirement for client machines is > 256 MB RAM and 800 MHz CPU. Skolelinux now got improved tools for system surveillance and maintenance. Roadmap for next merging of LinEx and Debian-Edu: * http://wiki.debian.org/DebianEdu/LinEx2DebianEdu-Roadmap Please note that the documentation for the 3.0 Terra release is only available in English at the moment and contains some rough edges. We have considered releasing before the end of the summer holidays more important and we will fix those rough edges in the coming weeks, when we also expect more translations to show up. Those fixes will be included in the upcoming 3.0 r1 release.

What’s the single biggest advancement Linux has brought to the industry? It’s an interesting question, and one that in my opinion has a very simple answer: Package management—or, more specifically, the ability to install and upgrade software over the network in a seamlessly integrated fashion—along with the distributed development model package management enabled. It used to be that operating systems were big, monolithic products, and applications were big, monolithic products you put on top of them. If you wanted to deploy, say, a web application, you sourced the middleware stack (which itself was probably several big products too), you sourced the operating system, and you (often painfully) had to integrate the two yourself (or pay a big company lots of money to do it for you). These days, you increasingly just “apt-get install whatever“. In this world, where does the operating system end and the application begin? The line is increasingly blurred—for when applications are deployed using an OS facility, seamlessly integrated with the OS itself, is the result an application or a feature of the operating system? In fact, in a very real way, all software looks to become part of the operating system—or, at least, this has certainly been the trend in the Linux world. What does this shift mean to the industry? For one thing, those of us that build operating systems as monolithic products have to change—it’s what users expect, and with a componentized operating system rather than a wad of stuff, it becomes far easier to push new innovations out into the marketplace and generally evolve the OS over time. Indeed, refashioning Solaris as a “distro” is the essence of Project Indiana—and package management is the key technology that will hold it all together. So, the next time you read about how Project Indiana aims to make Solaris more “Linux-like”, keep in mind that what we’re actually “copying” is the distro model, not Linux itself—which, after all, is a kernel, and has nothing to do with the package management and so forth the distros (you know, like Debian) built above it. This, better than anything else, highlights the opportunity for Solaris: What people really know when they say they know “Linux” is the environment that exists around the Linux kernel—the distro—all of which Solaris can deliver, and more.

The rinse tool has been sucking up a bit of my time recently, but happily it now installs:

• Centos 4 & 5.
• Fedora Core 4, 5 & 6.

(Debian package for Etch available here. Could be worth uploading to Sid? I'm tempted to do it myself .. at the very least it provides an alternative to rpmstrap and it shouldn't require constant updates... Yay? Nay?) Each of the seven supported distributions may be installed as either "i386" or "amd64" flavours. The current CVS version of xen-tools can use rinse as an installation method, so I can now create Xen guests of RPM-based distributions with a single command and a few minutes of patience. Nothing else exciting is happening right now. My partner is still away in the United States. (Counting fiddler crabs in the Florida Everglades!) Still it isn't all bad - she promised to bring me back a Nintendo DS - and the pictures seem to suggest she's having a fine time. Argh! Pirates! The only other thing I'm doing right now is working on the alternative dating site. That seems to be picking up steam in two geographical clusters. So I'm now spending a fair bit of time pimping, promoting and advertising specifically in the Edinburgh & London areas.

Following Uwes blog entry about flashrom, I finally decided to upgrade my Desktop PCs BIOS. Was about time, it was still running on the original BIOS version from back when the Board got manufactured (2004), and Tyan managed to release 6 new versions since then, all adding a lot of nice features. The update went nice and without a single problem (yay) and now I have tons of new stuff. Like - working powernowd support, automagic fan speed control and some other gimmicks. The first thing got my CPUs, usually running at 45 - 60 C to now work with about 37 C, as they are now mostly idling at half the speed they did before. Thats up to 23 C less heat. The fan control now gets fan 1 (of 2) in my Desktop to run with a very low speed, around 100RPM, sometimes it even seems to turn itself off. (My system uses a big fat watercooling with a water tank that has something between 20 to 30l of water in, so the fans are only to get air moving a little bit). Also, with my recent upgrade to 2.6.22.1 on this machine its now also able to suspend and resume. Which wasnt possible earlier, for unknown reasons. Ok, I can only suspend-to-disk, not to ram, there it only supports “Standby” mode, but its already better than “either on or off”. Funny side note - my desktop, having a NVidia card, using the non-free nvidia driver can suspend/resume without problems. My laptop, also having a NVidia card, can only suspend/resume without problems if I do not use the binary driver. The binary driver is able to suspend, and even resumes, but then Xorg (latest sid) happily eats all CPU cycles. The free nv driver at least works in suspend-to-disk mode. But fails to turn on the display in suspend-to-ram mode. Of course nv also manages to lock the whole machine if I try to run an application that needs a little bit more video foo, like blobwars or supertux. Oh, and my Xorg still seems to turn on the monitor, not liking DPMS, as blogged some time ago. But it’s now not limited to acpi events, it must be something else. Weird, but I didnt have enough time and motivation to debug this (or googling, maybe others have the problem too). Its only a very small bit annoying. (Sometimes happens after seconds, sometimes takes a minute).

