Search Results: "ema"

4 November 2010

Gintautas Miliauskas: Living a monastic life for 10 days

About a month ago, at the end of August, I finished a 10-day Vipassana meditation course. This was probably one of the more extreme activities I have ever participated in, and it's well worth a blog post. I found out about the course in a ridiculously trivial way, by following a link in a Reddit comment (I wonder if I could track down that comment...). The website referenced by the comment contained (almost) no new-agey mumbo-jumbo and looked legit in general. I also appreciated the fact that this was a relatively serious and intensive course, which should be enough to form a reasonably founded opinion on meditation in general. When learning sporadically, in small bits, it is hard to say whether the material itself is no good, or you just do not understand it yet and need to study more; I was quite skeptical towards the practice, but wanted to give it fair trial. I was quite impressed that there was a course available in Lithuania, a few hours by train from where I live. Finally, the course was free (by tradition Vipassana is taught without monetary compensation). I went ahead and signed up for a standard introductory 10-day course. Vipassana (also called insight meditation) is a meditation technique allegedly coming back from Gautama Buddha himself (well, all the traditions like to claim that origin...). It has been experiencing a renaissance, partly due to an organization set up by a meditation teacher S. N. Goenka which has founded meditation centers all over the world. The essence of Vipassana is a method of teaching your mind to act instead of merely reacting to outside stimuli such as pain, anger of other people or hardships. The technique provided is to monitor your sensations, watch them with equanimity and suspend any reaction, and slowly it sinks in that all things are temporary and you can choose what to react to and how. That's the basic idea; I don't want to go deep into exposition of Vipassana as there is plenty of information about that (also at the same time the information is almost useless because you have to experience it to really understand it). Instead, I will sure some of the more personal remarks and experiences. The course took place in an cottage near Kretinga, housing around 50 people. The living conditions were absolutely great, and this would have been a true holiday if not for the regime and the rules. The day would start very early, at 4 AM (ending at around 9:30 PM), and we'd do about 12 hours of meditation in total inbetween, with occasional breaks, but the most gruesome part is that no communication at all was allowed with anyone except the manager of the camp (and the teacher during a specified time). That gets to you after a few days, but still, there are people around you, so it's bearable; on the other side, the senses (touch, smell) become very acute. The food was taken care of by volunteers (students who have finished the course), and I could say it was quite good actually. The goal, of course, was to keep the environment from interfering with meditation, and I think it was done very well. The presentation of the actual technique also did not disappoint. Each day a new step would be introduced, with the whole day to practice before moving on. Looking back, the pacing worked well. Every day in the evening there were lectures on theory. They were somewhat informative, but also sometimes annoyingly primitive and verbose. The little mistakes, holes in logic and slight doses of mumbo-jumbo almost drove me nuts by the middle of the course, until I learned not to react to them. Despite the shortcomings of presentation, the simplicity and lucidity of the practice and lightness of theoretical baggage really appealed to me. The whole organisation in general gave the impression of complete transparency, with no strings attached, no financial interests in play and no agitation for further involvement. While there are many meditation techniques, I am happy that I've gone with Vipassana in particular for one reason: Vipassana meditation uses no artificial tools to help you concentrate, such as mantras, visualisations, counting, etc. Such methods make concentration much easier, but they also create a dependence on the methods themselves. I appreciate the purity of Vipassana in this regard. Not everything in the practice is roses though. First, a particular worldview supported by Vipassana is presented as "scientific" and supposedly "the right way to live", and if even if you don't agree, "the truth" of Vipassana will become obvious to you with time. This is a distinctive mark of ideologies. The thing that makes everything break is the reincarnation, which is generally assumed as true, even if it's not shoved down the student's throat. Every rationalization of a world view has a "white lie" (usually related to the concept of eternity somehow) at the core, and in this context reincarnation is it. Given what we know now about the relationship between the mind and the body, reincarnation is absolutely ridiculous and completely untenable, and that breaks all "moral" reasoning for practicing meditation as opposed to doing something else. I'm not the first to bring up this problem, there's plenty of material about it online. The second slippery idea is that the concept of "negative happiness" is central in Vipassana, that is: happiness is defined as lack of suffering. This point is not that unreasonable actually, from personal experience I could indeed call the state of non-suffering happiness, but there is definitely something missing when compared to the state of mind when I'm truly, positively happy. Whether you consider that something important or not, it's definitely there. Third, Vipassana suggests that it is only you who is at fault when your inner state is disturbed; the world affects you as much as you let it, and in order to find happiness you should learn to control the "interface" rather than the outside world, which will usually not behave as you want. This may be correct, but sometimes it could just be easier to fix the world rather than change yourself, and I have the suspicion that it this is much more frequently the case in the modern world compared to the pre-modern environment. (This is one of the points which break when reincarnation is rejected, as with reincarnation you have the whole eternity to fix yourself.) While the complaints are serious, they do not mean complete rejection of Vipassana but rather integration among the various other techniques available. The actual meditation technique is still great for gaining and maintaining mental composure, reducing anxiety and improving well-being. Now, if I could only get used to meditating regularly... If you have the chance, I highly recommend you try out an introductory 10-day course. There is little to lose and a lot to gain. And if you do go ahead, I have two hints. First, do not even think about leaving the course before it's over. Any hardships are temporary and will be overcome quickly. Second, use the time with the teacher, those interactions were very helpful to me. Also, given the "noble silence", talking to someone once in a while will not hurt.

