Search Results: "nma"

14 July 2008

Neil Williams: State of play in Emdebian ARM

Autobuilder Summary:
138 packages built successfully. 19 packages failed to cross build. 2 packages are tagged for a manual upload. (Dependency issues - rather than break the archive, these packages will not be uploaded until relevant dependencies have been fixed and uploaded.)
Stats
87% built OK
12% failed
Notes:
  1. All these packages built previously and fail at the latest versions in Debian Sid. Many could be upstream errors. All exist in Emdebian at
    previous versions (only 1 failure is known to contain bugs in the current versions in Emdebian and this only affects GUI installations. Two other GUI packages contains bugs but build OK.).
  2. Some of the packages in the repository (including some of the failures) are not used in *any* of the default emsandbox configurations. Two need to be removed from the repository completely.
  3. Some fixes are waiting for updates in Debian, either new uploads migrating to mirrors or pending fixes awaiting upload by me. (Probably tomorrow.)
  4. The history of each package is now available via the Emdebian Autobuilder Report. The package name links to the history of previous build attempts for this package. The version string links to the repository data for the current version in Emdebian. The result of the build links to the build log.
  5. A comparison with Debian unstable is constantly updated.
  6. 254 source packages exist in Emdebian but only 137 are currently built by the autobuilder. The rest will be built when new versions are uploaded to Debian (in some cases, that won't be until after Lenny). If I get time, I'll add build logs for these packages.
  7. The repository contains a fair number of packages that we don't currently use. This is a reflection of the problems of determining the "path" through the dependencies when starting at the bottom (glibc uClibc etc.). Bear this in mind when considering new architectures and new package sets. The process involves a lot of trial and error, particularly as cross-building potentially alters the dependency path at each iteration.

Problems
  1. libselinux and libsepol have just been uploaded with a bug fix that is needed for e2fsprogs and file cross-builds, amongst others. Waiting
    for the ARM mirror to receive the new builds, hopefully tomorrow.
  2. gtk+2.0 fails to cross-build because the patches now try to build the udeb which comes up against a bug in dpkg-cross. I'll be uploading the new version (including a couple of other bug fixes) tonight. (Final testing currently in progress.). The Gtk package also needs some work to run /usr/lib/libgtk2.0-0/update-gdkpixbuf-loaders so that the icons can be read in the GUI.
  3. pango1.0 also needs a fix to update the pango modules. This is usually done at build time but it means running a cross-built binary. It is a minor task and not CPU intensive so I plan to do this in postinst. Without this fix, no text is rendered in the GUI, only empty glyphs.
  4. xfonts-base is way too large still. More work is needed here to optimise just what is meant by the 'fixed' font for X, precisely which font files can be removed, which might be needed outside C or English locales etc.
  5. Other packages not currently cross-building include: (NOTE: Some of these build logs are VERY large.)
    • adduser - needs to be removed from the repository, it is perl and we implement it via busybox.
    • cups cupsys - /usr/include/pthread.h:653: warning: '__regparm__' attribute directive ignored.
    • gcc-4.2 - needs to be removed from the repository, it no longer builds libgcc1 which was the main reason for cross-building it.
    • glib2.0 - more generated content: /bin/sh: line 2: /usr/bin/glib-genmarshal: No such file or directory
    • gnomevfs - hasn't built for ages and isn't usable anyway due to dependency issues. Currently preventing the use of gpe-filemanager. Due to be replaced by GIO in Debian.
    • libusb - build failure, so far resistant to usual fixes.
    • ncurses - build failure - uses gcc in wide char support build.
    • ntp - build failure - assembly error. authkeys.c:445: error: invalid 'asm': invalid operand for code 'w'
    • pcre3 - build failure - apparently simply unresolved symbols resistant to usual fixes.

    • slang2 - possibly needs a patch update, tries to build -pic archives and then fails.
    • xorg-server - build failure: make[4]: *** No rule to make target -L/usr/arm-linux-gnu/lib', needed by Xprt'. Stop.


Of the problems above, only problems 2, 3 and 4 (gtk, pango and xfonts-base) are "critical" as these are the only ones where the current packages are sufficiently broken that the new version is essential before Emdebian can make a "release" of a series of three root filesystems for ARM. Sizes are still larger than desired - a fix for that requires changes in glibc which I hope to investigate during DebConf.

Any help on the above issues is appreciated.

Problem-solving:
$ emsource -c $package
$ cd /path/to/$package
$ emdebuild

If you have SVN access, use 'emdebuild --svn-only' to commit your changes (even if your changes don't solve all the problems).

Without SVN access, post the result of 'svn diff ../emdebian*' to this list (or 'svn diff ../debian*' if you have added a patch for the upstream code to debian/patches/).

Platforms:
All the above is based solely on Emdebian ARM for balloon3:
Linux balloon 2.6.25.2-pxa270 #1 Sun May 18 22:38:11 BST 2008 armv5tel unknown
balloon3 in CUED case
http://balloonboard.org/gallery/300/balloon3-0v1-fpga.jpg

AFAICT no other ARM platforms have been tested. :-(

I have a few fixes for the balloon3-config package that also needs an update in Emdebian - I've had some feedback from the touchscreen driver
upstream that we might be trying to use the wrong device (/dev/input/mice is the wrong target for the symlink, we can set whatever device we want in /etc/X11/xorg.conf and the driver will use that in preference to /dev/event0). As this is device-specific, /etc/X11/xorg.conf will be put into balloon3-config which is available via Emdebian SVN.

26 June 2008

Wouter Verhelst: Firefox sucks. No, really!

Warning: big rant ahead. I received some comments on my previous post, as expected. Most of them were helpful; e.g., the oldbar extension is very useful. One of them was silly.
It depends: If your application is "fullscreened", clicking on the link without having the focus could lead to interesting situation like "Hey, It does nothing?"
Just to make a point here, let me reiterate: There is no excuse whatsoever to steal the focus Sorry for the shouting, but seriously. I have the following in my icewm configuration: 
ClickToFocus = 0
RaiseOnFocus = 0
FocusOnMap = 0
FocusOnAppRaise = 0
FocusOnMapTransient = 0
FocusOnMapTransientActive = 1
RaiseOnClickClient = 0
What this means is that I don't want anything to either get the focus or get on top of anything else all by itself, unless it happens to be a new dialog box created by an application that already has the focus. I also don't want windows to appear on top of anything else just because they received the focus. I also happen to prefer focus-follows-mouse, which you can get by way of the ClickToFocus thing. The reason I prefer it this way, is that often I have several applications open all at once. For instance, when I read RSS feeds, I have my RSS reader open on one virtual desktop, and read through the articles. Since my laptop's processor is much, much faster in certain things than is my network, I also make use of its multitasking abilities to have it preload links in the background (on another virtual desktop, preferably). Unfortunately, somehow, firefox manages to bypass all that configuration and shows up in front, stealing the focus; and in the process, it completely interferes with the way I work. No doubt they do this in order to help some hypothetical "grandma" or other stupid clueless person who's never used a computer before, but let me tell you something: software should be written for people who actually do use software, not for stupid nitwits who can't even read an error message that tells them "you cannot do A, please go ahead and do B instead". But I guess I'm too stupid or something to understand the usability "experts" who know it all best and say that software should be "intuitive" so that those who are 53 and see a computer for the first time in their live can sit right next to it and start emailing. Hah. As if the above wasn't enough, firefox 3 also is a crashing load of shit. I just spent the better part of an hour to try and make a payment using my bank's excellent online payment software which requires nothing more than javascript, SSL, and a digipass 810 that is provided by the bank as part of the online banking contract. Unfortunately firefox insisted on crashing halfway through entering the required information, for six times in a row. You'd think I'd be filing a bug now, but no, it managed to crash in a different location every time. I'd probably have to start debugging firefox to get this done, which is not something I'll do in this life. You know what the problem is? Webbrowser developers think they're developing the most important application for any computer. They're not. It's just a webbrowser, no more important than an xterm or a mail client: a tool to get a job done. Period. Grunt.