Yes and really proud of it.. David did an awesome work fixing the tons of bugs I have been reporting in past couple of weeks with my super stress testing of the implementation. I have to admit that he was also > this close to scramble the "black choppers" towards my house but that's usually a good sign when I can piss him off this much :) ..because we did beat Xen ;) David implementation of LDOM was merged upstream in about 2 months development. Xen took only 3/4 years? :P Anyway just kidding.. don't take it personal. Xen is a full mature implementation and LDOM still lack functionalities and features but we are getting there very very quickly. For now I am going in vacation for a few weeks with my son and plan to stay away as far as possible from any form of electronic equipment and give David some slack to relax too. Once back I plan to hack my LDOM workarounds to handle better some "features" of the vds partiton checker and complete the tests with exporting single partitions. Thanks to Barton for shipping me a couple of extra disks for my Niagara, I will also be able to test other combos with Nevada and different guest setups. Stay tuned!

Maj, Amita June and I had a long day on airplanes today, heading to San Francisco. My brother Ted and his partner Nabil have decided to have a commitment ceremony, which is I guess one way of saying "get married". It's casual and fun, just like Ted and Nabil themselves, but Ted means too much to us for us to miss this event. So we spent some miles, dropped everything, and headed out west. Amita's still young enough (under 2) that we can sit with her on our lap. Not only that, but if we get her a seat, we have to bring along a car seat -- more of a hassle than having her on our laps. Still, on a crowded flight it can be kind of hard. Maj is really good at packing for the plane -- putting together food, toys, books and other distractions to get AJ through a long flight. But today tested her skills to the limit -- we had a 2 -hour flight to Dulles, then another 6 hours out to SFO. That's too much for any grown-up, much less a 22-month-old. AJ had a hard time going to sleep at naptime, and we had some crying -- some loud crying. Otherwise, the flight was survivable. I picked up JPod, the last novel from Douglas Coupland, at the airport before we took off. It's a great read -- difficult, exposed, referential, glib. A good read. My dad -- Amita calls him "Pappou", Greek for "grandfather" -- met us at the airport. Amita's usually pretty standoffish with any adult who isn't me or Maj, but she's really comfortable with Pappou. She told him stories about flying while we waited for our bags. "Tita... Airplane! Tita... Raisins! Draw! Stickers!" She got a lot of time to do it, because our luggage took a long time coming off the plane, and two of our bags never came. But it was nice comin' home to my parents' house, who've built a big backyard patio since we were last here. We had pasta and salad on the lanai, and then AJ went down for an easy night's sleep. Soon for me, too. tags: travel amitajune maj lostluggage sanfrancisco dulles jpop douglascoupland

DemoCampMontreal3 DemoCampMontreal3 is next Tuesday, July 24th, at the SAT. I'm excited about the event, since Niko and I will be showing our new project in public for the first time. It looks like there will be a pretty good line-up, and I love going to SAT for DemoCamps. Of course, I'm flying into Montreal at 5AM that morning, but it'll be good nonetheless. tags: democampmontreal3 barcamp barcampmontreal sat

Blog reactions I was glad to see that Creative Commons had a nice response to my essay about Paying wiki contributors. I've had a few people give me private responses, and I think it's an interesting issue that's important for people thinking about wiki, and wiki commercialization, today. tags: cc wiki commercialization

Thanks to the timely efforts of Lo c Minier, a more usable (even though still featureless) bug-triage version (0.1-2) has found its way to the Debian Archive, alongside with the shining new btsutils 0.2-1. Now it does return something on queries...

The development is also progressing, the current version in git can already show the upstream bugs for a given Debian package whose upstream uses bugzilla.

Being a good Debian user

Notes: the bulk of this article was written on the 17th; updates were added in later; this article is really long, you might want to read it in more sessions

Debian's arm port uses hardfloat. This means that apps like rrdtool (graph function) take ages to run because there is no floating point unit. In order to make this faster you'll want to use soft-float emulation. But this support needs to be present in all depended upon libs, including libc, which is an ABI incompatible change which would break all binaries. I can't use the yet-in-development-and-unofficial armel port since the machine has to be up and running almost 24/7 and I can't afford downtime.