3 November 2010

Julien Viard de Galbert: Working on X isn t that hard !

First, Hello Planet Debian ! Some words about me I m a new member of the X Strike Force, the debian team responsible for packaging Xorg. I basically stepped in with the openchrome driver.
I also have wider interest in free software or open source in general, but you can have a look at the rest of my blog, so I won t bother you with too much details. More about X Talking with various attendant at MiniDebConf Paris, I got the impression that people think working on Xorg is hard. I must say: It s not ! First debian work is mostly packaging, and the developers of the applications we package (debian call them upstream) are pretty responsive, so you won t be on your own.
Most of the work is preparing the packages for their new release, place them in experimental first, and ask for testers.
Then people test and the real work start: we receive bug reports.
Sometime seeing the report, it s easy to point the user to test some other version, do some change, remove some old libraries in /usr/local/lib.
Sometime we need to ask for more information. I said we, but for now unless it s about openchrome, I can t help much, but I follow the bugs on the X mailing list and learn from others response, I think I ll be able to help soon. An other way to help: TXBW I m sure you ve read about RCBW, kudos to every one posting some and to every BSP attendant.
But if you thought X was hard, you certainly find the remaining RC bugs too hard (Or if not, you might want some distraction with an easier task). So I have a proposition for you: Triage X Bugs of the Week (TXBW) As Lucas told on his blog I ve proposed him a patch to help triaging X bugs using UDD. And he accepted it, Thanks ! So here is the link I m using: XSF unstable bugs sorted by date.
But remember the udd database is not live data, if you close a bug, it won t disappear immediately.
Also please read the X Strike Force Bug Closing Procedure before starting. To conclude my TXBW data (well TXB of the Day so to speak) I hope this can be a success like the RCBW initiative is.
Currently there are hundreds of X bugs, more that a half are at least one year old so they deserve to be triaged ! The X Strike Force (still) needs you !

2 November 2010

Julien Danjou: Transparent GIF support in Emacs 24

Last week, I wrote a couple of patches to add support for transparency when Emacs is displaying GIF images. Until now, it was displaying the color used to define transparency in the file data. Now it displays the image correctly by using the frame color as the transparency color, like it's done for other image formats. The patches have not been merged yet, but will probably be soon. Flattr this

1 November 2010

Biella Coleman: The Anthropology of Hackers

I meant to blog about this a long time ago but it slipped past me. Here is my course on hackers described in The Atlantic . I ma not teaching it this year but will do so next year. I actually include a lot more than what is in the syllabus (much to the chagrin of my students).

Adnan Hodzic: I want Xperia X10 Android 2.1 update now!