25 June 2008

Clint Adams: Relaxation

I was misled. That much is probably true. I certainly had no idea what I was getting myself into. Enough of that though; there's narrative fading away. The part I should take responsibility for is the decision I made to stray off the map. Perhaps it was not so much a decision as a compulsion. I looked at the map. I saw the suspicious unmarked area at the edge, and concluded immediately that there was something good there, something the people wanted to keep hidden from me. I was correct, but I presumed far too much about the terrain. I thought I would make a quick exploration of the secret place, then backtrack to the more mapped area and get back with the program. Enough of that though; I've nearly forgotten the story. First I should point out that, had the map been to scale, it should have taken me an leisurely fifteen minutes to get to my first destination. It should have, assuming the land would be as flat as the map that represented it. Instead, it turned out to be something one could cover in fifteen minutes if one had, say, a jetpack and spring boots. I'm probably wrong; I'd probably injure myself in the process and take longer. Anyway, the average incline was close to 45 , and luckily was mostly uphill. Luckily. When I got to a resting place, I was able to conclude that my supply of fluids was almost certainly insufficient for me to continue. On the other hand, there was probably no way I would return if I went back for more drink. I told myself that there would likely be a beverage-selling shack out in the middle of nowhere around the next bend or so. Having solved this probability problem, I pressed on into the blazing sun. I came to a path leading down to the sea. It was unclear what was down there, but it was clear that it seemed to be a million miles down, and that that path might be the only way back. Given my current state of exhaustion and hydration, I decided to pass on this opportunity. After continuing for a while, the features at the bottom of that path became visible. A very pretty cove was down there, and almost certainly no shack o' drinks. I then came upon a fork. A wide path led downward: to what, I could not see. To its left, a narrow and rough path led straight. Knowing that a descent probably meant climbing four to eight times the altitude back somehow, and assuming the less pleasant-looking path led somewhere better, I went left. After a while, the land began to slope down, ever so slightly. Little clusters of bottles and newspapers were left on the rocks here and there. Then came a sofa under a tent. I began to wonder what hippies were traveling this path. The slope grew greater, and I passed a bench in a tent. Then I came to a giant staircase, almost straight down. It was covered in weeds and insects. Some were vegan, some wanted my flesh. As I got toward the bottom I thought about how glad I was that I had come that way from the top and not the other way around. Oh, I was very glad. At the bottom was something resembling a plastic bottle graveyard and barrels among barrels filled with water. Rubber hoses seemed to run randomly between certain barrels. A kitchen stood at the edge of some barrels. I suddenly got the feeling that I was not supposed to be here. After discovering that a couple of escape routes were actually dead ends, I proceeded to descend a small staircase to a terraced garden. Hoses lay about the rows, presumably for watering the plants. A cot under a tent lay empty, and I hurried past hoping I would not encounter the owner. Then I was at the ocean. The coast was lined with huge boulders, and a wooden bridge led me to the first one, and another wooden bridge took me to the second. Then the bridges stopped. In the distance, I could see that pretty little cove from before. I took stock. I could either return whence I came, up that horrifying staircase, or I could try to traverse the rocky coast over to the cove, then maybe do a faceplant on the beach and let the tide drown me rather than climbing back up. It seemed like a no-brainer, so I began making my way toward the cove. It got harder. Several times I became very afraid, either of falling and smashing my head against a rock or falling into the water below, or some sequential combination thereof. In the end I turned out to be more afraid of going back, at least until I got to what I judged the point of no return. I was reasonably close to where I imagined the sandy beach started, but there was a huge and impassable boulder in the way. Also, if I went further there was no way I would be able to climb back up in case I needed to retreat. I was thinking I would need to retreat, because unless there was some magical hidden toehold, I would be forced to jump into the water and swim around. I did not want to jump into the water. I wanted my phone to stay unfried in the event that I would need to use it to get rescued. I also did not want to call anyone to get rescued, especially since I didn't really know how to explain where I was. With a heavy sigh, I gave up, turned, and went back. This time I moved more quickly, though incurring more damage to my hands and feet. No humans were visible at the crazy farm/garden and makeshift reservoir, but plenty of bugs were visible on the staircase. I made the mistake of trying to lean against the railing to catch my breath. When I finally got to the bench in the tent, I understood exactly what it was for. I sat down, took a sip of my remaining water, ate an apple, and kept going up. When I got to the couch, I sat again. This time I sat and tried to figure out a plan. I still clung to the belief that once I got back to somewhere less wild I'd be able to buy a drink. I noted that I only had a little bit of water left, that I was dehydrated, that I was sunburned, that my pulse was about 180, and that there were no dogs or Russian people wandering past me. I ate a pear and drank my last few drops of water. I kept sitting until my pulse was down to around 150, then I figured I needed to keep moving. I was experiencing most of the effects of caffeine, and for free. Oddly, I passed a dog a few steps later. It was just standing by a rock, looking at me. I decided not to converse. When I had nearly reached the fork again, a couple came my way. I thought about begging them for water. I decided not to be rude. I have no idea what happened to them. I'm betting they wisely decided not to go down the steps. Resolving that the only sane option was to go back all the way to where I absolutely knew I could buy something potable, I headed in that direction. Still, I took two risks. Instead of going up the exact way I had come, or taking a well-travelled path down, I took a narrow and flat dirt path. It was actually a bit of a dilemma. I started down the latter two more than once each. Finally I saw that the down path was rather V shaped, and I concluded correctly that the straight path would bypass that angular-half-pipe-like construct. When I finally got to a point I recognized, it was smooth sailing the rest of the way down. I bought water and a snack, since I had had almost nothing to eat that day. At this point it would have been prudent to call it quits and go off and gorge myself on seafood or something, but no, I was now in the mapped area and surely it would all be roses and manna. Finishing one bottle, I bought two more. Five minutes later I bought another. I had now overcompensated, but I was playing it safe. I continued my explorations. Bicyclists kept nearly running into me, and, aside from the obvious, I viewed this as a good sign. Bicyclists, especially those that can't seem to steer straight for some reason, avoid difficult terrain. This is why they take their bikes on subways, trains, and buses. I don't like bike-riding, but if I had my druthers, I would always go downhill. No up, no flat, just down. Like downhill skiing, just down. It is a good thing I don't ride a bike. Once I got to the point where the bicycles thinned out to nonexistence, I was at an intersection. The way I wanted to go was up. The way I didn't want to go, but was a reasonable option, was only very slightly up. Additional factors complicated this decision point. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. Moving hurriedly away from there, I headed upward. After a couple of turns, I ran into Catholics. First there were dead Catholics. Then there were Catholics pre-occupied with dead Catholics. Then there were Catholics waiting to die. Then there were seminarians. Then there were teens with prayer books. When I reached the next pinnacle, there were more teens with prayer books. There were benches, and there were no teens on them, for the teens were standing or sitting on the ground, quietly contemplating the Word. Unfortunately, they had decided that the benches were more suitable for holding all their bags, so there was nowhere for me to sit. I considered interrupting their reverie, but decided it wouldn't be very Christian of me to disturb them, so I just placed an ancient Drasnian curse on them and plodded down the hill toward a small beach. I really didn't need any more sun, but at least there probably wouldn't be anyone praying there. The water was tempting, but I'm always paranoid about my belongings when swimming alone, and if my phone were taken I wouldn't be able to call anybody to come rescue me at the next crisis point, sure to come. So I skirted the coastline and arrived at a much larger beach, one with facilities and services. Opting to save money but complicate things by using the public changing rooms and showers, I made a discovery. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. Nonetheless, I changed into my swimming trunks, stuffed everything else but my towel, sunglasses, and a disgusting sugary drink I never should have bought into my bag, and went barefoot a few buildings down to rent a locker. The locker was ridiculously large for a single person, which is good to know should I ever want to kidnap a family and torture them at this place. The proprietor informed me that they were closing at some specific time, about an hour from then. I had no timekeeping device outside of the locker, so I had to wing it, and erring heavily on the side of caution, I had a short beach diversion. Given that large swathes of my epidermis were turning bright red, it's probably for the best. Handling the shower, locker, and changing in the other direction was slightly more complicated, but I did it and then I headed inland, figuring I should have a substantial meal for once that day. On my way to find dinner is when things got really crazy. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. I wandered over to a bench to eat my newly-acquired snack, and did not exercise enough caution, because the flimsy paper bag ripped and I got sauce all over my pants and a little on my shirt. Unfortunately I had used my napkin in that earlier episode, and I'm not sure how much it would have helped anyway. Thus I continued on, looking like a slobby retard. Then I made an obviously-poor decision and ended up having a subpar dinner. What happened after that is a story for another time.