So what to do?

Well, obviously use another soft-float enable libc, like uclibc, in parallel withe the hrad-float enabled libc. Debian Sid contains uclibc development libs, but building the whole toolchain is a pain. There is no real support in the distro itself and building on the arm machine is kind of out of the question. I tried a little in a debootstrapped chroot on the native machine, but this was a pain and I was stuck tring to figure out how to disable whitles and bells for rrdtool since I didn't needed any of the perl, tcl or python support. So I stopped, went to bed and decided I'll continue the next day (the day I wrote the biggest part of this article). The future looked dark, trying to build a softfloat uclibc rrdtool on a system that wasn't prepared for that and from which softfloat was pulled away somewhere during etch's development stage....

Deciding to go with the competition - native building

From link to link I found out that gentoo has arm-softfloat-linux-uclibc port, among others, so I decided to use that on the target machine (a NSLU2) in a chroot. Well I stumbled on the low computing power, when I tryed to emerge sync the tree. I gave up un that and tried to use emerge-websync. It looked better, but I didn't got too far with this either since the machine ended up being overloaded, with figures varying from 3 to 8 for the load average (all of them).

Deciding to go with the competition - cross building

It was time to bring in the big guns and I decided I was going to crossbuild those binaries, probably statically since it meant lower risk for things to break on the target machine.


Since I observed that gentoo has a nice tool called crossdev which actually uses emerge (the equivalent of dpkg+apt in Debian world) to make the cross chain tool and saw that they have some really good documentation and a development version of an arm-softfloat-linux-uclibc, I decided I could .

So I went on and downloaded the latest stage3 tarball for x86 (so I can have a gentoo system to start with), made all the necessary things and created a gentoo chroot. I emerge sync-ed, updated portage, installed crossdev (following the nice instructions on the gentoo embedded site about the subject). This took a while, but it went like a breeze. I made the necessary arangements to be able to cross build packages (setting SYSROOT, making that nice xmerge script).

As my goal was to make an arm-softfloat-linux-uclibc binary for rrdtool I tried directly to xmerge rrdtool (of course, first just pretended -p).

Finding bugs in the packages

First bug

All went fine until I found freetype which for some weird reason detected the i486-pc-linux-gnu-gcc compiler as i486-pc-linux-gnu (observe the missing trailing -gcc). I looked over the logs and determined that the CC_BUILD environment variable was not set. So exported CC_BUILD=i486-pc-linux-gnu-gcc and xmerged the library.

(While trying to fix this issue I entered #gentoo-embedded on freenode and actually met Yuri Vasilev, whom I had met in Edinburgh, at DebConf. Look for the video about Ligusk if you are interested about his project to make a Debian like distribution based on Gentoo. It was nice to meet a friendly "face" - as much you can say that online.)


I reported the bug (already there is a patch, I haven't tested, but looks ok) and the workaround in the gentoo bugzilla... after creating an account, since I never used that BTS before.

Second bug

Next pain was libart_lgpl whose upstream, for some comfortability reason chose to detect the target type sizes (and basically ignoring inttypes.h) with a small program which was built with the cross compiler which later was supposed to be ran on the host. I don't think is necessary to say that i failed, of course, since the binary was an ARM binary, while the host was an x86 machine. Yupee! not.

Ok, two bugs, no softfloat rrdtool yet. I reported this second bug and tried to work around the issue. Since I didn't really used too much a gentoo system, I wanted to know details and what possibilities I had. I got some really nice tips from "solar" (aka Ned Ludd) on #gentoo-embedded. He pointed out that while building a package one can press CTRL+z, do some stuff, like altering the Makefile.in file in the build directory and then fg back. Ok, cool.

All I need now is somebody with direct access to an arm machine that can compile and run for me the program in question. seanius on #debian-devel was kind enough to do this for me and, to my surprize, I got the same output header file as I got in the host x86 chroot. But that detail is not important, let's just compile that rrdtool. Well, first libart_lgpl...

Ok, I CTRL+Z-ed the build process just after the configure stage ended, cd-ed into the build directory, I tampered with the Makefile.in file and changed that line from

./gen_art_config > gen_art_config.h

into

cp /gen_art_config.h.arm gen_art_config.h

Haha! In your face! Ok, nasty did was done so I fg-ed and went on confident that I will get my hands on that rrdtool very soon. The package build ended succesfully, without any other suprizes, so I went for the graal!


xmerging rrdtool, the bugs don't stop

xmerge -v rrdtool

Bla, bla, bla.... bla, bla, bla, what do you know, there are a few IEEE math function tests in the configuration script of rrdtool. They failed. I don't know why, but I have a feeling that this should be happening on softfloat or even maybe the rrdtool source is not that cross compile aware. I didn't care that much, so I did what I knew best, tampering with an ongoing build.