Story I bought Xperia X10i this summer during DebConf10 in NYC, I loved this phone from very beginning however what bothered me was that it was still stuck on outdated Android 1.6. To get your own custom Android on it, wasn t quite possible because no one managed to hack bootloader even though some of the guys at XDA where getting pretty close. Long story made short, Sony Ericsson has finally release their Android 2.1 update, but made it available only for Nordic region, they explained it all on their blog where they also sent a message for paranoid users as they called them. I thought, if I gave it all this time I can wait a little bit longer, but then one of my friends (@sahinovic) gave me a good pointer to go in right direction with using custom ROM, Nordic for example? So this is where I got my idea. I want 2.1 update now! Please note steps below will get you Android 2.1 update, but AFAIK you ll also lose your warranty 1. Root your phone If you don t have your phone rooted, this can now be done in single click. Get X10 Root and follow instructions on screen. 2. Edit system/default.prop Get Root Explorer, mount r/w (upper right corner), edit system/default.prop Lines you re concentrating on are 1 and 3 Let s say they are:
ro.semc.version.cust=1237-0333
ro.product.name=X10_1237-0333
Edit them to look like:
ro.semc.version.cust=1234-8465
ro.product.name=X10_1234-8465
Save the file and it s gonna create automatic backup of original file. 3. Get the updates using SEUS Turn off your phone, launch SEUS, plugin in the USB cable while holding back button, SEUS is going to tell you have updates for your phone Smile Follow on screen instructions. Enjoy the update Smile Conclusion X10 is a pretty sweet phone, but with it being so closed, it also closes a lot of doors to hacking it and playing with it, great example would be this update itself, since right now Android 2.1 update is an outdated one. However 2.1 update brings new life into it, just as it s a brand new phone, it s more responsive and much much faster. And do take a backup before this update, because I lost everything from my contacts to internet settings, but all files on my sd card remained intact. If you want to discuss anything regarding this topic please do so in comment area below or find me on Twitter.

29 October 2010

Alexander Reichle-Schmehl: Release Critical Bug report for Week 43

The bug webinterface of the Universal Debian Database currently knows about the following release critical bugs:
In Total:695
Affecting Squeeze:284
Squeeze only:71
Remaining to be fixed in Squeeze:213
Of these 213 bugs, the following tags are set:
Pending in Squeeze:7
Patched in Squeeze:40
Duplicates in Squeeze:24
Can be fixed in a security Update:14
Contrib or non-free in Squeeze:7
Otherwise fixed in Squeeze:32
Ignoring all the above (multiple tags possible), 126 bugs need to be fixed by Debian Contributors to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 169 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers.

28 October 2010

Torsten Werner: More Results from the Debian Community Poll

I have announced the Debian Community Poll and published first results in former blog posts. I'll publish my analysis of the remaining questions about changes to Debian now.
Should Debian remove its non-free component?

Should Debian spend more money?
  • 28.9% choose answer #5: I don't know or don't care.
  • 22.8% choose answer #3: Debian should pay people having important positions in Debian and doing important work.
  • 21.2% choose answer #1: Debian should spend more money on organizing developer conferences and team meetings.
  • 11.4% choose answer #4: Debian should not spend more money.
  • 8.0% choose other (see below) or didn't answer
  • 7.7% choose answer #2: Debian should spend more money on free merchandizing, free DVDs, having a sexy web site, and being present on IT events.
There were quite a number of other answers. One participant missed the information about how the money is currently spend. Several participants didn't want to choose one of the provided answers. They either wanted to choose multiple answers or various combinations of them. Most other answers fall into one of the following categories:
  • various marketing suggestions with different focus than answer #2
  • Debian hosted hardware, infrastructure, services
  • funding upstream development
  • QA and work on release-blocking issues
  • partners and commercial support
  • developing important features
  • security support for oldstable
  • education of prospective developers and contributors
  • documentation for users
  • improving usability and accessibility
  • certifications like LPIC
  • getting supported by hardware and non-free software vendors
  • beer
  • promoting debian in developing countries
  • help contributors running a business on Debian
  • Bounty system
  • updating stable to avoid becoming stale
  • developing multimedia codecs
  • getting compliant with FSF guidelines for a free system distribution
  • developing free replacements to non-free software
  • maintaining a database of debian-friendly hardware
  • lobbying and politics
  • visibility to wider society, even non-IT
  • hardware for driver developers
  • a more sexy DVD/CD set with graphics (like Fedora, Ubuntu)
  • membership to boards of W3C, TEI Consortium, OASIS, etc.

