The unofficial rc bug tracker currently knows about the following bugs:

In Total:	371
Affecting Squeeze:	281
Squeeze only:	66
Remaining to be fixed in Squeeze:	215

Of these 215 bugs, the following tags are set:

Pending in Squeeze:	14
Patched in Squeeze:	40
Duplicates in Squeeze:	23
Contrib or non-free in Squeeze:	7
Claimed in Squeeze:	1
Delayed in Squeeze:	3
Can fixed in a security Update:	12
Otherwise fixed in Squeeze:	14

Ignoring all the above (multiple tags possible), 132 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 235 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

Hello Planet Debian, Since everyone seems to like sharing and hearing about travel plans, I took the initiative of creating a Debian group on Tripit*. To join, you need a @debian.org email and click on: http://www.tripit.com/group/join/debian. Cheers *I realize Tripit is not free (as in freedom), but it s not like there are comparable free alternatives.

As I already wrote too many times, I've started to use Gnus 6 months ago, and never looked back. At that time, I joined the ding mailing list in order to ask some dumb questions and, once, send a patch. There were very low activity on that list. Until Lars, the original Gnus author, came back. Three weeks ago, he started to wrote a new wash function to render HTML mails properly, with pictures. It's named gnus-html', and is (for now) based on w3m (but not on emacs-w3m, which is not part of Emacs). Last week, I've sent a set of patches to replace the usage of curl by the standard url-retrieve' function to fetch images, plus various enhancement. It seems that my work was good enough that Lars offered me write access to the git repository. I can therefore mess up the Gnus entirely. Hurrah! I've continued to work on gnus-html' and recently merged a set of patches improving image retrieval (which is now done in parallel) and starting to use url-cache' to cache image for a defined period of time. Of course, I found a bunch of tiny bug and special case while reading RSS feeds and various HTML mails, and fixed them all along. Lars added a libxml binding for Emacs 24, providing the html-parse-string' function. His future plan seems to be the abandon of w3m in favor of a native parsing via libxml to render HTML, and therefore, HTML mails. I should also mention the new nnimap' back-end; Gnus has been designed to read NNTP newsgroups, and not mails. Consequently, it had a very poor behaviour when used with a back-end such has IMAP. Lars took a week to rewrite entirely our dear nnimap' back-end, and make it act in a more expected way. There's still a bunch of bug and code to write, but it is at least usable and seems faster than the old code. Last thing I did was to rewrite the icon support in the group buffer. When I started to use Gnus, I was curious and tried to configure this. I never managed to make it work, and now know and understand why it was broken. So I ended rewriting entirely, and now it works. I never though I would understand, fix, and commit this code when reading the Gnus documentation this winter, but hell yeah, I did. Now I've still several little project to improve things in all sort of area. We'll see what I'll do next. :-)

So I suspect folks have received a message from a professor when on sabbatical and it usually goes something like this:

Thank you for your message. This is an automated reply.
I am on sabbatical leave and unable to reply to my email. For all matters concerning the __________________________ Department of __________ Contact ____________ .
Thank you for your patience,
Professor

I have been thinking of writing one myself, being I am also on sabbatical but thought I might be a bit more honest and forthcoming. This is what I have so far come up with:

Thank you for your message. This is an automated reply. I am on sabbatical leave and while I am able to reply to my email, in fact, I have a heck of a lot more time compared to when I teach, it is customary to write a message like this and claim otherwise. However, being on leave does relieve you of (most) all department responsibilities. And given the grueling pace of academic jobs and the contemporary burden of email avalanches we all suffer from, I am taking the license (the sabbatical license) to say: 1) I may never get back to you 2) I may but it may take longer than usual 3) honestly I suffer from MEAD (Massive Email Anxiety Disorder) and hate it when people don t respond to me, so I will likely get back to you but don t you get MEAD if I fail to do so. Thanks for your patience,
Gabriella Coleman
On leave 2010-2011

So I suspect folks have received a message from a professor when on sabbatical and it usually goes something like this:

Thank you for your message. This is an automated reply.
I am on sabbatical leave and unable to reply to my email. For all matters concerning the __________________________ Department of __________ Contact ____________ .
Thank you for your patience,
Professor