This time is was a little bit harder to catch since I had to wait for the source to unpack (well, there is a larger frame, but that is the rough timing) and at that moment CTRL+Z the build.

I didn't had much time to waste, so after looking shortly over the tests I realized I should just ignore the error and look for the "failing command" that was interrupting my beloved build. Muhahah!

Thank God for verbose error messages, I could find the place fast and chaged the two "exit 1" statements into two harmless 'echo "Ignoring IEEE math errors"', sic. I had to do this a few times since I got the timping wrong, at some point I got the syntax wrong (at which point I remembered the cp trick I did earlier and saved the modified file in /configure.rrdtool )...

xmerging rrdtool and the 4th bug

After passing past this stage, I got a compilation error which, judging from the command, meant that the linker tried to link the target (arm) binary against the host (x86) libraries.

Oooook, this is not going to stop me! I look at the Makefile.in to try understand why this happened and then realized it wasn't worth it for me to try to fix it the right way. So I cheated once again! Muhaha, I just ran some useful commands which I'll let you feast your eyes to:

ln -sf /usr/arm-softfloat-linux-uclibc/usr/lib/libart_lgpl_2.so /usr/lib/
ln -sf /usr/arm-softfloat-linux-uclibc/usr/lib/libpng12.a /usr/lib/
ln -sf /usr/arm-softfloat-linux-uclibc/usr/lib/libfreetype.so /usr/lib/

Ok, good to go. Of course, I had to stop again the build to copy the "fixed" configure script that ignored IEEE math errors, but that is already history.

And, believe it or not, actually the build succeded. I had a cross built rrdtool using shared libraries built against softfloat ucllibc. No guarantees about its correctness, but it built!

This is when I decided to start writing this article.

Still there are things to do

I will have to do a few things before being happy about the victory:

• check that all the resulted binaries are indeed ARM ELF files, and not Intel x86. It appears the shared libs are already.
• done, they are (checked the next day)
• figure out qpkg (is a utility from portage-utils which seems to be a way to make binary packages) to package somehow the result of this work or maybe just ignore it and use plain cp
• see how I can fit together both the softfloat uclibc binaries and the native debian binaries on the same filesystem, including ld.so configuration...
• but I fear this will be a nightmare, so I might decide to go with static compilation of rrdtool, which I don't think it will be quite straight forward given the experiences describe above; there could be also the size issue to take into account, and since the NSLU2 has only 32MB of RAM, this could be problematic
• I think I'll have to use a statically linked binary after all (note added late, the second day)
  
• see if the rrdtool binary really works and if all the work payed off, performance wise - it should, taking into account what I have heard from wookey during the debconf7 talk about the armel (warning, 73MB ogg file) port
• be happy with the solution I got or wait for the Debian armel port to catch up and switch to that asap
• if I'll have to do the switch I'll probably think of ways of migrating the whole system from arm to armel, and not to reinstall everything; this might prove useful for the whole debian armel port, when people are working on migration plans, since arm will be deprecated in favour of armel

Not so long time ago i used to be a hardcore photography taker. I would carry a camera everywhere i went, and took hundreds of pictures. I even had a darkroom where to develop my b&w films. But digital came, and it was easier to shoot, check, re-shoot, erase,… you know, all the “benefits” you get with a digital: you care less what you are shooting because it is inexpensive to erase what went not-so-good. It all started again getting into shape last month, before our trip to Spain and France, when i gave my girlfriend my Polaroid camera. She was amazed and bought some film for it. In Barcelona we found a lomography shop, where i purchased a fisheye2 camera. And it finally happened 2 weeks ago when i revisited a flickr.com page of a guy who lives in NY and takes pictures daily. I was amazed, and following some links i ended up learning about Lomography.com and the Lomo LC-A’s. It was monday last week when i purchased a sealed, unused Lomo LC-A for 80e and few hours later i had my first film in several years in the shop for development. Now it is 2 weeks later (almost) and i have purchased few other items: a wide angle for my serviced old Pentax ME-1, few 120 rolls for my Yashica D, some more 35mm rolls for it (i will mod the case with some foam to insert 35mm rolls and take full 3.8×6 takes), an Olympus XA, a Minox 35ML and a couple of old FEDs. All together for less than 350e. My flicker page already reflects the activity i have been enjoying here and there. I admit it needs some cleanup, some pro upgrade and some descriptions added, but with time i will get there.