Do you prefer time based releases instead of the "it's ready when it's ready" releases?
  • 73.1% answered no
  • 19.8% answered yes
  • 5.1% anwered: I don't know or don't care
  • 2.0% didn't answer

Which release interval do you prefer?
  • 38.7% choose answer #2: about 12 months
  • 36.9% choose answer #3: 18 - 24 months
  • 10.0% choose answer #5: I don't know or don't care.
  • 5.9% choose answer #1: about 6 months
  • 5.5% choose answer #4: more than 2 years
  • 3.0% didn't answer

Dirk Eddelbuettel: Google Tech Talk on Integrating R and C++: video and slides

Last Friday, Romain and I were guests of the R intergrouplet (what an adorable name!) at Google's headquarter in Mountain View. This arose out of discussions following useR! 2010 where we met Google's Murray Stokely. There appears to be ever increasing use of R at Google, and so it was a great opportunity to give a Google Tech Talk about R and C++ integration --- centered around our Rcpp, RInside and RProtoBuf packages which facilitate interoperability between R and C++. A video recording of our ninety-minute talk is already available via the YouTube channel for Google Tech Talks. The (large) pdf with slides (which Romain had already posted on slideshare) is also available from my presentations page. The remainder of the weekend was nice too (with the notably exception of the extremly sucky weather). We got to to spend some time at the Google Summer of Code Mentor Summit which is always a fun event and a great way to meet other open source folks in person. And we also took one afternoon off to spend some with John Chambers discussing further work involving Rcpp and the new ReferenceClasses that appeared in the just-released R version 2.12.0. This should be a nice avenue to further integrate R and C++ in the near future.

27 October 2010

Alexander Reichle-Schmehl: (Delayed) Release Critical Bug report for Week 42

The bug webinterface of the Universal Debian Database currently knows about the following release critical bugs:
In Total:700
Affecting Squeeze:291
Squeeze only:72
Remaining to be fixed in Squeeze:219
Of these 219 bugs, the following tags are set:
Pending in Squeeze:16
Patched in Squeeze:44
Duplicates in Squeeze:24
Can be fixed in a security Update:15
Contrib or non-free in Squeeze:8
Otherwise fixed in Squeeze:27
Ignoring all the above (multiple tags possible), 125 bugs need to be fixed by Debian Contributors to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 173 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers. Connection to alioth.debian.org closed. PS: Due to an unscheduled downtime, last weeks statistics have not been published. But better late than never, here are the current statistics.

26 October 2010

David Welton: Kindle?