23 June 2008

Jonathan McDowell: BarCamp Belfast 2008

I spent Saturday at BarCamp Belfast. There were more people than I expected; I'm no good at judging exact numbers but the wiki lists 62. As it turned out not everyone ended up talking; this worked out well for me because I don't think I'm Web2.0 enough (is that a bit ironic given I'm writing this on a blog?). I don't really do user interfaces or website stuff and that seemed to be the primary focus of a lot of the attendees. Nice to know there's a fairly active crowd in
Belfast though; I discovered the existence of Belfast Open Coffee which I'll have to try and make at some point.

I went to at least the following talks::

Gerard McBreen on Digital Circle & Adobe Flex: Quite a cute demonstration of the Flex framework for Flash. I'd have been more convinced if Flash could be considered truly cross platform; Adobe can't even manage a 64 bit client yet and Gnash is far from ready.

Daniel McLaughlin on Nagios: Not really anything I didn't already know, but always interesting to see how other people are using these things to see if there's any nice tricks you've missed.

Andrew Gribbon from Exile Coffee on speciality coffee: This was really interesting. A complete tangent from IT but enjoyable and I must buy some roasted beans from him (I've been meaning to place a Roast and Post order for ages anyway).

Brian O'Neill on freelancing: Tailored towards the web market in my opinion, which is fair enough but things like aiming to never employ anyone and stay a one man operation doesn't really work if you're doing something that a customer wants supported around the clock. Or even just during the working day if you're crossing time zones. Interesting to hear that Brian had run an agency in the past but preferred working on his own these days. I kinda feel I've gone a bit the other way. :)

Linux Hardware workshop: Not really a lot of interest here; a clutch of EEEs, an N800 and a Debian box or two. However I had a chat with David Newman about his MythTV setup which convinced me I really should give it another try. After I get someone to install a bigger aerial in the hope of stabilising our Freeview reception.

Brian Cleland on Linux Trends: Talking about lots of Linux takeup by big names and general market adoption eg the recent selection of cheap subnotebooks. Main thing of interest was OpenPandora which I hadn't heard of before; OMAP3 based handheld device running Linux with a 800x480 4.3" screen. Aimed as a gaming device, but has a keyboard and bluetooth/wifi so has potential as a PDA as well. Hopefully the build quality will be better than the GP2X I saw.

Andy McMillan on coffee shop working: I've thought about this in the past myself; I worked from Cafe Java in Norwich a few times while doing Black Cat, but in general didn't find it as conducive to work as I'd hoped. He mentioned Coworking Belfast which is an idea Tristam has talked about in the past, in terms of people who work from home getting to have some form of social contact with like minded individuals, without having to go to the expense of a whole office. It'll be interesting to see if it takes off.

Darragh Doyle and Grannymar on blogging: I think everyone in the audience already had a blog of some description. I don't really consider my blog a social forum; it's not something I expect to have a long conversation on, just ask a quick question or discuss something
I've done that I think might interest people or give a general "this is what's happening at present" post. Blog commenting systems are all a bit crap to keep up anything sustained. Someone needs to write a blog<>nntp gateway that correctly cross posts comments as well. I suppose the issue with that is then everyone needs to run a news server, or all agree on
using the same one. Fine for groups of people who know each other but not if you want to read a dozen blogs from different areas in a single client that'll let you properly follow conversations. Mind you, people seem to cope with forums and I don't really understand how. Supporters of news and mailing lists seem to be dwindling. :(

Anyway, that was my first BarCamp. I wasn't quite sure what to expect, it was a bit more Web2.0 than I'd have liked (which is fair enough, but I'd have liked to have seen some talks about low level bits really) but I'd go again and will keep an eye out for the next one. And hopefully I'll see some of the people I met there at the BLUG meeting this Wednesday (Tap House in Lower Crescent from 6pm for anyone who's not on the mailing list).

22 June 2008

Christian Perrier: Console stuff not a secret, just neglected

Marc, from my experience, there is no 'secret' in the console-tools/kbd migration work. Just low involvment of all parties. I have watched the work on console handling stuff in Debian for a few years now, and my conclusion is just that nearly nobody cares about it now. I do maintain console-data that provides console fonts and keymaps. I took it over slowly from Alastair McKinstry (the console-tools maintainer mentioned in Marc's blog entry) because that involved maintaining localization of keymap names....that are used and visible in the installer. Ideas to switch the installer to console-setup and related tools are floating around. Just not achieved...because of lack of motivated manpower. Progress was made because of Anton Zinoviev and Colin Watson's work, but the project is currently hosed on a quite critical choice: About console-tools being installed by default: this is the consequence of it being Important while kbd is Extra. I think it should be up to kbd maintainers to push the change up. But this brings us back to the initial remark: indeed, now nobody cares about console handling, particularly when it comes at handling non-English environments. Those who still use the console in Linux environments apparently all do it with US keyboards and an English locale. For sure, kbd is more maintained than console-tools so, at least, we should switch to it. Funnily, our installer (even the graphical version) *still* relies on console keymaps during the installation process and, therefore, we rely on mostly unmaintained stuff here (people who think that I maintain console-data are plain wrong: I just keep it surviving...:-))

19 June 2008

Martin F. Krafft: IPv6 with Debian

Even though I ve dealt with IPv6 for almost a decade, have delivered presentations, and given multi-day courses on IPv6 security aspects, I ve never actually added IPv6 to my own server/home network infrastructure because it seemed that Linux and/or Debian just weren t ready for it. This seems to have changed (although there are still a number of problems) and in less than a day, I put a few of my machines online. In the following, I d like to share with you how I did it.

Kernel versions and stateful connection tracking Unfortunately, I have to start off with some bad news: even though Debian etch, our current stable release, which uses a Linux kernel version 2.6.18, speaks IPv6, I cannot recommend it for deployment, as the 2.6.18 kernel does not support proper stateful connection tracking for IPv6, and thus makes it impossible to firewall hosts in a sensible manner (I always add local packet filters to all my hosts, and if only to guard against the situation when a user installs a malicious programme to listen on a high port). Of course, it is possible to configure a packet filter statelessly in an acceptable manner once you know the use case, so do with this information what you wish; I prefer to stay general for now. For me, a remedy is almost around the corner: the 2.6.24 kernel seems to support stateful connection tracking for IPv6, and it s even available for etch as it will be included in the upcoming etch-and-a-half release. I simply ended up using the kernel packages pre-release, and so far have not had a problem with it. To do so, add the following line to your /etc/apt/sources.list, making sure to use a close archive mirror: 
deb http://ftp.xx.debian.org/debian etch-proposed-updates main
I then just upgraded the system and pulled in all proposed updates. As that may have let in software that won t be part of etch-and-a-half, or even lenny, you may want to pin the archive and only upgrade the kernel packages, by adding to /etc/apt/preferences (replacing amd64 with your architecture): 
Package: *
Pin: release a=proposed-updates
Pin-Priority: -1
Package: linux-image-2.6.24-etchnhalf.1-amd64
Pin: release a=proposed-updates
Pin-Priority: 600
Alternatively, you could use the 2.6.24 linux kernel packages on backports.org.

Xen and IPv6 One drawback of switching to 2.6.24 is that you cannot run a dom0 on that machine any longer, so by practical extension, you cannot connect it to the IPv6 network with a packet filter in place. Supposedly, running 2.6.24 instances on a 2.6.18 dom0 is reported to work, however.