Since I'm a member of the set of people "somebody better suited to explaining it" mentioned in Silvia Pfeiffer's "A Long Story of Logins", I suppose it falls to me to explain what the hell we actually did to make the thing work. A quick recap, for anyone who hasn't read Silvia's article: the Vquence website is a very AJAXy, Web 2.0 style video socialisation site. Since we want the site to be available to all as much as possible, we don't lock any part of the site away behind a "login required" page unless we absolutely have to. An unpleasant side effect of this is that, when it does does come time for you to login, pushing you off to a separate "please login" page is going to be, well, a pest. There's all sorts of state about what the user is up to (it's a web-based video mashup creator, after all) that we need to submit -- but only after the user has logged in. Enter the realm of the Web 2.0 Login. Instead of sending the user to a login page, getting them to login, and then redirecting them back to where they want to go, you just have some sort of popup form that, when submitted to, does a background request and logs the user in behind the scenes. This isn't a new concept by any means -- for example, try voting up or down a link on reddit when you're not logged in. However, most sites that implement this sort of thing (based on our brief informal survey around the office) don't protect the password information in any way -- it goes over the wire as a plaintext HTTP request. We don't like this, so we wanted to send the login form over HTTPS. And there began our problems. The trivial implementation of a Web 2.0 Login page is as you'd expect -- the AJAX stalwart, XmlHttpRequest, POSTing to a handler somewhere that validates the login, sets a session, and sends back some javascript to change the page layout a bit to show you're logged in. We had this working nicely, until we started testing on our staging environment, where HTTPS comes into play... You see, XmlHttpRequest doesn't like making a request to a domain other than the one that the main page comes from -- for security. It also thinks that the same hostname via a different protocol counts as a different domain, for the purposes of this security check. (I can see the theoretical reasoning for it, but it is a bit weird for HTTP to HTTPS transitions) So if you want to POST to https://www.vquence.com/something using XmlHttpRequest, you need to be doing it from a page which is retrieved from somewhere in https://www.vquence.com/ as well. We considered just turning on HTTPS across the board, but that would have all sorts of unpleasant ramifications, so we decided against that. But the problem remained, how do we get the user's credentials to our server in a secure manner with a minimum of unpleasantness? We came up with all sorts of options. This is where the infamy of "bug #93" started -- it's a monster of a bug log. Lots of it is me going "we could do this, but it'd suck, or we could do this, but it would suck". Finally, Silvia (I think) suggested we look at using an iframe. "Eeew" was the general response, but it might at least give us a way to set a part of the page to HTTPS, which we could use as a launching point for our XmlHttpRequest call. While researching how to make this all work (I had, to my great pride, never inflicted an iframe on the world before), I managed to come across a few articles on how you can use a hidden iframe to handle requests instead of using XmlHttpRequest. Basically, the trick is that you do a regular POST on your main page, but set the target of the form to a hidden iframe in your page. A general discussion of the principle is available At the Apple Developer site, and there's also a Rails plugin that implements the concept rather nicely. When I found these, I briefly danced for joy. My quest was over. POST to the iframe, the iframe get some JS back from the server, JS mangles the main page's layout to show the user is now logged in... aaaand profit. Like fun it was. My implementation was short and sweet -- a true work of genius (if I do say so myself). Everything worked like a charm. Until we got it back into staging. Then cross-domain security bit me again. Naturally, if you don't want XmlHttpRequest calls to perform cross-domain, you probably don't want iframes for different sites to be manipulating each other's content either. That's exactly what happened -- the iframe can't manipulate the main page's layout as we need it to. Why I didn't think of this before I charged mightily ahead I don't know. My only defence is that I've never claimed to be a web development guru. Sneaky tricks will defeat any security measure, though. For instance, we control both sites (http and https), so we can send the user back to the unsecured site after login and then that location (still in the hidden iframe) can manipulate the main page layout. Redirect to the rescue! That worked really well in Firefox, even with HTTPS in staging. We were saved. At least until IE came along. Bloody Microsoft, ruining all my cunning plans. IE complains when a HTTPS site redirects (using the Location HTTP header) to a HTTP site. You apparently can't turn this off. I was shocked that Microsoft cared so much about their user's data security -- it's certainly not the first thing I think of when I think "Microsoft". My faith in the world was restored when Silvia pointed me to a workaround for the problem -- if you send the redirect in a <meta http-equiv="refresh"> tag instead of a Location header, IE is more than happy to let it pass. Because obvously a chunk of HTML that says "HTTP equivalence" is completely different to a HTTP header. Sheesh. To snatch defeat from the jaws of victory, after all this brilliant hacking, I managed to make a newbie error with the contents of the http-equiv by setting the content to "0;http://www.vquence.com/blah" instead of "0;url=http://www.vquence.com/blah" (note the url=, because I sure didn't). IE complained by looping infinitely on the source URL, while Firefox just made sense of it and did the right thing. I managed to waste most of an hour of three of us over that little stuff-up. Go me! (Sorry about that guys, by the way) Feeling very chuffed, I went home for the evening. The next morning saw a browser compatibility defect in my queue -- Safari didn't like the new setup. Instead of doing the right thing, clicking on the login button would create a new tab instead of logging in. The fix? Changing the style of the hidden iframe from "display: none" to "width: 1px; height: 1px; border: 0" did the trick. Fark. So much for "hidden" iframes. What's particularly funny is that Apple's own tutorial on hidden iframes says to avoid "display: none" because NS6 doesn't like it, but doesn't mention it's own glaring deficiency in this area. So, what are the lessons learned?