I'm thinking about getting a Kindle, and I thought I'd write down some thoughts, even if they're a bit jumbled, and invite commentary. Good: One thing I really like, living here in Italy, is that I would be able to get English language books instantaniously, and not pay shipping or import duties on them. Whatever disadvantages there may be, that is a huge advantage. Closely tied to that: if we ever move back to the US, shipping all our books will be very expensive. Having some of them in an electronic format would lighten that load considerably. It's fairly cheap. At $180, it's not something I'd want to treat carelessly, but it's significantly less expensive than various existing tables. Long battery life means it's not something you have to worry much about. E-ink looks like it's easier on the eyes than LCD screens. I'm not sure, but also its slow update speed might be a "feature not a bug" in the sense that you're not so easily distracted by the internet being just one click away. Bad: I love having real, physical books in my house. I grew up in a house full of books, and I want the same thing for my daughter. I like being able ot look through them, pick one up, and read about something. Real books are very convenient, as long as you're not lugging around hundreds of them. I like not having to worry too much about dropping them, about getting a bit of water on one or that sort of thing. You can cart them around in a backpack with little worry, take them to the beach, and so on. As far as I can tell, Knuth's books are not available for, nor would appear like they do on paper. That's the golden standard for me: once "The Art of Computer Programming" looks good on an e-reader, it will be really and truly ready. We're not there yet. It's not general purpose. Like I said above, maybe this is good for reading, but there are also times when it'd be nice to have a general purpose device, with email, maps, applications, and so on. A while back, Amazon announced some sort of beta program for a kindle SDK. I haven't heard much of anything since. So it looks like it's not really possible to code for it, which is a bit disappointing. I like to have that option available, even if I don't always exercise it. Unknown: The pricing: sometimes Kindle versions are cheaper (especially, in my case, considering shipping, and, potentially, import duties), but sometimes they aren't, which seems a bit unfair, given that you cannot sell the book if you don't like it. I'm not sure how it would work out for me in the aggregate. Digital Rights Management, or DRM, means you can't, say, sell someone a "used" ebook. This is, in some ways, understandeable, because it's not like an e-book degrades with time as a physical one might. Were it possible to sell on your old books, that might radically change the market. I could see that having both good consequences (cheaper books), but also negative ones for authors (less money). I suppose this topic merits a post or two, or even an entire book of its own, because it's a complicated subject without, in my opinion, "easy" answers. Suffice it to say, though, that there are some drawbacks, but I suppose it's also nice that Amazon "knows" which books I have, so even if I switch to a different reader, I still have my books. And it's good that authors can get paid to work on a book. Not having actually bought it yet, I have no idea how it actually 'feels' to read a book with one. I love curling up with a good book, something I certainly can't do with my laptop. The Kindle looks light and small enough that it could work, but maybe it's just too high tech and sleek to provide that same comfortable coziness. Or maybe I'm just a luddite where books are concerned?
Do you have one? Do you use it? For all kinds of books or just certain kinds (technical books, cheap 'fun' reads, whatever...)? What's the experience like?

25 October 2010

Jonathan Wiltshire: Facebook groups: a gift to framers

I didn t quite believe what I was seeing until I searched and found several other people noticing the same behaviour. For background, Facebook recently introduced the concept of groups not in the sense we ve been used to, but more like lists. Groups are supposed to be to lists what databases are to bits of paper. You can add friends to groups to organise them, send them group emails, run a collective mailing list, and so on. Except that in practice, this is another really good way of exploiting lazy users. See, there are some things to know about groups: The second point may be wrong it s very unclear exactly what permission is afforded to a group member and when or where information about the group membership is published. Since my day job is in private education, this immediately makes me think of two terrifying scenarios:
  1. A student inadvertently gets added to a large group and nobody notices because there is so much other traffic. Whatever my other privacy settings, anything I or anyone else posted to the group is now visible to him this is the same as the previous group arrangement. The difference is that he can now go on and add anyone else Mark Zuckerberg himself even without any kind of checks by the group administrator. A membership system like this quickly spirals out of control.
  2. Somebody with a grudge maybe I took too long fixing their PC adds me to a group with, shall we say, inappropriate or unsavoury content while I m away on holiday and tips off the child protection officer. Better yet, he first sends an email to all staff expressing horror and asking them to verify this in case it s his computer lying. Now there are multiple witnesses to the fact that I was a member of this group, and I return from the sea side to find a P45 on the door mat.
Unlike free software, I can t fix this. Fortunately, I have: enabled every email notification under the sun; few and trustworthy friends; according to my profile, no interests or contact details whatsoever; and no care for groups. I m happy with my lists, thanks all the same.
Comments flattr this!