Configuring the packet filter The first thing I did was to configure the packet filter on each host appropriately. Unfortunately, this is harder than it should be, because to quote one of the netfilter developers when ip6tables was conceived, someone had a big bad brainfart : rather than adding IPv6 rules to your existing iptables ruleset, you have to create a new ruleset, duplicate all chains, networks, hosts, and individual rules, and maintain the two in parallel. Even though there are efforts of unification on the way, I speculate it ll take another couple of years until PF_INET6 will be fused into PF_INET and one will be able to do sensible cross-address-family packet filtering with Linux. Since I ve recently started to look (again) at pyroman, maybe the most logical way forward would be to extend it to write both, IPv4 and IPv6 rulesets from its knowledge about the hosts and networks you configured. Anyway, we want to get stuff working now! Thus, let s configure ourselves a packet filter. (Almost) all IPv6-related filtering must be configured via ip6tables (read on further down about IPv6 in IPv4 tunneling, the reason I said almost ). The following is a simple default ruleset to start with, which I put into /etc/network/ip6tables to load with ip6tables-restore: 
*filter
:INPUT REJECT [0:0]
:FORWARD REJECT [0:0]
:OUTPUT ACCEPT [0:0]
:in-new - [0:0]
### INPUT chain
# allow all loopback traffic
-A INPUT -i lo -j ACCEPT
# RT0 processing is disabled since 2.6.20.9
#-A INPUT -m rt --rt-type 0 -j REJECT
# allow all ICMP traffic
-A INPUT -p icmpv6 -j ACCEPT
# packets belonging to an establish connection or related to one can pass
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# packets that are out-of-sequence are silently dropped
-A INPUT -m state --state INVALID -j DROP
# new connections unknown to the kernel are handled in a separate chain
-A INPUT -m state --state NEW -j in-new
# pass SYN packets for SSH
-A in-new -p tcp -m tcp --dport 22 --syn -j ACCEPT
# log everything else
-A INPUT -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[INPUT6]: "
### OUTPUT chain
# RT0 processing is disabled since 2.6.20.9
#-A OUTPUT -m rt --rt-type 0 -j REJECT
# allow outgoing traffic, explicitly (despite chain policy)
-A OUTPUT -j ACCEPT
### FORWARD chain
# RT0 processing is disabled since 2.6.20.9
#-A FORWARD -m rt --rt-type 0 -j REJECT
# disallow forwarded traffic, explicitly (despite chain policy)
-A FORWARD -j REJECT
COMMIT
Note that this recipe is pretty much unusable on pre-2.6.20 kernels due to their broken implementation of stateful connection tracking. The ruleset should be fairly obvious, but you might wonder about my use of REJECT and allowing all ICMP after all, you ve heard for the past 30 years that ICMP is a bad hacker protocol , and Internet security is no domain for being nice to people, so to prevent any information disclosure, you should DROP connections, not let people know that they re simply not allowed. Well, to hell with all that! I don t see a single reason or attack vector that is foiled by DROP or disallowing ICMP. In fact, it s just security by obscurity, and might inconvenient at the same time. ICMP is also much more important with IPv6 than with IPv4 (it replaces ARP, for instance), and it s actually useful to be able to ping hosts, or get back informational messages on why something failed. Finally, rejecting traffic rather than dropping it doesn t suggest to a hacker that something s hidden here. Then there is RFC 4890, which almost made me puke. This document is part of the reason why I say: let s fix problems in the kernel, rather than shielding them with unreadable and unmanageable rulesets!

Getting connected If you already have an IPv6 address, you re basically ready to go, but may want to read further down on how to connect your local network to the IPv6 Internet as well. If you are searching for a provider, have a look at the list of providers with native IPv6 connectivity over at sixxs.net. If you are reading up to here, I assume you are connected to the Net with IPv4. There are two ways for you to move towards IPv6: 6to4 or by way of a tunnel provider. A Kiwi website explains how to setting up 6to4 connectivity, and thus I will concentrate only on the tunnel approach. Even though everyone can set up 6to4 in a breeze without any accounts or waiting, there are a number of security considerations, it s pretty ugly to debug (due in part to asymmetric routing), and makes your life unnecessarily difficult when all you have is a dynamic IP that changes from time to time. If you are stuck behind a NAT gateway, you cannot use 6to4 either. Thus, I prefer the tunnel approach. With the tunnel approach, IPv6 packets are wrapped up in IPv4 packets on your host, and sent to the IPv4 address of your tunnel provider, who has native IPv6 connectivity. The tunnel provider unwraps your packet and shoves the contained IPv6 packet onto the backbone. The IPv6 address you used as source address is routed to the tunnel provider, so any replies arrive at their machines, where they re again wrapped into IPv4 packets and sent to your (publicly-accessible) IPv4 address. Those IPv4 packets specify payload type 41 ( ipv6 ), which is why we need those -p ipv6 -j ACCEPT rules in the iptables ruleset. There are a few tunnel providers out there. I chose SixXS and have not regretted my choice. I shall thus assume that you do the same: sign up for an account right now, so that you have it by the time you finished reading this document! SixXS works on a credit system: tunnels and subnets cost credits, which you can accumulate by maintaining your tunnels properly. This ensures that everyone can play around, but to do more advanced stuff, you need to first display competence with the basic concepts. Your first step with SixXS will be to request a tunnel. SixXS offers three types of tunnels:
  • static tunnels, for those with static IPs,
  • heartbeat tunnels, for those with dynamic IPs, and
  • AYIYA tunnels, for those behind NAT gateways.
Each of these tunnels have advantages and disadvantages, as everything does: the first two types of tunnels use IP protocol 41 packets to encapsulate the IPv6 packets. As such, there are security considerations involving the impersonation by spoofing, and all upstream firewalls must let protocol 41 pass. AYIYA addresses these problems by using signed packets, but that solution comes with extra computation overhead and smaller MTUs. I suggest to use the first type of tunnel that fits your situation. Debian s aiccu package can take care of heartbeat and AYIYA tunnels for you, and it can even set up static ones. During registration, you will also need to choose a PoP , which stands for Point of Presence . If your country only has a single PoP, that s the one you will end up using (unless you have a good reason for another one), but if there are more options, I strongly suggest that you go through the list of PoPs and select the one with the best roundtrip time and lowest latency from your location! Note that you must answer ping requests (ICMP echo-request) from the PoP you chose, or else the tunnel will not be created. Once your tunnel request gets approved, you ll get a /64 prefix, in which you only use two addresses: the PoP will configure the :1 address and you need to configure your host to use the :2 address on the tunnel interface. You ll also be told the IPv4 address of your PoP endpoint . Joey Hess taught me that aiccu can set up the interface for you, using the data it queries from the SixXS registration (TIC) server. I tried it, and it works. However, I prefer the pure ifupdown approach, as it makes things explicit and allows me to use the hooks for stuff like loading the packet filter. So in my /etc/network/interfaces, you can find: 
auto sixxs
iface sixxs inet6 v4tunnel
  endpoint 194.1.163.40
  address 2001:41e0:ff00:3b::2
  netmask 64
  gateway 2001:41e0:ff00:3b::1
  ttl 64
  pre-up ip6tables-restore < /etc/network/ip6tables
  up ip link set mtu 1480 dev $IFACE
  up invoke-rc.d aiccu start
  down invoke-rc.d aiccu stop
Make sure to read about MTU values of the tunnel and adjust the 1480 value in the above to your tunnel settings and ISP connectivity. Also set ipv6_interface sixxs in /etc/aiccu.conf, if you are using aiccu, or else aiccu will bring up a duplicate/additional interface. If you tell it to use the same interface, it will actually execute all the same commands (which will fail), but won t report any errors. A future version will have a switch to prevent it from configuring the interface. Unfortunately, this will probably not work. The reason is that your regular IP packet filter (iptables, without the 6) doesn t let those encapsulating IPv4 packets pass, unless we tell it to; we probably want to do this early on in the chain, and also limit it to our tunnel peer, so: 
iptables -I INPUT -p ipv6 -s 194.1.163.40/32 -j ACCEPT
For AYIYA, you need to open port 5072, either for UDP, TCP, or SCTP, depending on how you configured it. Also have a look at this FAQ entry on what a firewall needs to pass. If it still doesn t work, you have an upstream packet filter that needs some of those holes poked. Good luck. In most situations, the FORWARD chain does not get such a rule, since the tunnel terminates at the gateway, which routes to a native IPv6 network, or another tunnel. Allowing tunnels through a gateway is almost always a bad thing, as it would allow undetected and untraceable traffic from compromised boxes in the local network. The OUTPUT chain also does not need such a rule, if you have configured stateful filtering properly. Now bring up the interface and verify the connection: 
# ifup sixxs
# ping6 -nc1 2001:41e0:ff00:3b::1
PING 2001:41e0:ff00:3b::1(2001:41e0:ff00:3b::1) 56 data bytes
64 bytes from 2001:41e0:ff00:3b::1: icmp_seq=1 ttl=64 time=74.0 ms
[...]
# ping6 -nc1 ipv6.aerasec.de
PING ipv6.aerasec.de(2001:a60:9002:1::184:1) 56 data bytes
64 bytes from 2001:a60:9002:1::184:1: icmp_seq=1 ttl=55 time=91.5 ms
[...]
Welcome to the Internet of the future!