• Firstly, IE is different. I knew this already, but living in an all-Linux, not-normally-a-web-frontend-developer world, I need to be reminded every now and then.
• Safari is differently different. Being a former Konqueror user, and wrangling with that browser's retardations in an earlier existence, I should have been ready for this one.
• "Code to the standards" is a crock of shit. That's not to say that we shouldn't encourage it, but I'm fairly sure that the HTML 4.01 standard is silent on whether or not an iframe with it's display property set to none is a valid target for a form submission (I had a quick look, and nothing jumped out at me). Anyone who dismisses the difficulties of web development with a hand wave and a casual "just code to the standards" will get a double-spaced, 24pt printed and bound copy of all of the W3C standards dropped on their head from a tall building.
• No matter what security measure you think has stopped you, there's always a workaround. Can't do a XmlHttpRequest to a different domain? POST to a hidden iframe (you can post to any domain you want, too -- so much for cookie security). Want to run JS you got back from POSTing to a different domain? Just redirect back to the first domain. Can't redirect from a HTTPS to a HTTP page? Don't use a HTTP redirect, use a meta refresh. Sigh.
• Hidden iframes are cool. While I'm firmly in the "frames are evil" camp, they're a nice freaky behind-the-scenes tool if you want to do something more than what a simple XmlHttpRequest gives you. It's like having a whole separate scratch-pad of a browser you can play with, and the user never has to see it.
• Web development is frustrating. I don't do a whole heap of it (I'm more a backend code / infrastructure guy), so when I do some web UI work, I have to re-learn exactly how much of a pain it is to have to cater to the needs of a bunch of different browsers, each with their own quirks and irritations. Suddenly supporting a bunch of different Linux distros seems so much less frustrating.

I said I was going to upload the packages I don’t have time to finish for the moment, but that are in good shape, meaning they compile without problem in latest SID, and are just lacking man pages, icons and so, here’s the next round of them:

• JFS: Development environment for a fuzzy logic programming language.
• Pop’em: small and addictive puzzle game from Free Lunch Design featuring many different game modes and graphical themes. Your goal is to remove as many balls as possible by connecting locating groups of the same color. Source code downloadable here.
• Zombiepox: Throw brains at the zombies and turn them back into humans. As you progress
  you get help from your fellow humans in the fight against the zombies. Source code downloadable here.

Collabora and OpenedHand are pleased to sponsor a party this evening at the Walkabout bar on Broad Street from 8pm. Please come along to today’s closing keynote for more details. To get there walk through the Paradise Forum next to the Conservatoire in the direction of Brindley Place and then along Broad Street to the left. Check out this map. Anyone who looks under the age of 25 will be required to prove they are over the age of 18.

We went camping this weekend near Nominingue, northeast of Mont Tremblant. It was fun -- we met our friends Jeff and Anne-Marie, who'd biked there from Tremblant during the day. Maj and Amita June and I brought tons of food and big tents and stuff in the car. Our drive up was nice; Amita kept saying, "Camping!" every few minutes to emphasize how excited she was about going camping. She's getting much better about longer road trips. She entertains herself, reading books or telling herself stories or looking out the window and thinking out loud. Occasionally we sing songs or color together. The night was rainy, though, and Amita June slept in a dry but loud tent all night. At about 6AM she woke up angry. "Purple house, NOW!", she said, talking about our house in Montreal, with purple trim. "Shhh, Amita!" Maj said. "We're sleeping in the sleeping bag. We're camping!" "NO CAMPING!" said Amita. So the two of them got up and walked down to Lac Nominingue, while I got some rest. Later that morning, all the people in the campgrounds around us were smiling. "No camping! Camping no!" became a pretty popular refrain. Ah, well. At least they had a sense of humour about it. tags: amitajune laurentides camping travel maj jeff annemarie