Steve Kemp: Delivering to a Maildir folder, but marking as read

Email. We get a lot of it. We filter out the SPAM. Then if we're well-organized we file it away into folders as it arrives. (To be fair some people use priority settings such that all mail stays in their INBOX until they're "done" with it. I've never had the patience for that kind of behaviour.) One problem which I often encounter is wanting to have email be delivered, archived, and stored, but I don't want to read it. Yet when I see a folder in my mail client which has unread mail in it I cannot unsee. In my case I deliver mail to folders as it arrives via either Exim's filter language, or procmail. Procmail blows goats on the whole, but it is common and available everywhere - I just don't trust my own DSL enough to rely upon it (which is a dangerous sign). So, how do you deliver a new mail to a Maildir folder, and mark it read at the same time? Well you can be na ve and do what I did which is to invoke formail to add "Status: ro" to the header. Unfortunately that's insufficient to mark a mail as read when viewed in mutt. When an email is stored in a Maildir folder its status is encoded in part of its filename - which is why you'll have files like:
new/1288039894.28406_3.steve.org.uk
cur/1283711971.11157_3.skx.xen-hosting.net:2,S
The latter file has been Seen. So to mark a message as not-new you need to do two things: I've seen some horrific shell + procmail code to do the job, but the simpler version is:
:0
*^(To: From:).*root@
*^X-added-header:.*debian-administration.org
  ~/bin/read-to-maildir .machines.debian-administration.org/
Similarly you can use Exim's filter language to do the same job:
# Exim filter
if $h_to: contains "hostmaster@" then
    pipe "/home/skx/bin/read-to-maildir /home/steve/Maildir/.hostmaster/"
finish
Cute. Obvious too? Maybe not to me. ObSubject: Why did you murder someone, Raymond? - In Bruges

Raphaël Hertzog: Secret figures of a Debian/Ubuntu blogger: what you liked most on raphaelhertzog.com

Chart goes up on screenI launched raphaelhertzog.com this summer (taking over the English content of my former multi-lingual blog), when I decided that I would be more serious about blogging on Debian/Ubuntu related topics. On September, I decided to write 2 articles per week and up to now I managed to keep the schedule. Two of my articles were published by Linux Weekly News, those are much more researched than the average blog article (they are tagged with [LWN] in the list below). The most popular articles Most people read my blog through the RSS feed which happens to be syndicated on Planet Debian and Planet Ubuntu. According to the feedburner s statistics, the top-5 articles are:
  1. 5 reasons why I still contribute to Debian after 12 years (32700 views)
  2. [LWN] Understanding Membership Structures in Debian and Ubuntu (31700 views)
  3. Social Micropayment Can Foster Free Software, Discover Flattr (30100 views)
  4. Everything you need to know about conffiles: configuration files managed by dpkg (29900 views)
  5. How to make 110.28 EUR in one month with free software and Flattr (29400 views)
But I also have occasional readers visiting my blog because my articles are announced on Identi.ca, Twitter and Facebook (and they circulate on social networks, thanks to those who are sharing them!). The top-5 articles according to the statistics of my website are:
  1. 5 reasons why I still contribute to Debian after 12 years (6000 views)
  2. [LWN] Can Debian offer a Constantly Usable Testing distribution? (5000 views)
  3. Understanding Debian s release process (1500 views)
  4. Flattr FOSS (1400 views, not an article but I regularly blog about this project)
  5. Can Debian achieve world domination without being on Facebook? (1100 views)
The most flattered Since I am using Flattr on my blog, it can be interesting to see the articles which generated lots of flattr micro-donations. The top-3 articles are my articles about Flattr (1, 2, 3). Excluding articles related to Flattr, the top-5 is:
  1. 5 reasons why I still contribute to Debian after 12 years (12 flattr)
  2. The secret plan behind the 3.0 (quilt) Debian source package format (10 flattr)
  3. How to use multiple upstream tarballs in Debian source packages? (5 flattr)
  4. [LWN] Understanding Membership Structures in Debian and Ubuntu (4 flattr)
  5. Do You Want a Free Debian Book? Read on. (4 flattr)
Most articles get 2 to 3 flattr clicks. The most commented I usually get 4-5 comments on most articles but some generate much more feedback:
  1. [LWN] Can Debian offer a Constantly Usable Testing distribution? (40 comments)
  2. 5 reasons why I still contribute to Debian after 12 years (22 comments)
  3. Can Debian achieve world domination without being on Facebook? (15 comments)
  4. How to generate different dependencies on Debian and Ubuntu with a common source package (14 comments)
  5. [LWN] Understanding Membership Structures in Debian and Ubuntu (12 comments)
Factoids Here are my conclusions based on the above figures: If you also appreciate the above-linked articles, you should click here to subscribe to my email newsletter.