I have been thinking of writing one myself, being I am also on sabbatical but thought I might be a bit more honest and forthcoming. This is what I have so far come up with:

Thank you for your message. This is an automated reply. I am on sabbatical leave and while I am able to reply to my email, in fact, I have a heck of a lot more time compared to when I teach, it is customary to write a message like this and claim otherwise. However, being on leave does relieve you of (most) all department responsibilities. And given the grueling pace of academic jobs and the contemporary burden of email avalanches we all suffer from, I am taking the license (the sabbatical license) to say: 1) I may never get back to you 2) I may but it may take longer than usual 3) honestly I suffer from MEAD (Massive Email Anxiety Disorder) and hate it when people don t respond to me, so I will likely get back to you but don t you get MEAD if I fail to do so. Thanks for your patience,
Gabriella Coleman
On leave 2010-2011

I m putting together a list of email server features that you should look for. I m thinking:

Transport Layer Security support -

this successor to SSL means that your connection will be encrypted. You want this so that your email and your login details aren t being intercepted. Unless you trust everything between you and your mailserver completely, this is pretty much a minimum requirement.

A good login method, probably either CRAM-MD5 or APOP -

you want this so that you aren t simply sending your password over the network. Your connection might be encrypted, but this is a belt-and-braces approach.

IMAP rather than POP -

Internet Message Access Protocol usually offers many more features than the antiquated Post Office Protocol. POP usually shoves all your email through your virtual letterbox, junk or not, and dumps it on your computer. IMAP is more like telling a postman which email to deliver where and when. You can create folders on the server (as well as on your local computer), you can delete junk mail before you download its bodies and it s easier to access your email from multiple locations like your desktop and your phone. QMUL has a longer comparison but nearly everyone would be better off with IMAP.

Sieve configuration -

Now I m getting really optimistic. A Sieve file is an instruction file of standardised mail filtering rules. They re a little harder to write, but should be much easier to move between Sieve-compatible mailservers.

So do you agree with those as desirable features, and would you add more?

The Debian policy dictates that package upgrades must take care of preserving user changes to configuration files. This article will explain you how most packages ensure this. This is important knowledge for anyone who has to manage upgrades: knowing how it works lets you easily automate most of it and deal correctly with the fallout. How dpkg manages configuration files Most packages rely on dpkg to properly install configuration files. Dpkg keeps a checksum of the last installed version of configuration file. When it must install a new version, it calculates the checksum of the currently installed file and if it doesn t match anymore, it knows that the user has edited the file. In that case, instead of overwriting the configuration file, it asks the user what to do. You probably already have seen those questions, they look like this:

Configuration file  /etc/bash.bashrc'
 ==> Modified (by you or by a script) since installation.
 ==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
 The default action is to keep your current version.
*** bash.bashrc (Y/I/N/O/D/Z) [default=N] ?

In this specific example, if you answer Y or I (for yes or install ), dpkg will install the new version of /etc/bash.bashrc but it will also backup the current version in /etc/bash.bashrc.dpkg-old. If you answer N or O (for no or old ), dpkg will install the new version in /etc/bash.bashrc.dpkg-dist and /etc/bash.bashrc is left untouched. The two other answers allow you to examine the differences before taking a decision. Note that if you choose to start a shell, the new version is currently available as /etc/bash.bashrc.dpkg-new (and since Squeeze there are convenient environment variables $DPKG_CONFFILE_OLD and $DPKG_CONFFILE_NEW in case you want to create a custom review script). All configurations files managed by dpkg are called conffiles because that s the name of the field where they are recorded in the dpkg database. You can display the list of conffiles for any package:

$ dpkg --status bash
[...]
Conffiles:
 /etc/skel/.profile ecb6d3479ac3823f1da7f314d871989b
 /etc/skel/.bashrc 2afdd6c53990f2387a7ef9989af0bc07
 /etc/skel/.bash_logout 22bfb8c1dd94b5f3813a2b25da67463f
 /etc/bash.bashrc 5b3c3bc73d236e4e1b6f9b6c1ed5964e
[...]

