Raphaël Hertzog: My Debian package maintainer pledge
When coming back from DebConf9, I wrote this pledge:
As a package maintainer, I will do my best to help the Debian project release a stable version of our operating system. In particular, I will work together with the release team and I will keep all packages associated to my name free of release critical bugs. To this effect, if I m not registered as being busy or in vacation, I will start working on my release critical bugs as soon as possible (in less than 1 week in common cases). If I can t deal with them in a timely fashion, I will state it clearly in the associated bug reports, tag them help and invite other contributors either to provide a patch or to do a non-maintainer upload. If I do not manage to handle release critical bugs in the above described way, or if I almost never deal with any of my RC bugs by myself, I will:It tries to sum up the minimal expectations that Debian should have towards the package maintainers. I tried first to get this pledge integrated into the NM/DM process but the discussion concluded that it would be best to document this in the developers-reference. There s already a chapter called Debian Developer s Duties where this can nicely fit. I submitted this as a wishlist request for the developers-reference soon after and it s still open. Now I went to the next step and prepared a patch that restructures the chapter about developer duties. See #548867 for details.I recognize that my work is not limited to unstable. I will also work with the stable release team and the security team to provide updated packages for the stable and/or testing distribution when some issues deserve it. I am aware of the limits of my skills and my available time and I will avoid packaging software that I would not be able to maintain properly.
- not refuse help and even propose co-maintenance to good contributors
- recognize my failure and actively try to find a new maintainer and/or co-maintainers
- not complain if the quality assurance team decides to orphan the package
Follow me on Identi.ca, Twitter and Facebook. Or subscribe to this blog by RSS or by email.
4 comments Liked this article? Click here. My blog is Flattr-enabled.
Continuing my series about my 
In the software community, people hold strong opinions on the subject of listening to users. Some feel that users are an essential source of information for making successful products, as evidenced in the 
The 
If you ve ever gotten tired of waiting for a new Mono release to appear, and taken matters into your own hands by compiling your own copy of Mono, you ve likely faced the problem of missing libraries. That s weird, it says it can t find gtk-sharp, but I have that package!
This happens because every version of Mono on your system has what s called a Global Assembly Cache a location where all system-wide assemblies lives. So when you run an app like Tomboy, it loads its libraries such as GTK# from the GAC belonging to the Mono runtime being used. Ordinarily, this is in /usr/lib/mono/gac on a Debian/Ubuntu system.
When you have your parallel Mono, it doesn t share a GAC as a result, libraries in your main distro GAC are not available in your DIY GAC, as they were never registered in there.
Typically, the advice is to either start compiling every lib you need into a non-standard place too however, here s a better idea. Why not make Apt take care of not only your system s GAC but additional GACs too? We actually have structures in place to handle this, so it s not as hard as you think (merely relatively unknown). This guide does NOT take startup scripts into account it s your problem to ensure you re using the correct mono command to run your copy of MonoDevelop or Tomboy or whatever. You should probably learn about update-alternatives and $PATH for this. Oh, and this guide will BREAK HORRIBLY if you try to uninstall system mono completely. Don t try it.
Setup step 1: preparation
Don t install parallel Mono into /usr/local. I don t care what happens to you if you do. Use some random folder in /opt, usually a per-build prefix like /opt/mono-2.10
Setup step 2: duplicating existing magic
Open a terminal, and copy /usr/share/cli-common/runtimes.d/mono to a new filename, e.g. /usr/share/cli-common/runtimes.d/mono-2.10
Setup step 3: tweak duplicate magic
Open your copied file in an editor, and change the name value on line 27ish (e.g. from Mono\n to Mono (parallel 2.10 install)\n ). Then change the two places in the file, on lines 64ish and 120ish, from /usr/bin/gacutil to /opt/mono-2.8.2/bin/gacutil or equivalent.
Setup step 4: apply magic to existing packages
Run /usr/share/cli-common/gac-install mono-2.10 (or whatever filename you picked for your runtimes.d entry) as root. This will instantiate your parallel GAC(s).
From now on, every GAC library you install or uninstall will happen to every single runtime in runtimes.d.
To go back to how things were before, with only a single Mono runtime:
Uninstall step 1: empty out parallel GAC
Run /usr/share/cli-common/gac-remove mono-2.10 (or whatever filename you picked for your runtimes.d entry) as root. This will remove all packaged entried from your parallel GAC(s).
Uninstall step 2: remove magic
Delete your file from runtimes.d
but you ll be traveling the world while reading him.
My questions are in bold, the rest is by Christian.
Who are you?
I am a French citizen (which is easy to guess unless you correct my
usual mistakes in what follows). I m immensely proud of being married
for nearly 26 years with Elizabeth (who deserves a statue from Debian
for being so patient with my passion and my dedication to the
project).
I m also the proud father of 3 wonderful kids , aged 19 to
23.
I work as team manager in the Networks and Computers Division of Onera
the French Aerospace lab , a public research institute about
Aeronautics, Space and Defense. My team provides computer management
services for research divisions of Onera, with a specific focus put on
individual computing.
I entered the world of free software as one of the very first users of
Linux in France. Back in the early 1990 s, I happened (though the BBS
users communities) to be a friend of several early adopters of Linux
and/or BSD386/FreeBSD/NetBSD in France. More specifically, I
discovered Linux thanks with my friend Ren Cougnenc (all my free
software talks are dedicated to Ren , who passed away in 1996).
You re not a programmer, not even a packager. How did you come
to Debian?
I m definitely not a programmer and I never studied computing (I
graduated in Materials Science and worked in that area for a few years
after my PhD).