Flattr this Share/Bookmark 4 comments Support my work

24 October 2010

Jordi Mallach: Recipe Manager meets arr s a banda

Two weeks ago, nekohayo posted a blog entry on Recipe Manager, a (you guessed it) cooking recipe manager for GNOME. Looking good, I fetched the bzr tree from Launchpad and played a bit with it, and soon discovered it had no internationalisation support. I've tried to add i18n properly, but I've not had enough time to do it. Before tackling that, the authors need to give it some bootstrapping love so the app can actually install, look for its files in /usr/share, etc. My fugly, unpostable current patch does allow for a preview of how Recipe Manager will teach the world about the best rice dish ever, arr s a banda. Yum!


Recipe Manager, showing off the zenith of Valencian culture

Benjamin Mako Hill: Sharing an Email Address

I used to think that couples who share a single email address were just too cute. Then I saw this article which imported this whole "keeping each other honest" logic into the practice. Mika and I have never even had accounts on each other's servers.

23 October 2010

Joey Hess: tranquility

I brought my cat Leo to the house in the hollow a week ago. He settled in quickly; this was his 7th move. He seems both more kittenish, and more predatory out here. This was a trial run, I'll bring him back to town soon for a few weeks. Since early August, I've for one reason and another been away every other week, and I got tired of worrying about the cat home alone. With a cat, and with electricity seemingly sorted, it's getting homelike here. As the days shorten, I'm being power wasteful with computers and radio and lights, and the batteries still never drop below 13.5 volts. Bodes well for winter. All that remains to be done is refrigeration that does not involve hauling ice, and more water. Winter will help with both. Still remains to be seen if I will continue bouncing back and forth, or if there will be an inflection point. I've regained a tranquility that had been eluding me for ages. It's been a lot of work, but it seems worth it. (git-annex announcement soon!)

22 October 2010

Erich Schubert: Gnome panel applet alignment

Dear Gnome people. Is there a reliable way to right-attach panel applets? May laptop screen and my external monitor have different resolutions, and I havn't found a reliable way (except making two panels) of getting some of my applets to stick to the right. I usually keep my launchers on the left, while vairous system status icons on the right part. But when switching to a higher resolution, at most one will move to the right end of the panel at the new resolition, while the others just stay in place (i.e. left-attached at a given pixel position). There are so many smart layout managers, GTK pretty much always uses flexible layout managers, why is the Gnome panel relying pixel offsets? It has been suggested to me a couple of times that I could achieve this via gconf. However, since the gconf changes are not reflected at runtime but frequently overwritten I did not get this to work reliably even just for two applets. Thank you. If you have any comments, please email me via erich () debian org. On a side note, this is also the first true post to my new blog. :-)

Julian Andres Klode: FAIL: Arch Linux switch python executable to Python 3

Today, I got an email from an user of one of my Python scripts asking why the script t does not work on Arch Linux anymore. As it turns out, the Arch Linux team decided to switch /usr/bin/python to Python 3.0 and use python2 for Python 2.X versions. By doing this, they decided to make their distribution incompatible to almost any Python script in the world. Arch Linux s decision to diverge from the rest of the world that uses python for Python 2.X and python3 for Python 3.X is stupid. And doing this without updating reverse dependencies beforehand and thus breaking packages in their own distribution is insane. In the end this means that if you use Arch Linux, you should consider switching to a distribution that does things the right way: Debian. You can also switch to Ubuntu, that s normally just a bit less right (= faster). But using a distribution that does those crazy things in such an irresponsible way is really insane. Really, how can they be so stupid in the Arch world?
Filed under: Python