The command dpkg-query --showformat='$ Conffiles \n' --show bash can give you the same information if you need to retrieve only that field. The 32 characters after the filename are the MD5 checksum of the original configuration file provided by the package. Avoiding the conffile prompt Every time that dpkg must install a new conffile that you have modified (and a removed file is only a particular case of a modified file in dpkg s eyes), it will stop the upgrade and wait your answer. This can be particularly annoying for major upgrades. That s why you can give predefined answers to dpkg with the help of multiple --force-conf* options:

• --force-confold: do not modify the current configuration file, the new version is installed with a .dpkg-dist suffix. With this option alone, even configuration files that you have not modified are left untouched. You need to combine it with --force-confdef to let dpkg overwrite configuration files that you have not modified.
• --force-confnew: always install the new version of the configuration file, the current version is kept in a file with the .dpkg-old suffix.
• --force-confdef: ask dpkg to decide alone when it can and prompt otherwise. This is the default behavior of dpkg and this option is mainly useful in combination with --force-confold.
• --force-confmiss: ask dpkg to install the configuration file if it s currently missing (for example because you have removed the file by mistake).

If you use Apt, you can pass options to dpkg with a command-line like this:

$ apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade

You can also make those options permanent by creating /etc/apt/apt.conf.d/local:

Dpkg::Options  
   "--force-confdef";
   "--force-confold";
 

Bringing up the conffile prompt at any time The conffile prompt is only displayed when dpkg detects that the package provides an new version of the conffile. Thus reinstalling the same package will not bring up the prompt. But you can instruct dpkg to ask nevertheless with the --force-confask option. This is a new feature in Debian Squeeze. It will only ask for files that are locally modified.

If you want to read more articles like this one, click here to subscribe to my free newsletter. You can also follow me on Identi.ca, Twitter and Facebook.

4 comments Support my work

It might seem odd that someone who has come from a research organisation to one which is for education and research should ask a question such as the title! Some explanations are in order. Mathematics is one of the oldest intellectual activities of mankind, so it is not surprising that the amount of mathematics that has already been done is enormous as compared with almost any other discipline. One consequence (that has not escaped notice!) is that people who prove theorems are often much older today than in earlier years. Another important consequence is that for anyone active in mathematical research today, most mathematical learning has happened outside the classroom. Moreover, such non-classroom learning is far from linear. Monuments of mathematical beauty are built on wooden stilts; the latter are only turned into firm pillars when one finally writes down the fruits of one s research. The above paragraph is nothing new to working mathematicians, but each incoming generation must learn it anew. This is because courses and books in mathematics are often structured in a linear way. There are clearly defined prerequisites and everything new is either defined or proved in strict deductive order. This serves the important purpose that each fresh batch of students verifies the grand edifice . However, it also leaves many a student with the false impression that this is how mathematics is done. Even worse, it may leave the impression that classroom and textbook learning is what mathematics is about. One should certainly strive to improve one s classroom skills, to write more readable textbooks and to design better courses. However, one should never lose sight of the wide open spaces where many new mathematicial objects are built.

The week before DebConf has been traditionally been DebCamp. This has been advertised as a time for core teams to come early to work on their projects together, and this post will talk more about what that means.At DebCamp, there is not much infrastructure set up yet. We have (unfurnished) hacklabs, accommodations, and usually food from the very beginning. We'll have Internet access, but the network and power distribution isn't set up yet. People find what they can and make their own space to work. The DebConf team works on setting up hacklabs starting on day 0 or 1, and the DebCampers serve as the test subjects to make sure that everything works.There intentionally aren't many scheduled activities during DebCamp. The organizers have too much else to do, and events aren't the main purpose of DebCamp. If some people wanted a place to meet, they could probably find a place, though. Some years, there have been one or two workshop type events on the DebCamp schedule.DebCamp has frequently been explained by "Development teams like debian-installer and debian-edu also have the possibility of meeting beforehand for undisturbed collaborative work. ... Interested teams should contact the organizers upfront to make special arrangements." (From the DC10 website) Also included in DebCamp are the DebConf organizers - we desperately need that time to pull organizers from over the world together to get us on the same page locally. Furthermore, anyone without a workplan can attend DebCamp by paying their actual costs.However, saying that DebCamp is limited to these groups of people doesn't reflect reality: Anyone can attend. Thus the DebCamp description doesn't necessarily reflect the actual limits for attending. This has the appearance of resulting in (and some people believe it has) a DebCamp which is biased towards those who well-connected with organizers, since they know that basically anyone can go and get a free extended holiday with Debian people. In fact, getting anyone to review the submitted workplans has met resistance in the last few years.For DebConf10, we did manage to reach agreement to filter out possible tourist-like people, but it was a similar (or only slightly more strict) criteria than DebConf itself. This was done very late, too late to be fair to force adjustments in travel plans of too many people. The difference between the DebCamp listed criteria and who has gotten sponsored for DebCamp in the past caused contention among some new organizers this year. Why didn't they know that they would have qualified for DebCamp past years? The moral of the story is that we need to be more clear on the purpose of DebCamp and make the actual qualifications for attending concrete and well-known so that it remains fair.Of course, it's also true that non-core developers and other interested people to attending DebCamp is a good thing, since it is a strong motivator to get more involved in Debian. Local people are encouraged to attend and learn/hack/volunteer. DebCamp isn't meant to be exclusive, just to reflect the realities of a limited budget.
DebCamp is a very important part of DebConf, both for Debian development purposes and for DebConf set-up purposes. However, since it is a week of limited attendance with mostly the same people attending year after year, we need to ensure that it remains transparent to the rest of Debian.Tags: debconf