Setting up an IPv6-capable gateway Your IPv6 connection works, but it s limited to a single address, and you do not get to specify the reverse DNS PTR record for it. Since the concept of NAT is mostly absent from IPv6 (thanks! thanks! thanks!), you will not be able to connect any other hosts to the IPv6 network. If your local network has a few hosts behind a gateway, you will need to request a subnet from SixXS and configure your gateway (which has the tunnel connection) appropriately. Don t worry, this is not really very difficult. First, request a subnet for your tunnel from your PoP via your SixXS homepage. Once approved, you will get a /48 prefix for your own use: 2^80 1.2 heptillion addresses which are yours to assign to every dust particle in your office or home, if you so desire. The way I set it up is to add the first of these addresses to your internal interface on the gateway, by adding the following two lines to the interface s stanza in /etc/network/interfaces; you will need the iproute package installed (which you should be using for everything network-related anyway): 
up ip -6 addr add 2001:41e0:ff12::1/64 dev $IFACE
down ip -6 addr del 2001:41e0:ff12::1/64 dev $IFACE
Instead of bringing the interface down and up, just run ip -6 addr add 2001:41e0:ff12::1/64 dev eth0. Note the use of the /64 prefix instead of the /48 that got assigned, leaving only 20 pentillion addresses. Oh no! The reason for this is buried in the specs: basically, /48 is a site prefix, but individual networks should not be larger than /64, which is the prefix length of links in the IPv6 domain. Now is also a good time to enable IPv6 forwarding, e.g. like so: 
# echo net.ipv6.conf.all.forwarding = 1 >> /etc/sysctl.conf
# sysctl -p /etc/sysctl.conf
Obviously, you will also need to change the policy on the ip6tables FORWARD chain. For now, let s just set it to accept. You should later create a proper ruleset, though! 
# ip6tables -I FORWARD -j ACCEPT

Bringing IPv6 to your local network The final step is to spread the love to your local network. Refrain from selecting addresses from your subnet and assigning them to the local hosts, or wondering how to configure the DHCP server, because IPv6 does it differently: your gateway will advertise its routes (which includes a default route) to your network, and each host will pick an address based on its MAC address (unless it already has an EUI-64 address assigned. This all happens automagically, at least with current Debian and Windows machines. On the gateway, you need to install radvd and simply tell it which prefix to use on which interface. My /etc/radvd looks like this, and I won t explain it: 
interface eth0
 
  AdvSendAdvert on;
  prefix 2001:41e0:ff12::/64
   
   ;
 ;
Note again how we advertise a /64 network rather than the /48 we own . You cannot advertise smaller networks if you want automatic configuration to work, and you should not use networks larger than /64 in any case. If 2^64 addresses are not enough for you, I trust you ll be able to figure out how to advertise another of your 65536 /64 prefixes in the /48 subnet to appropriate hosts. Restart radvd and run over to another host to witness how it automagically gets connected to the IPv6 network by scanning /var/log/kern.log and watching the output of ip -6 addr and ip -6 route. Try ping6ing from there! Find the dancing turtle! It should all work. If you don t like the automagic aspect of this, look into stateful configuration, using DHCPv6, as provided by dibbler-server and ?wide-dhcpv6-server.

Resolving names Take note of the IPv6 address of each host. There s a way to determine it given the host s MAC address, but this is easier (ipv6calc is also useful). You might want to let your local DNS server know by adding AAAA records in parallel to the existing A records, and possibly even adding PTR entries. If you re serious about IPv6, you can tell SixXS to delegate reverse lookups for the IPv6 addresses to your DNS servers, but you ought to refrain from polluting the DNS namespace. Note that bind9-host provides an improved host tool, which fetches all kinds of information about names, not just the one single information configured as default: 
% host pulse.madduck.net
pulse.madduck.net has address 130.60.75.74
pulse.madduck.net has IPv6 address 2001:41e0:ff1a::1
pulse.madduck.net mail is handled by 99 b.mx.madduck.net.
pulse.madduck.net mail is handled by 10 a.mx.madduck.net.
% host 2001:41e0:ff1a::1
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.1.f.f.0.e.1.4.1.0.0.2.ip6.arpa
domain name pointer pulse.madduck.net.
Oh, and if you re really that curious about how IPv6 addresses are computed from MAC addresses, read RFC 2464. Basically, given a prefix 2001:41e0:ff1a:: and a MAC address aa:bb:cc:dd:ee:ff, the resulting IPv6 address is obtained by:
  1. inserting ff:fe into the middle of the MAC address to yield aa:bb:cc:ff:fe:dd:ee:ff;
  2. flipping the second lowest bit of the first octet to yield a8:bb:cc:ff:fe:dd:ee:ff;
  3. removing the odd colons to yield a8bb:ccff:fedd:eeff, the EUI-64;
  4. concatenating the prefix and this result to get 2001:41e0:ff1a::a8bb:ccff:fedd:eeff.
If you find your (Windows) IPv6 addresses changing all the time, you might be faced by privacy features .

Remaining issues Even though my IPv6 connectivity works, I have two remaining issues.

Sending larger amounts of data to the network I am experiencing a curious issue where outgoing ssh IPv6 connections time out and outgoing data transfers hiccup. I have yet to find out what s going on.

Mapping names to laptops Laptops generally have two interfaces, one with a cable, and the other wireless. Both of these interfaces will have separate MAC addresses, and by extension, the laptop will have different IPv6 addresses depending on how it is connected to the local network. I want to be able to connect to laptops without knowing the medium they use to connect to the network. Unfortunately, there seems to be no feasible way. The solutions I see are:
  • override the MAC address of one interface with that of the other, which is going to cause bgi problems in the case when the laptop (accidentally) gets connected to the same network twice;
  • add both IPv6 addresses as AAAA records to the laptop s DNS name, which will cause random delays when connecting as the resolver may return the currently inactive address first;
  • set up mobile IPv6, e.g. by following this Mobile IPv6 how-to, which would allow accessing the laptop uniformly, no matter where in the world it is. Unfortunately, Debian s support for Mobile IPv6 is severly lacking at time of writing. Also, Yves-Alexis Perez notes that this how-to is horribly outdated and promised to tend to it Real Soon Now .
The second solution works for me for now, but I am interested in the third. In response to this document, Andreas Henriksson has suggested the replace the stateless configuration (radvd) with stateful configuration, using DHCPv6. I have yet to investigate this option. Jeroen Massar suggests to unite cable and wireless into a bridged interface, which seems like a very good idea.

Credits Thanks to Bernhard Schmidt, William Boughton, and Jeroen Massar, and everyone on #ipv6/irc.freenode.org for their help over the past few weeks, and all those who fed back comments in response to this document!

4 June 2008

Joey Hess: Obama in Bristol

So Obama will be (sorta) kicking off the general election campaign in Bristol VA, right down the road from JR's produce and just over the state line from me in Bristol TN. Why here? It's an interesting, quirky choice. They seem to have put this town hall togther at the last minute, renting VA high's gym only yesterday. The small number of tickets went fast (gone at 10 am this morning), so I didn't hear in time to get one, or even get on the waiting list. I'll try to get up early enough to see the circus outside tomorrow morning.