Andrew Pollock: [debian] Well that's a relief

As readers of my blog (who care about Debian stuff) may know, I've been plugging away at the DHCP 4.x packages for some time now. I first uploaded 4.1.1-P1-7 to unstable in early July, then -8 in mid-July followed by -9 in late July. The main reason for the delay (beyond my lack of spare time) was the coordination with third-party packages that were plonking hooks into /etc/dhcp3/dhclient- enter,exit -hooks.d. Once that got all squared away, the release team gave me the green light to upload to unstable. On the 26th of July, 4.1.1-P1-9 made it into the testing distribution. Rather unfortunately (for me), the release team then declared testing frozen on August 6. I'd been hoping for a few more iterations on the package after getting feedback from the testing user base. Alas, it was not to be. One piece of feedback I did get on August 9 was release critical bug #592361, which made me very sad, because I totally agreed with the severity of it. It was an upstream issue, and I immediately escalated it to upstream. Unfortunately, they did not get back to me particularly quickly (I had to use some back channels to get a response at all). I eventually got the response I was pretty much expecting: I was going to have to directly patch configure.ac to make it stop trying to link with libcrypto. To complicate matters, the LDAP patch also goes and messes with configure.ac, so it required some fiddling with the LDAP patch as well. I figured I could wrap my head around it all, it was just some patch wrangling, but with parenthood and a wife who was trying to be a full-time mother as well as a part-time student-by-correspondence, large chunks of spare time were not in great abundance. So I've had this bug niggling away at the back of my mind for literally months now, when in sails Simon McVittie with a patch. Hallelujah, I said to myself. I could just take this guy's patch, and we'd all be home and hosed. So I spent a bunch of hours yesterday, while I was at home trying to kick a cold, faffing around with his patch and trying to get it to build. Alas, it would not build. I went to bed far too late last night, feeling like I was on the verge of having it work, but it wasn't. I emailed Simon back today, and he quickly got back to me with the (easy) fix, and tonight, I am in business! The much awaited 4.1.1-P1-10 is uploaded to unstable. I'm still not particularly happy with the state of the package though. The supplied dhclient-script doesn't properly support DHCPv6, and I'm in no position to quickly rectify this, unfortunately, especially in light of the freeze. If you are interested in helping test pre-releases of an updated dhclient-script, please feel free to subscribe to pkg-dhcp-devel@lists.alioth.debian.org, and I'll coordinate such activities on that list in the near future.

21 October 2010

Ian Wienand: Logging POST requests with Apache

After getting a flood of spam, I became suspicious that there was an exploit in my blog software allowing easy robo-posts. Despite a code audit I couldn't see anything, and thus wanted to log the incoming POST requests before any local processing at all. It took me a while to figure out how to do this, hopefully this helps someone else. Firstly install libapache-mod-security, then the magic incarnation is
SecRuleEngine On
SecAuditEngine on
SecAuditLog /var/log/apache2/website-audit.log
SecRequestBodyAccess on
SecAuditLogParts ABIFHZ
SecDefaultAction "nolog,noauditlog,allow,phase:2"
SecRule REQUEST_METHOD "^POST$" "chain,allow,phase:2"
SecRule REQUEST_URI ".*" "auditlog"
So, to break it down a little, the default action says to do nothing during phase 2 (when the body is available for inspection); the allow means that we're indicating that nothing further will happen in any of the remaining phases, so the module can shortcut through them. The two SecRules work together -- the first says that any POST requests should be tested by the next rule (i.e. the chained rule), which in this case says that any request should be sent to the audit log. After that, the similar allow/phase argument again says that nothing further is going to happen in any of the subsequent phases mod_security can work on. As per the parts between A and Z, we'll log the headers, the request body, the final response and trailer. So, as it turns out, there is no exploit; it seems most likely there is an actual human behind the spam that gets through, because every time they take a guess it is correct. So I guess I'll take a glass-half-full kind of approach and rather than being annoyed at removing the spam, I'll just convince myself that I made a small donation from some spam overlord to one of their poor minions!

Next.

Previous.