There seems to be increasing demand for changing default theme in phpMyAdmin. Well the obvious question is which one to choose :-). There are currently 3 themes compatible with 3.3 branch, what is still far away from current master, however I don't see that they would mean big improvement over current ones. Maybe we should just make some contest for new theme? Anyway if we decided to change the theme, we will still get complains from users that we did the change. At least this is what I remember from last attempt to do so several years ago :-).

In the process of studying for my PhD general examinations this year, I ended up writing summaries about 200 academic books and articles. AcaWiki is a wiki designed to host summaries of academic articles so it seemed like a great place to host these things. Over the last few months, I've uploaded all these summaries. Since I've finished, I've continued to add summaries of other articles as I read them. My summaries tend to be rough. I write them, run them through a spellchecker, and then post them. I don't even reread them before publishing. I hope to improve them as I reread them over time. Of course, because I've uploaded them to wiki, I hope others will add to and improve the summaries as well. AcaWiki uses Semantic Mediawiki and provides nice platform for publishing, editing, and collaboration. Although there are still ways in which the platform can be better, what is needed now is, quite simply, more contributors. I am sad to see that my summaries make up a big chunk of all summaries on the site. So if you are a student, an academic, or anyone else who writes or has written summaries of articles or books or if you might want to do so, you should consider contributing your summaries, in whatever form, to AcaWiki. I've done a little work to help integrate AcaWiki and Zotero which might make things easier. Doctoral students reading for qualifying or general examinations in particular should should consider taking notes and studying with AcaWiki. From the student's perspective, writing summaries can be one of the best way to reflect on and learn a literature. In the process, one can create a great resource for the rest of the world. If a single doctoral student from each of twenty diverse fields of study published summaries of the 200 key articles in their area, AcaWiki would have the critical core of what is most relevant in academia. Help us build it!

Given the impending deprecation of vservers, I've decided to make the switch to KVM on my laptop. Although lxc is a closer approximation to vservers, I decided to go with KVM due to it's support in Virtual Machine Manager. My first step was to confirm that my CPU would support kvm:

egrep -o "svm vmx" /proc/cpuinfo

If that command outputs either svm or vmx (depending on whether you have Intel or AMD hardware) then your CPU supports virtualization. I'm working on a host machine called chicken, which has a logical volume called vg_chicken0. All vservers on chicken operate on a root filesystem that is backed by their own logical volume. In this post, I'll describe the steps to convert the vserver hobo (which operates on a filesystem mounted on the host in /var/lib/vservers/hobo and is backed by the logical volume called vg_chicken0-hobo_root). Both chicken and hobo are running debian squeeze. vservers don't have a kernel installed or grub. KVM virtual servers need both. I was hoping I could simply enter the vserver, install both a kernal and grub and be ready to go. However, grub installation will fail miserably because grub can't figure out how to install on the underlying disk (which is hidden from the vserver). Next, I tried launching a kvm instance, passing a debirf generated ISO with the -c (cdrom) option. However, grub recognized that it was being installed onto a device that did not have a partition table (the logical volume was directly formatted with a file system). So, since I had disk space to spare, I created a new logical volume:

lvcreate --size 5GB --name hobo_root_new vg_chicken0

I then added a gpt partition table (why not prepare for the coming 2TB disks?) and created two partitions. One partition for grub2 and one for everything else:

parted /dev/mapper/vg_chicken0-hobo_root_new mklabel gpt
parted /dev/mapper/vg_chicken0-hobo_root_new unit s mkpart biosboot 2048 4095 
parted /dev/mapper/vg_chicken0-hobo_root_new set 1 bios_grub on 
parted /dev/mapper/vg_chicken0-hobo_root_new unit s mkpart primary 4096

When prompted for the end of the last partition, choose: -1 and accept the adjustment. I had to eyeball cat /proc/partitions to figure out which dm device was the second partition (dm-19). I then created a file system:

mkfs -t ext3 /dev/dm-19

Mounted it:

mount /dev/dm-19 /mnt

And rsync'ed the data:

rsync -a /var/lib/vservers/hobo/ /mnt/

With the data in place, I chroot'ed and installed the packages I needed. When prompted, I chose not to install grub to the disk, because I wanted to wait until I had an environment in which the proper disk would be available to grub as it will when the virtual server boots (see below):

chroot /mnt
mount /proc
aptitude install linux-image-2.6-amd64 grub2
umount /proc
exit

Then, I cleaned up:

umount /mnt
umount /var/lib/vservers/hobo
lvremove vg_chicken0/hobo_root
lvrename vg_chicken0/hobo_root_new hobo_root
dmsetup remove /dev/mapper/vg_chicken0-hobo_root_newp1
dmsetup remove /dev/mapper/vg_chicken0-hobo_root_newp2
kpartx -d /dev/mapper/vg_chicken0-hobo_root

And I removed it from /etc/fstab. Next, I created a new kvm virtual server, using the disk /dev/mapper/vg_chicken0-hobo_root and passing a debirf cd image with -c: virt-install --name hobo --ram 512 --disk /dev/mapper/vgchicken0-hoboroot -c /usr/local/share/debian/ISOs/debirf-rescuesqueeze2.6.32-5-vserver-amd64.iso After logging in, I installed grub2 (aptitude update; aptitude install grub2) and then I installed grub:

mount /dev/sda2 /mnt/
grub-install --no-floppy --root-directory=/mnt /dev/sda

After running grub-install, edit /mnt/boot/grub/device.map so it reads:

(hd0) /dev/sda

Then, rerun grub-install command. I tried generating the grub.cfg file, but got an error message indicating that grub-probe would not detect the device providing / (because I was running on a ram file system from debirf). I added the following to /mnt/etc/fstab:

/dev/sda2  /     ext3 errors=remount-ro 0 1
proc       /proc proc defaults          0 0

And then re-generate the initrd image:

chroot /mnt
mount /proc
update-initramfs -u

So, I rebooted the virtual machine by typing:

exit
reboot

This dropped me into a grub shell. I manually typed:

root (hd0,gpt2)
linux /vmlinuz root=/dev/sda2 ro
initrd /initrd.img
boot

Once booted, I logged in a completed the task with:

update-grub

Trolling and refueling the tank of spectacle.

Trolling and refueling the tank of spectacle.

I ve been sitting on this one since more than a month. I ve contacted upstream on the 19.08.2010 and the Debian maintainer on the 02.09.2010. No reaction from them till today, and no, my spamfilter does not eat mail ;) Still, I won t tell you the name of the software (but you could easily guess or check ) So let s put the grey hat on and begin ;) Foreword: when I write spam-filter, I mean some DNSBL/SPF/blah filter, not SpamAssassin, crm114 or other content-based filters. common spam-filters There are plenty of spam-filters out there which work after the following schema:

for check in checks:
    if check(mail) == BAD:
        reject(mail)
        break

And the checks often look like this:

def check(mail):
    errors = False
    result = some_magic(mail)
    if not errors: return result
    else: return GOOD