However, my daily work always involved computing (I redesigned the
creep testing laboratory and its acquisition system all by myself
during my thesis research work). An my hobbies often involved
playing with home computers, always trying to learn about something
new.
So, first learning about a new operating system then trying to
figure out how to become involved in its development was quite a
logical choice.
Debian is my distro of choice since it exists. I used Slackware on work
machines for a while, but my home server, kheops,
first ran Debian 1.1 when I stopped running a BBS on an MS-DOS machine
to host a news server. That was back in October 1996.
I then happened to be a user, and more specifically a user of
genealogy software, also participating very actively in Usenet from
this home computer and server, that was running this Debian thing.
So, progressively, I joined mailing lists and, being a passionate
person, I tried to figure out how I could bring my own little
contribution to all this.
This is why I became a packager (yes, I am one!) by taking over the
geneweb package, which I was using to publish my genealogy
research. I applied as DD in January 2001, then got my account in July
2001. My first upload to the Debian archive occurred on August 22nd
2001: that was of course geneweb, which I still maintain.
Quite quickly, I became involved in the work on French localization. I
have always been a strong supporter of localized software (I even
translated a few BBS software back in the early 90 s) as one of the
way to bring the power and richness of free software to more users.
Localization work lead me to work on the early version of Debian
Installer, during those 2003-2005 years where the development of D-I
was an incredibly motivating and challenging task, lead by Joey Hess
and his inspiring ideas.
From user to contributor to leader, I suddenly discovered, around
2004, that I became the coordinator of D-I i18n (internationalization)
without even noticing 
The text I ve cropped too eagerly says Choosing a secure password is an essential part of protecting your personal information , or thereabouts. I duly chose a complex password that fitted the requirements, and to my surprise it was rejected. I tried another, and it was rejected; then a third and a fourth. By trial and error I worked out what was going on:
1. The password must contain only the listed special characters, not just include one of them.
That s a bit of a problem, because even assuming a basic ASCII set, 15 characters are unavailable to users; 80 are left, so that s about a 15% fall in the available combinations*. Not a good start.
More concerning is the presence of a security question field. It s used for resetting the password in the event losing it, but this technique for recovery has 
Actually the first form, not shown here, initially just asks for a username, giving an error message if it isn t registered, and here s another problem:
3. The password reset process confirms the existence, or non-existence, of a given username half the credentials required to log in to any visitor.
I d be prepared to take a bet that most users will choose What was the name of your first school? as a security question. The first pet you have is often at such a young age you can t remember it clearly; the name of the street you grew up on might change a couple of times if you moved house. But first school I attended? I ll never forget that, so it makes most sense to use as a backup password . It s also the best one for an attacker to try and find out from public sources.
But that aside, as you can see the password is not generated at random and communicated to the real account holder out-of-band, in the manner of many other sites. Instead:
4. A new password is immediately set to a value already known by the attacker.
Once inside, an attacker can also change the security question or answer, or both, so you can t even regain your account by telephoning the company unless you can convince them you re genuine, in which case the security question was a total waste of time anyway. I awarded some marks for notifying the user by email that the password has been changed, but immediately docked them again because bingo! You re now a victim of identity theft!
Let s assume you ve been locked out, the security question has been changed and you want your account back. ALLOW don t let you telephone them; you either have to dig around and find an address to send an email, which we all know can be intercepted, or (and you re encouraged to) contact them through a form on the site. You ll probably include some personal details, because you want to convince them of your real identity; indeed, two of the options on the form are I ve got a question and Something doesn t work . I sent my findings through this very form, under the latter heading, and to my surprise:
5. Despite promises of full encryption of all data at all times, full implementation of secure socket layers , the contact form is transmitted to ALLOW in the clear, with no protection whatsoever.
So now anyone listening in your connection knows all about you too: your ISP, any of the peers along the route, the deep packet inspection advertisers if your ISP is less than reputable, and the neighbour who connects to your wireless and slips you a fiver every month for the privilege. Nice work, privacy specialists.
(For the record:
I'll collect here links to the various linux-2.6 distribution trees based on the longterm release 2.6.32. I won't go into details of bigger external patches (grsec, openvz, rt, xen, ..), which in consequence also aligned themselves on 2.6.32.
Important bug fixes usually are connected to some bug report, which may be publicly viewable. So from the patch and changelog entry one can usually assume if a certain patch satisfies the 
I picked up a couple of cheap Linux devices at the weekend. First of all, a $99 Android tablet from CVS, made by Craig. It's a generic RK2818 device and of course it's lacking any kind of GPL offer in the documentation. As far as I know the only company that's released any Rockchip source so far has been Archos, and even then they haven't released the tools you need to actually build an image - they seem to be floating around the internet anyway. But it's straightforward to get it to run the Android market, and it runs 
I was going to make this a comment against 
Yesterday I had my last day at $company and today is my first day in freedom. I'll write about my future plans in another blog post. Here I just want to express the joy I had yesterday afternoon when I did:
squeeze is released but this doesn't mean the end of the ordinary RC bug;
old ones are still around, & new ones keep floating in.
Some projects have historically sucked; they've been incomplete, they've been hard to use, they've had poor documentation, or they've had regular security issues.
Over time projects that started off a little poorly can, and often do, improve. But their reputation is usually a long time in improving.
For me? Personally? PHPMyAdmin is a security nightmare. So while it is nice to read about it gaining the ability to be themed, and even receiving submissiosn from users (a rare thing for projects to receive such external contributions) I just find it hard to care.
I see PHPMyAdmin written in a blog, in a news article, or on a users machine and I just think :