1 June 2008

Axel Beckert: How to get Network Manager working with ratpoison

Using GNOME Network Manager is a neat way to connect to wireless or virtual private networks from a laptop running Debian Lenny, Sid, Etch with Backports or any of the *buntu distributions. You can control everything from the system tray. But not all window managers have a system tray. And with some window managers it’s not obvious how to make them work with one of those lean third party trays and panels. Especially my favourite window manager for small displays as on the EeePC – ratpoison – insolently puts any panel or tray in the middle of the screen by default. It took me a moment to find out how to make ratpoison work with my favourite third party system tray trayer (which can handle transparency and is only a system tray, no taskbar). First we need to make ratpoison ignore the trayer on the one hand and and reserve space for it on the screen. Fiddling around with preconfigured frames didn’t work well and the following way is also more straight forward:
  1. trayer always has “panel” as window title, so adding the following line to your .ratpoisonrc makes ratpoison ignore trayer: 
    unmanage panel
  2. Now all windows overlap the trayer, so we need to configure the space for it. Trayer in the default configuration shows up at the bottom and has a height of 26 pixels, so we tell ratpoison to add a padding of 26 pixels at the bottom of the screen by adding the following line to the .ratpoisonrc: 
    set padding 0 0 0 26
Now we are confronted with the problem that these settings only apply to new windows, not ones which were already running when ratpoison starts. I usually start my X session using an .xinitrc or an .Xsession which calls the window manager using exec at the end. We can start the trayer later though by spawning a subshell in the background with a sleep at the beginning. Also the Network Manager applet (nm-applet) can be started that way. In my case the end of the .Xsession looks like this: 
( sleep 1; \
  trayer --align right --edge bottom --distance 0 \
	 --expand true \
	 --transparent true --alpha 128 --tint 0 \
	 --SetDockType true --SetPartialStrut true & 
  nm-applet & ) &
exec ratpoison
The result could look like this:
My EeePC desktop with ratpoison, trayer and two aterms
The other programs in the system tray are from right to left: nm-applet (GNOME Network Manager), Twitux (GTK Twitter Client), Audacious, Opera, Pidgin (formerly known as GAIM), Icedove (unbranded Mozilla Thunderbird). The clock on the bottom left is from the package osdclock. Oh, and although I’m fine with trayer: if anybody knows a possibility to control the GNOME Network Manager without the need for a system tray, I would be very happy if you could tell me. :-)

30 May 2008

Jonathan McDowell: DG834Gv3

I've been asked about the v3 DG834G in the past (mine is a v2) and always answered that I don't know anything about it. Earlier this week Ben asked me about it and let me have a login to his. He also took pictures, which are on the OpenWRT DG834G page.

Some comments, based on this:

I think it should be easy enough to get OpenWRT up and running on this (possibly someone has even done so already); someone just needs to hook up a serial console and do some prodding.

13 May 2008

Daniel Leidert: [DSA 1571-1] New openssl packages fix predictable random number generator

Ok, shit sometimes also happens to Debian users. Now I read a lot of FUD, flames, arrogant claims and much more bad things, including blaming of downstream in general. Well, Debian maintainers are NOT upstream authors. Maintainers often care about a lot more than just 1 package. Now I wonder if one can really expect, that maintainers know the source code of their packages as good as upstream authors do? Is this, what the user or the Debian project expects from a package maintainer? I agree, that this would be the ideal situation. But how realistic is it, if one maintains 10, 20 or more packages? Normally users report us issues. We take a look at the source, try to catch the issue, track it down and fix it. And IMHO in almost all cases this is enough and it lets us handle several packages. And maybe this is also, what happened here. The maintainer got a report, tracked it down and tried to fix it. It seems, he posted it to the openssl-dev list, which is to my reading considered for such questions, and got a positive response. And with fixing it, he made a horrible mistake. But apparently it also seems, that the question had been discussed earlier more than just once (I wish, the OpenSSL guys would have created the FAQ entry earlier). I don’t want to blame the maintainer for doing this mistake. We are humans. But do we need another instance, that (periodically) checks (probably only Debian-specific) patches/changes to security relevent software or do we need different requirements for maintainers of such software [1] or should we simply archive this under “Shit sometimes happens … even to Debian users”? [1] Consider gnupg which is currently almost unmaintained. It also has Debian specific patches applied and I wonder, which skills the new maintainer should or must(?) have (IIRC this question was raised in the linked threads too)?

3 May 2008

Neil McGovern: Election results

For info, as I've been asked by a couple of people, I've been elected as a city councillor for King's Hedges in Cambridge

Full results:
CandidateVotes
Neil McGovern (Liberal Democrat)762
Geri Bird (Labour)560
Cyril Weinman (Conservative)419
James Youd (Green)129
This gave me a majority of 198, a massive improvement of last year's majority of just 18. Huge thank you to everyone who supported me and helped during the campaign period, I'm really grateful.

30 April 2008

Pablo Lorenzzoni: Recording with Palm TX

I gave Brenda a Palm TX, so she can better organize her life. As a plus, it is wi-fi aware, so all sorts of interesting things can be done. Sadly, though, it doesn t ship with a microphone (I still wonder why it s large enough to hold an embedded mic, just as Palm smartphones have). Lately, Brenda was talking about recording some sessions or holding her thoughts in one of those tiny memo-recorders, and this promptly stroke me as another gadget to stuff her purse ... then I remembered having read that Palm TX have all that is required to hold a microphone, but the microphone I retrieved the Palm Multi-Connector pinout from Wikipedia and realized that all I had to do was attach an electret microphone to 16 and 17 pins and there we go. I ordered a charging cable just for the connector and here are the pictures I took of the building process: The tools and pieces I used: It s easy to disassemble the connector. Take a close look at the attaching plastic hooks there are four of them: two outside, near the pins, and two inside near the cable. Last two are harder to detach, but once you ve detached the first ones, just hold the two pieces of the connector and easily shear them: one side will detach first. The microphone have two terminals that already hold enough soldering tin. Beware to solder the blue cable (the one that goes with pin 16 AGND) to the marked terminal of the microphone, and the red one (the one that goes with pin 17 MIC_IN) to the unmarked one. (In the picture, my cables are all black, but the wires inside are red or blue . I could not get a good picture of the terminal markings). I have dissolded the charging cables from pins 1, 3, 5, and 8, but that is up to you (you can just cut the main cable and leave the pins untouched). Also, while soldering the microphone cables to the connector, beware of using as little tin as possible. It ll be even easier if you remove the pin from the connector it s easy to do if you have small pliers and careful fingers. Try first with one of the other pins that will not be used. Solder the red one to pin 17 and the blue one to pin 16. I cut a piece of an old earphone cushion to close the charging cable hole (and to protect the microphone). Here is the final result: Now, for the recording software, there s a nice free software that does that perfectly for PalmOS: Better Recorder. Now Brenda can record her mind!

13 April 2008

Clint Adams: The Legend of Bagger Baggs

One day the Stranger arrived. He was a tall and lanky teen, his face peppered with acne and sparse pubescent hair. He wore a wide-brimmed hat, a long coat, a scarf, and he was Strange. Some newcomers prefer to observe, to gauge the breadth and nuance of Social Custom, and to keep low profiles until they are comfortable enough to risk a misstep. This newcomer preferred to wield a bean bag, and to go door to door, knocking, introducing himself, and asking if there might be any nice conversation lurking inside in which he might join. Predictably, most people were horrified, frightened, and offended. They responded in a hostile fashion, and branded him Bean Bag Boy, or Bag Boy for short. A few others viewed him instead as a free spirit, a visionary, a unique character, and a Cool Guy. Perhaps they bought into the crap that society spews forth as part of its Campaign for Cognitive Dissonance. Perhaps they were just confused. Those that admired him branded him Doctor Who, a moniker of affection and respect. I will never understand this, even though I know which drugs they were on (Prozac, Zoloft, LSD, THC, psylocybin, and PCP, respectively). Bag Boy learned to keep mostly to those who appreciated his insane ramblings. Had he been motivated and competent, he probably could have been a minor cult leader. Instead, he fell out of public view for a while. When he returned, he had two younger companions: a boy and a girl. It became immediately obvious what to call them. The female, whose name, eerily enough, was Baggs, would be Bag Girl. Since Bag Boy already possessed that name, the male would have to be Little Bag. Little Bag was an enigma unto himself, and went on to have many adventures of his own. Once he called me a Zenmaster, so I will refrain from mentioning him for a long time. Bag Girl was no less a character. She detested being called by either her given name or her surname, and instead preferred to brandish an agglutinative designation of her own choosing: one part temporal adjective, one part finite act of performance. This contrasted delightfully with her appearance, which was not dissimilar to a three-foot-tall chinchilla. Most were content to call her by her chosen appellation, though some would add her real surname (to which she fumed bitterly), and one insisted on calling her by her given name, as a hostile act of hatred. Bag Girl's main hobby was a menagerie of characters that she explained were her multiple personalities. Unlike persons suffering from dissociative identity disorder, Bag Girl had full knowledge of her personalities and their doings. One of these personalities was a 90-year-old elf named Galiganda Dulin. Another was a man named Sayjon, who bore a suspicious resemblance to Pink Floyd's fascist alter ego from The Wall. In fact, Bag Girl had been profoundly affected by The Wall, although she had watched it while on LSD, so interpolation based on these data may be tainted.