Here some_magic is a function that do the actual checks (DNSBL lookups etc) and which stores possible happened errors in errors. If an error occurred, it s safer to say the mail was good (or at least not bad) than bad. the problem This looks like a sane approach on the first sight: iterate over all checks and execute them until a mail is found to be spam (and the corresponding check did not end up in an error (imagine some weird DNS error for DNSBL or SPF checks here)). But then the author realizes that the errors might be global , like with DNS: when the first check notices that it can t resolve anything (ie. it ran into a DNS timeout three times in a row), the second check (which also utilizes DNS queries) will most probably result in an error too. After this he adds a global counter for DNS errors and skips all the checks that use DNS if this counter is >=3. Great idea , you say, saving resources is good . Bad idea , I say The reason is simple: DNSError != DNSError. Why? The local resolver might be broken, then every DNS query will end up with an error and DNS-based checks should be really disabled. The first three (out of eg. ten) DNSBLs might be down, but that s not a reason to skip the other seven and the SPF check. Etc Now let s assume all configured DNSBLs are working properly, so is the local resolver and the checks are:

checks = [check_HELO, check_SPF, check_DNSBL]

How could one attack this filter? the attack Set up the following zone

spam.example.com IN NS ns1.example.com
spam.example.com IN NS ns2.example.com
spam.example.com IN NS ns3.example.com
spam2.example.com IN MX mx1.spam.example.com
spam2.example.com IN MX mx2.spam.example.com
spam2.example.com IN MX mx3.spam.example.com
spam2.example.com IN MX mx4.spam.example.com
ns1.example.com IN A 10.1.1.1
ns2.example.com IN A 10.2.2.2
ns3.example.com IN A 10.3.3.3

and greet the to-be-spammed-MTA with EHLO client1.spam.example.com
What happens? The spam-filter tries to resolve client1.spam.example.com in check_HELO to check whether the hostname matches the IP-address the connection is coming from, fails three times (there are no reachable DNS servers in 10.0.0.0/8) and continues with the next two checks, but these are skipped because of previous DNS errors. As no checks could identify the mail as being spam, the mail is delivered to the users mailbox. With some creativity this can also be used in SPF records (via spam2.example.com), sender-domains etc. conclusion If you want to save resources by skipping DNS-based checks after another (DNS-based) check failed don t! Think whether this is really the same error you are seeing Additionally this can be used as a sort of DoS against the not said software: according to the logs each of my tries needed between 30 and 36 seconds (!) to complete imagine some hundred simultaneous requests the end You think I did something wrong with that post? Throw the first stone then, I don t care.

There are corners of the Internest where foolish people congregate, and invent stories. These foolish stories are then read as gospel by trusting people, and reposted, until the original made-up source is concealed from view. As an attempt to stem this flow of disinformation, here are some commonly held but incorrect beliefs about the Mono framework, and an explanation of the reality of the situation, as far as I understand it. The next Mono version is co-developed with Microsoft There is a grain of truth behind this one, but it s a gross mischaracterisation. Mono 2.8, when it ships, will bundle, for convenience, a number of Free Software libraries, which are released by Microsoft under a license considered Free Software by the Free Software Foundation, the Ms-PL. These are:

• System.Web.Mvc and System.Web.Mvc2: ASP.NET MVC, a library for writing ASP.NET web pages with a model-view-controller design, similar to Rails for Ruby. This is not news System.Web.Mvc has been bundled in Mono since Mono 2.4.2 (June 25th 2009). System.Web.Mvc2 has been bundled in Mono since Mono 2.6.7 (July 14th 2010).
• System.Numerics: Mono re-uses Microsoft s implementation of BigInteger.cs from the Dynamic Language Runtime (see below). This is indeed new to Mono 2.8, as it is part of .NET 4.0 (Mono 2.8 targets .NET 4.0 compatibility by default).
• System.Data.Services.Client: The OData SDK client library. This is indeed new to Mono 2.8.
• System.ComponentModel.Composition: The Managed Extensibility Framework, a library for writing and using plugins. This is similar in scope to the existing Mono.Addins project. This is indeed new to Mono 2.8, although it was added to Mono Trunk in 2009.
• System.Web.Extensions: Microsoft Ajax, a library for using Ajax inside ASP.NET projects. This is not news MicrosoftAjaxLibrary has been bundled in Mono since Mono 1.2.6 (11th December 2007).
• Microsoft.Scripting.Core and Microsoft.Dynamic: The Dynamic Language Runtime is a framework permitting implementation of dynamic languages (such as Python or Ruby) on top of the core .NET runtime. It is used for IronPython and IronRuby, amongst others. The DLR has very recently changed license from Ms-PL to Apache 2.0, but the version bundled in Mono is still under the older license. This is not news the DLR has been bundled in Mono since Mono 2.6 (14th December 2009).