Inefficient days Long day today. Brian got back from Halifax (Nova Scotia) on Friday, so we once again have a full house. Which is fun, but it makes it hard to work at home. I went out to Caff ArtJava near our house early this morning, but their le Sans Fil? connection was down. So I came home to pick up my bike to ride to La ka, but the back tire had a hole in it. And I didn't have a pump. Gar. So I spent a couple of hours working out that situation, and by that time I needed to go pick up our moving van. Maj found a great teak "wall unit" on Montreal Craigslist, and we need the shelves for our living room. So I got a van to pick up the pieces -- it was far too big to fit in our car. And, since my friend Niko wanted to go to IKEA, I traded him an afternoon with the van for help with my wall unit. He and Maj went off to IKEA as planned, and me at Amita went to the wading pool at Parc La Fontaine. It was a great time, although it's a long walk. I've had a hard time getting Amita onto the back of my bike -- she got pinched once when we were putting on her helmet, and since then she's wanted nothing to do with helmets, bikes, or nothing. If I force her helmet on and stick her in the seat, she loves it, but it's hard to trick her into it. She screams bloody murder when I try to put the helmet on her. But the pool was fun -- we chased each other up and down through the water. She fell asleep during the walk home, and I managed to get a little work done this afternoon. But Maj and Niko got back around 5:30, and Niko had a comedy show at 7PM and couldn't help me out -- the welcher! So I got Brian to come instead. The furniture was heavy -- really heavy. Teak is a heavy dang wood. Getting it out of the guy's house was really hard, and getting it up to our second-floor living room was Sisyphean. I'm amazed we didn't break any limbs. But at the end of it all, we had a great-looking new living room, and Maj had made a delicious gazpacho with polenta on the side. Yum! Hopefully the rest of the week is going to be more productive that today. Niko and I launch a new site at next week's DemoCampMontreal3 (as he so lugubriously pointed out in this blog post). And another group of partners will be launching kei.ki during Wikimania 2007, which is coming up soon. On top of that, we leave on Thursday for my brother's "commitment ceremony" in San Francisco, announced about 2 weeks in advance. We were lucky we had lots of miles so we could make the trip, but it still really cuts down on our Montreal summer experience. tags: maj furniture craigslist amitajune brian niko teak

For what can be read on Planet SoC, computer problems seems to be the norm between SoC students... I've got my part of this cake today with a power cut and some strange /dev permissions when my PC got back...

Fortunately it was somewhat easy to solve (I believe it was the udev upgrade which did the trick), so I've been able to release btsutils 0.2. Please take a look on the announcement for more details.

Still on the SoC side, thanks to the great work from the Debian ftpmaster team and Lo c Minier, the packages python-btsutils and python-bzutils have made their way through the NEW queue and are on the Debian official archive.

And finally, on Debian side, Lo c Minier also uploaded libgnomedb3 3.0.0-2, a bug fix release for libgnomedb closing two bugs. Thanks, Lo c.

The Foundation AGM will take place at 5pm in the ABH.

I now have a working system for creating minimal installations of Fedora Core (6), and CentOS (4.5 & 5). I've updated xen-tools to make use of this, via --install-method=rinse - and now I can create new Xen guests :) There were several false starts: <dl>

Have a static list of .rpm names + versions

This is precisely what rpmstrap does, and it is a broken approach. I'm happy to have a static list of packages, but restricting the packages to specific versions is fragile and broken.

Use Yum

yum is used by many RPM based distributions, but unfortunately each distro uses slightly different versions to the one in Debian - so whilst I could run:

mkdir /tmp/fc6
yum -c /tmp/yum.conf --installroot /tmp/fc6 install yum

This results in a system which cannot be updated:

chroot /tmp/fc6 /usr/bin/yum update
[errors about yum database formats]

I suspect this is because the versions of the Berkeley database are different .. but I'm not sure.

Parse Dependencies

This would be a neat approach, however it is difficult. Too difficult. Abandoned after several fruitless hours.

Cheating

I cheated in the end.

• Download a list of packages which are known to be required to produce a working yum, and unpack them.
• Copy those downloaded packages into the yum cache tree.
• Run yum install yum - to make the local Yum + RPM database match what we fetched manually
  • Unfortunately "rpm rebuilddb" couldn't do that for us.

Worst case? I download each package twice. Once for the initial download, and once again when the Yum process runs. I can live with that.

</dl> I'll talk about something else next time. Promise.