12 April 2008

Lior Kaplan: A begining of an Israeli openoffice.org community ?


While issue #86811 is going to the right direction, I decided to try and use the momentum around it to unite people into an Israeli openoffice.org community. The first thing was to start and do a little triage of RTL/CTL related bugs. A few were confirmed as existing in 2.4.0 and should be moved from UNCONFIRMED to NEW, and get re-target. I also published a list of other bugs that need confirmation and links to the complete RTL/CTL lists so other people could continue my work. Maybe creating a meta issue to and get blocked by all other bugs will simplify the process ? I don’t know if that’s acceptable in the openoffice.org issuezilla. Although I think that is the case in Mozilla’s bugzilla. The confirmed bugs already got some more votes, which is a good beginning, but I’d like people to do more. Next items on my todo list are documentation, and translation of version 3.0. The documentation is mostly thickening the existing Hebrew wikibook about openoffice. I’m not quite sure were to start with translation of version 3.0, although I saw quite a few translations for other languages.

1 April 2008

Benjamin Mako Hill: Geek Shall Inherit the Earth Talk

I wrote an essay several years ago called The Geek Shall Inherit the Earth: My Story of Unlearning. It's buried on my website but still manages to attract a consistent stream of readers. It's essentially the story of how I became a geek, about school, ADD, and free software. It is by far the most personal thing I've ever published. That said, several people have told me that it's influenced them deeply -- changed their views, politics and attitudes in important ways. In December, my friend Marcell asked me to give a version of the talk as part of his G33koskop series. I was hesitant to give such a personal talk but I did it anyway. I've finally got around to cleaning up the recording and have posted it online. You can download and listen to the talk here in Ogg Vorbis or here in MP3).

26 March 2008

Nico Golde: streaming from your fileserver using mpd and icecast

My mobile music player is often missing the files I want to hear right now if I'm under way because my music collection is too big to fit on it.
Long time ago I used gnump3d which seems to be unmaintained in Debian for quite some time and then I often listened to some live streams, network connections are available nearly everywhere.
But I always wanted my own live stream with music I want to hear. There are several solutions out there for this task but they all require the creation of a playlist before the streaming starts.

Fortunately mpd provides the possibility to define different output targets and also one for streaming to a shoutcast or compatible server like icecast.

So after apt-get install mpd icecast2 (on a Debian box) you have to edit /etc/mpd.conf
There is not much to do, be sure to set music_directory to the place your music is located and the configure the output part.
Add the following to your mpd.conf and adapt some values:
  1. audio_output {
  2.         type "shout"
  3.         name "foobar stream"
  4.         port "8000"
  5.         host "localhost"
  6.         format  "44100:16:2"
  7.         mount "/stream.ogg"
  8.         password "somepass"
  9.         quality "2"
  10.         user "source"
  11. }

The type defines that this output will be streamed to a shoutcast target. The name will be displayed by the client you use to play your stream. 8000 is the port icecast2 will listen on host "localhost" (in this example the icecast2 server is on the same host). format specifies the audio format of the stream, the first number is the sample rate in Hz, the second number is the number of bits per sample and the last number defines the number of channels (2 is stereo here). Those values should work for most of you. mount specifies the path under which the stream is available later from the server root, in this example http://localhost:8000/stream.ogg.
quality defines the ogg encoding "quality". You can also specify the bitrate instead of it. The user and password values are used to authenticate mpd at the source input for icecast2.

There seems to be a bug in the 0.13 release (which is also in Debian) of mpd that prevents this from working. I don't know the details about this bug but adding
  1. audio_output {
  2.         type "alsa"
  3.         name "fake out"
  4.         driver "null"
  5. }
fixes it.

Make sure to set START_MPD=true in /etc/default/mpd to enable mpd.
That's all that needs to be done for mpd.

The next step is to edit /etc/icecast2/icecast.xml.
The default configuration nearly ready to use. Configure the authentication part:
  1. <authentication>
  2.       <source-password>somepass</source-password>
  3.       <admin-user>admin</admin-user>
  4.       <admin-password>someadminpass</admin-password>
  5. </authentication>

The source password is the one we specified in the mpd configuration. This is needed to authenticate mpd with icecast. source is the default user name icecast uses here. Additionally we define an admin-user that can be used to add users to icecast later because we want to protect the stream by a username and a password.
Then set
  1. <hostname>you.somehost.org</hostname>
.
This hostname is used to generate URLs in icecast that a user receives.

Because we want a very simple authentication for the stream we need to add some options for the mount (/stream.ogg):
  1. <mount>
  2.     <mount-name>/stream.ogg</mount-name>
  3.  
  4.     <max-listeners>1</max-listeners>
  5.     <authentication type="htpasswd">
  6.             <option name="filename" value="/etc/icecast2/htpasswd"/>
  7.             <option name="allow_duplicate_users" value="0"/>
  8.     </authentication>
  9.     <on-connect>/home/icecast/bin/stream-start</on-connect>
  10.     <on-disconnect>/home/icecast/bin/stream-stop</on-disconnect>
  11. </mount>

I think the xml tags are pretty much self-explanatory. Keep in mind to set the filename to a location the icecast daemon has access to, that's why I used /etc/icecast2. Then you can add users with htpasswd or using the web interface on port 8000 and add a user there.

The last thing to do is to adjust the <alias source="/" dest="/status.xsl"/> setting. Change status.xsl to auth.xsl people need to authenticate if they connect to the web interface before seeing the stream information.

Now you can login via ssh on your home server and use your favorite mpd client to configure playlists on the fly, I use ncmpc for this. Of course the authentication is not secure, people who sniff your traffic can see your login data.
One thing to keep in mind is to restart mpd after restarting icecast otherwise mpd will hang and not continue to stream, this seems to be a bug.

After routing through your NAT, you should be able to play your stream via http://you.somehost.org:8000/stream.ogg.

16 March 2008

John Goerzen: The Power of Love

A few years ago, Elvera Voth, a musician that grew up a few miles from here was back in the area. Her specialty is vocal music, and one evening, she led a hymn sing at our church.

During the event, she talked about how much music can touch the heart. Elvera remembered many years ago that a woman in the church was leaving for a service trip to India. She would be gone for 7 years straight. None of her family or friends would be able to see her during that entire time.

The day she was to depart, friends, family, and church members went with her to the Santa Fe station in Newton, KS. While waiting for her train, at some point, the group started singing. Elvera remembered that they sang So nimm denn meine H nde (Take thou my hand, O Father) and Ich bete an die Macht der Liebe (O Power of Love).

Elvera remembered they sang in the station, and the high, wood ceilings made it sound like the music filled the whole building. I can't think of a better goodbye than that.

Elvera remembered so many details about the event, but two things she didn't remember were who was leaving and what year this happened. So I remembered this story for awhile, but didn't really follow up on it.

Then last December, our neighbor Hildred called. Hildred and her sister live on their old family farm about a mile from us. They're some of the older members of our church, and I believe both of them have lived on that farm their entire lives. Hildred heard that I am gathering photos for a book about the centennial of our church, and she offered to bring some of them over. Knowing that it was cold and dark outside, the roads were snowy, and that Hildred drives a car at least 40 years old (because "Daddy said this is a good car"), I offered to drive to their place. "Oh no," she said, "it's no trouble. I like to get out. Besides, I haven't seen your house since it's been remodeled!" So she came over.

Hildred had stacks of amazing old photos from the church and the community. And she had a stack of photos and letters from India, where her aunt Augusta Schmidt was a nurse for 14 years. She was very proud of her aunt's service to the needy there. I started to put things together in my head and asked her if she remembered singing at the train station when Augusta left for India. "Oh sure," said Hildred, as if everyone knew about that.

So that's how it happened that the "historical moment" on Feb. 10 was about Augusta Schmidt. Each month during church, leading up to our centennial in October, we have a brief time where we highlight some interesting story from the church's past. I happened to mention this one at a historical committee meeting.