So, to summarise, there are five Free Software libraries written by Microsoft under the Ms-PL included in Mono 2.8 but only two of those five are new, and none of them were co-developed in any meaningful sense. Mono development is dead There have been reports that Mono development has ended, on the basis that no commits have been made to Novell s Subversion server for a few weeks. However, these reports miss one minor detail Mono has moved to Github.com. There were 35 commits from 9 different people to the main mono.git repository (of dozens of repositories under the main Mono project) in the last 2 days, at time of writing far from dead. Mono lacks features found in Microsoft.NET Mono lacks libraries found in Microsoft.NET, such as the Windows Presentation Framework GUI toolkit. In terms of features, i.e. things implemented at a compiler or runtime level, Mono is typically more advanced. This is helped in no small part by Mono s Free Software development model, allowing experimentation and what if changes to the core runtime which a sluggish corporate behemoth like Microsoft cannot accommodate. To give three real-world examples, Mono allows embedding of its compiler as a service, and provides a REPL shell this is a planned feature for .NET 5.0, but has been available for years in Mono; Mono.Simd provides a number of data structures which will run on any version of Mono or Microsoft.NET, but will use optimized CPU extensions like SSE when run on a sufficiently new version of Mono, on an appropriate architecture as far as I m aware, there is nothing like this available or planned for Microsoft.NET. Mono is able to produce fully compiled, static executables which do not need to JIT anything at runtime this is used for iPhone compilation, for example, where JITters are not permitted. There is no comparable feature in Microsoft.NET. Clearly, Microsoft.NET can only be thought of as more featureful if one defines features in terms of does it have lots of libraries? in terms of functionality, Mono is ahead. Mono can sneak onto your system without your knowledge If you don t have the mono-runtime package installed, you can t run Mono apps. It is possible to install some Mono apps alongside the awful-yet-popular mononono equivs package, since the popular equivs script fails to place Conflicts on the correct packages (F-Spot will be blocked, Tomboy will not). No package in Debian or Ubuntu embeds its own copy of the Mono runtime, and we have no plans to make any changes to packaging which would allow execution of any C# application without mono-runtime installed. If one is using a different OS, then things may be different e.g. The Sims 3 for Mac & PC uses embedded Mono, which you wouldn t know about without looking. Canonical are pursuing a pro-Mono agenda, and are responsible for it being pushed in Debian Mono development has been happening in Debian for longer than Canonical has existed the first upload was made in April 2002. Ubuntu is made primarily from software already available in Debian deemed of sufficient quality, and when F-Spot and Tomboy became parts of the default Ubuntu desktop system in 2006, both pieces of software were already available in Debian and deemed of sufficient quality. Nobody working on Mono in Debian is paid by Canonical actually, that s not entirely true, three packages related to accessibility are officially maintained by someone who was hired by Canonical after doing the initial packaging work when he worked for Novell. But the Mono runtime itself, Canonical have no influence over its direction in Debian. As for a pro-Mono agenda , they ve always taken an extremely pragmatic approach to language choice, never showing any real preference for one language or another when it comes to app selection. They don t exhibit any overt anti-Mono policies, which is not the same thing. The names of people contributing to Mono in Debian are not secret check the pkg-mono team page on Alioth. The System.Windows.Forms namespace is protected by Microsoft patents The truth is, nobody knows for sure if SWF, or any other part of Mono, or any other framework such as Vala or Python, is covered by Microsoft patents. The way the US patent system is contrived, it is actively dangerous to check whether something contains any patents when you write it, as you are liable for triple damages should it later emerge that there WAS a patent, even if your searching missed the fact. You cannot patent an API or namespace only a specific implementation of a software concept, in those countries where software patents are permitted. There has never been any evidence shown that Mono s implementation of SWF, or indeed any part of Mono, infringes any Microsoft-held patents, because if that were the case, then the code would be rewritten to avoid the issue much like the approach taken by Linux kernel developers when a patent becomes apparent. The belief within the Mono community is that the core parts of Mono as defined in ECMA334/335 are safe (they are covered by the