On several occasions I have watched part of a TV documentary on gifted children, but I have never been able to watch one completely because every one that I have seen has been offensively wrong. One thing that they always seem to do is say that gifted children have special needs and often claim that they have problems socialising. This sounds quite reasonable, but if that’s the case then why would you make such children perform tricks on TV? Putting the children on TV is a very poor example of journalism and often of parenting - the parents’ desire to boast about their children’s performance (and implicitly their own parenting skills) is apparently more important than protecting the children. I think that the only situation in which gifted children should have their talents demonstrated on TV is if their skill is related to the performing arts. Not that TV coverage is necessarily good for children who have abilities related to performing (a casual scan of the news regarding adults in Hollywood shows the problems that people have dealing with fame), but it’s something that they will be driven to anyway. Also if they are going to demonstrate the intelligence of a child on TV then they really should make sure that they don’t demonstrate a lack of intelligence (on the part of the child as well as the producers). Asking a child to provide a definition of a word is often used as an example of intelligence (when it’s really an example of vocabulary). In one documentary a child defined a philanthropist as “someone who has a lot of money” (according to dict on my system it is “Love to mankind; benevolence toward the whole human family; universal good will; desire and readiness to do good to all men“). In another a child defined a genius as “someone who knows a lot“, while the definition of genius is not clear and there is some disagreement about what it is, most people agree that it’s about ability not knowledge. Being able to recognise when you don’t know something and admit would surely be correlated with intelligence… Telling a child that they are a genius or telling them their IQ seems like a bad idea at the best of times, and doing so in front of a documentary camera crew isn’t the best of times. Children are able to determine how their skills compare to others, there are more than enough attitude problems in schools related to skill comparisons without encouragement from adults. When I was in high school a friend who studied a martial art refused to tell me which belt he wore - he had been taught that such things shouldn’t be discussed outside the dojo to avoid creating a hierarchy based on belt rating in the community. I think that the same thing could be applied to IQ ratings. The term genius is grossly overused generally, I believe that showing greater than average ability in one area is not enough to qualify. I think that the minimum criteria would be to produce dramatic new developments/inventions in one area of research (EG Albert Einstein or Stephen Hawking) or to advance multiple fields of science or art (EG Leonardo da Vinci) would be the minimum criteria. I had people call me a genius when I was young because I won prizes in maths competitions, was good at programming computers, playing chess, etc. The main criteria for achieving such things is to avoid wasting time on sport - in a school run by idiots with a focus on sport this was more a tribute to being stubborn than being smart! The TV documentaries mention many things that gifted children supposedly require, but strangely I don’t recall any of them mentioning the need to meet adults who are significantly smarter than average! You might think that this is the most obvious thing. The Big Brother and Big Sister programs of mentoring children who are at risk of crime and drugs apparently provide significant benefits, something similar for gifted children might do some good, probably more based on meetings of a few intelligent adults with a small group of intelligent children instead of the BB-BS model of one-on-one meetings. Washingtonienne seems like a good example of the need for this. There are some useful print articles however, this article in The Age makes some good points, it’s particularly interesting to note that some schools lie about special programs to support gifted children to attract students (someone should name the schools that do this). But then you get awful ones like this, naming the child in such a situation is irresponsible journalism. The girl in question may be forced to change her name to escape google when she’s older. It’s strange that it’s illegal to name a child who is involved in a court case but it’s not illegal to name them in such an article (let’s hope that the journalist used pseudonyms). Also you might expect an organisation such as Mensa to have someone smart enough to realise that bringing such attention on a 2yo is not in the child’s best interests. Does anyone know of a good TV documentary about gifted children? I guess that it would be extremely difficult to make one without showing the children on TV so that would restrict the film maker to children who’s abilities are related to the performing arts.

Share This

DebFile: Python Library for Inspecting .deb A couple of days ago Mike Hommey blogged about "coincidences" in free software development: more than one developers are likely to have the same crazy ideas. It happened to me and Filippo last Friday. While writing the script for maintaining the OCaml status page I faced, unsuccessfully, the need of a library for extracting meta-information and actual content out of .debs of incoming. While I was getting sad for the lack of such a (Python) library Filippo contacted me on Jabber stating something like you know what? ... a cool addition for python-debian would be a library for querying .deb files ... A few days later we have something working and fitting our (disjoint) needs (it's a branch of the python-debian package which includes two brand new modules: arfile.py and debfile.py):

$ bzr branch http://people.debian.org/~zack/bzr/pkg-python-debian/

Here are some examples to wet your appetite:

• changelog head.py
• dpkg-info.py
• extract cron.py
• ar.py

It is already a proposed addition to python-debian, feel free to comment about the API ... before it's too late

I can successfully boot Fedora Core 6 & 7 - to the extent that RPM and Yum both work. This takes in the order of 70Mb and around 2 minutes - assuming the caching mechanism works. Now I need :

1. A cute name.
2. To abstract the common parts of the code somehow.
3. To get started on SuSE + CentOS.

Today: Hacking. Tomorrow: Security work.