So, on that Sunday in February, someone got up and told everyone about Augusta's life. She was born in 1894 and graduated from college with a nursing degree in 1927. She heard about India at a conference, and quickly felt that God wanted her to serve there. She left for India in the fall of 1927, and would serve two 7-year terms there.

She wrote that India was a beautiful land, contrary to things she had heard. The city where she worked (I believe it was Bombay, but I'm not positive) had hallmarks of a wealthy city, such as educational institutions, hotels, etc. However, it saddened her greatly to learn that 80% of the people in the city were homeless and slept on the street. No doubt this played a role in her dedication to service there.

After we learned about Augusta, the choir sang So nimm denn meine H nde -- one of the songs that Augusta heard at the train station back in 1927. Imagine you were there, 81 years ago, seeing a friend off on a trip across continents, not to see her again for 7 years. Then the people there start singing a cappella...

So nimm denn meine H nde
und f hre mich
Bis an mein selig Ende
und ewiglich!
Ich kann allein nicht gehen,
nicht einen Schritt;
Wo du wirst gehn und stehen,
da nimm micht mit.		Take thou my hand, O Father,
and lead thou me,
until my journey endeth
eternally.
Alone I will not wander
one single day.
Be thou my true companion
and with me stay.


You probably weren't there that day in 1927, or even the day in February when the choir sang the song. I wasn't either because I had the flu that day. But I borrowed the cassette recording of that day's service, recorded using the best we have right now -- the wrong type of microphone pointed the wrong way, onto a cassette tape that has certainly been reused way more times than anybody knows.

Click here to listen.

The choir sang the first verse in German, verse 2 in English, and the whole church joined in on verse 3. I'm told there weren't many dry eyes in the church after that. After all, how could you keep a straight face singing "Take, then, my hand, O Father, and lead thou me, until my journey endeth eternally" right after the narrator read about Augusta's retirement and death, saying, "there, I was surrounded by friends, but most of all, by the sovereign love of God who had been with me my entire life."

Postscript

Remember Elvera Voth, from whom I first learned this story? In 1961, she moved to Alaska. Elvera taught at several universities; founded the Anchorage Opera; directed the Alaska Festival of Music, Anchorage Boys Choir, and Alaska Chamber Singers; and there is Elvera Voth Hall at the Alaska Center for the Performing Arts.

But her best work, I think, happened after she retired and moved back to Kansas in 1995. In 1998, Elvera founded the East Hill Singers, a choir composed mainly of minimum-security prison inmates, plus volunteers from the community. Elvera has inspired so many people, taught them that they have value, that they can succeed and make themselves better. One of the said:

Can you imagine what a standing ovation feels like after being told all your life that you are worthless?


And another inmate commented:

It made me feel like maybe I'm not just being punished. I mean, I am being punished for what I did. But being in this program made me think that I can also come out well, better a better person.


It all makes me think. What an amazing thing these two women with love in their hearts have done to make this planet a better place. Is it even possible to do that by using weapons that kill and power to frighten?

As Elvera puts it, "many of the men in prison will be back in the community soon. I'd rather have them as a neighbor with hope in their hearts than with hate in their eyes."

Steve Kemp: E.T. phone home

I've just finished reading "Don't You Have Time to Think", a collection of letters written to and from Richard P. Feynman. A birthday present from my wishlist. Previously I've read the collection of letters to/from Tolkien. (Several times actually. Very nice collection!) It suddenly struck me that over my lifetime I've probably written <200 letters to people. When I was young I had a couple of pen pals, and when I was entering university I was involved with a couple of play by mail games which involved writing random letters involving strategy & etc. Personal letters though? I've written very few, and I think they've mostly consisted of letters to my partner/partners of the time. (For example Megan went home for a few months at the end of a university year about two months after I initially met her. So there were many letters back and forth. Recently she spent two months working in the USA; counting eggs and avoiding alligators so again there was a flurry of written letters, maybe 20 total during the duration of her trip.) I guess that most of my (hand)written messages to people have been in the form of postcards whilst on holiday. A long time ago I offered to mail postcards to Debian developers. I know I sent at least two, and I received at least one back - but the thing I remember most was exchanging addresses with Amayita and getting into character set issues. Her emails, containing her Spanish address, were difficult to understand as my mutt/console refused to display the foreign character set properly. I can't recall whether she did ultimately receive a card from me, but I'm sure she'll remind me if she did. Anyway I have no resolution, intention, or expectation that I will suddenly start writing more physical mails to people. But I think it almost counts as something we do less of these days. The telephone and internet have become the norm. In some ways this is fantastic. In others it less good. On the left my handwriting is so bad that maybe this isn't necessarily a problem. ObQuote: E.T.

15 March 2008

Dirk Eddelbuettel: SFJAZZ Collective at CSO

Went to the CSO yesterday as a nice way to end a frantic workweek: first a beer or two after work, and then off for some Jazz. Yesterday's program was the SFJAZZ Collective: eight individuals, all noted in their own right, coming together for a few weeks each year to play as an ensemble. The program generally consists of two halfes: one with material by a modern composer -- Wayne Shorter is this year's pick -- and new original compositions by the band members. This was a special treat as Wayne Shorter's compositions from the 1960s, both from the bands he lead and as a member of the legendary Miles Davis Quintet, have always been some of my most favourite modern pieces. At the same time, it gave me a chance to finally see Joe Lovano on ts and Stefon Harris on vb. Other band members were equally impressive: Dave Douglas tp, Miguel Zenon as, Robin Eubanks tb, Renee Rosnes p, Matt Penman b, Eric Harland dr. Favourite new composition of the night: 'Angel's Shares' by Penman. All in all a nice evening out to cap off a busy week.

8 March 2008

Clint Adams: The Legend of Bagger Baggs

One day the Stranger arrived. He was a tall and lanky teen, his face peppered with acne and sparse pubescent hair. He wore a wide-brimmed hat, a long coat, a scarf, and he was Strange. Some newcomers prefer to observe, to gauge the breadth and nuance of Social Custom, and to keep low profiles until they are comfortable enough to risk a misstep. This newcomer preferred to wield a bean bag, and to go door to door, knocking, introducing himself, and asking if there might be any nice conversation lurking inside in which he might join. Predictably, most people were horrified, frightened, and offended. They responded in a hostile fashion, and branded him Bean Bag Boy, or Bag Boy for short. A few others viewed him instead as a free spirit, a visionary, a unique character, and a Cool Guy. Perhaps they bought into the crap that society spews forth as part of its Campaign for Cognitive Dissonance. Perhaps they were just confused. Those that admired him branded him Doctor Who, a moniker of affection and respect. I will never understand this, even though I know which drugs they were on (Prozac, Zoloft, LSD, THC, psylocybin, and PCP, respectively). Bag Boy learned to keep mostly to those who appreciated his insane ramblings. Had he been motivated and competent, he probably could have been a minor cult leader. Instead, he fell out of public view for a while. When he returned, he had two younger companions: a boy and a girl. It became immediately obvious what to call them. The female, whose name, eerily enough, was Baggs, would be Bag Girl. Since Bag Boy already possessed that name, the male would have to be Little Bag. Little Bag was an enigma unto himself, and went on to have many adventures of his own. Once he called me a Zenmaster, so I will refrain from mentioning him for a long time. Bag Girl was no less a character. She detested being called by either her given name or her surname, and instead preferred to brandish an agglutinative designation of her own choosing: one part temporal adjective, one part finite act of performance. This contrasted delightfully with her appearance, which was not dissimilar to a three-foot-tall chinchilla. Most were content to call her by her chosen appellation, though some would add her real surname (to which she fumed bitterly), and one insisted on calling her by her given name, as a hostile act of hatred. Bag Girl's main hobby was a menagerie of characters that she explained were her multiple personalities. Unlike persons suffering from dissociative identity disorder, Bag Girl had full knowledge of her personalities and their doings. One of these personalities was a 90-year-old elf named Galiganda Dulin. Another was a man named Sayjon, who bore a suspicious resemblance to Pink Floyd's fascist alter ego from The Wall. In fact, Bag Girl had been profoundly affected by The Wall, although she had watched it while on LSD, so interpolation based on these data may be tainted.

Next.

Previous.