Microsoft Community Promise patent grant); any of the Ms-PL libraries mentioned above is definitely safe (Ms-PL includes an explicit patent grant); and the rest of the package is likely safe too (on the basis that it is a named component of the Open Innovation Network s list of protected software and on the basis that there s unlikely to be anything patentable in one of many implementations of basic ideas like database connectors). Nobody knows for sure, because that s how the system works. But, again, nobody knows for sure that Microsoft patents don t apply to other frameworks such as Python there is simply a belief and an assumption that they do not. MonoDevelop contributors removed GPL code from MonoDevelop, in an attack on the GPL This is somewhat disingenuous, given MonoDevelop is LGPL. The MonoDevelop team excised the remaining GPL code (and there wasn t much of it) in order to grant greater Freedom to developers. Previously, the entire MonoDevelop IDE was a GPL combination, meaning any add-ins for the IDE also needed to be GPL, regardless of developer choice. Now, any developer can write an add-in for MonoDevelop, using the license of their choice, whether another Free license like the Mozilla Public License, or a proprietary closed-source add-in. They are still welcome to produce GPL add-ins, if they want to, as well. Mono won t run random Microsoft.NET apps anyway, so isn t really cross-platform Actually, this one is often true. When developers write apps for Windows primarily, they rarely take the time to think is this the correct way to do it? and will often plough on with an assumption about the Windows way of doing things. It might be simple things like filesystem assumptions (assuming a case-insensitive filesystem, or assuming a backslash is used to separate directories, not a forward slash). It might be more involved, such as using P/Invokes into Windows-specific C libraries, when a more cross-platform alternative is possible. So, often, random applications for Microsoft.NET won t run on Mono. The reverse is also true F-Spot or GNOME Do are fairly heavily tied to Linux (or to UNIX-like OSes with X11, at any rate), through the libraries they invoke being fairly platform-specific. You can write platform-specific Java, with one quick piece of JNI, too. It should be noted, however, that Mono makes the chance of .NET applications being ported to Linux (and/or Mac) much more likely, since even in the worst case scenario, a company only needs to fix a portion of their source to make it cross-platform. The Mono team have a tool called MoMA, which will scan an application and its libraries, and give you detailed reports on the app s portability. This info is used at both ends by app vendors who want to become more portable, and by the Mono team who want to fill in the most frequently encountered blanks. And, it should be stressed, writing cross-platform apps is entirely possible if one desires it e.g. the IRC client Smuxi is pure cross-platform C#, and the executables compiled on Mono on Linux will run fine on Microsoft.NET on Windows. Portability in this direction is important too consider how many people have been introduced to Free Software thanks to availability of Free apps on Windows like OpenOffice.org, Firefox, Pidgin or GIMP. You can download Tomboy for Windows, and work is ongoing on fixing Banshee portability issues (which are mostly caused by gStreamer). Mono on Android is a terrible idea which will be super slow There are two efforts to enable developers to write Android applications with Mono a paid proprietary product from Novell called MonoDroid, and an untitled porting effort by big-name Android hacker Koushik Dutta. I have no insight into MonoDroid since it hasn t been released yet, but Koush did some benchmarks of his work which exhibited some remarkable figures compared to Dalvik (and even compared to Sun Java for ARM). Those numbers haven t been updated to reflect the Froyo Dalvik JITter, but Mono on Android is still very exciting from a performance perspective. Mono isn t really Free Software The source code is all available under Free Software licenses. So, um, yes it is. We don t need Mono because we have $LANG By the same logic, we don t need $LANG because we have Mono. By all means, use the language of your choice other developers will use the language of their choice too. If you want to use Vala or Python or Java, then by all means, go ahead. It doesn t mean there s no room for more languages, better suited to other usage patterns. Haskell is great for some types of development, so is Fortran, and so is C#. You might not need Mono because of $LANG, but there are others in the world with different needs. Mono apps are all slow, and crash your computer, and stuff No userland app can crash your Linux system, unless there s a bug in the kernel, or you have some severe problems with your hardware. If you ve ever observed a crash as a result of running a Mono app, then it s really coincidence that Mono is tickling whichever part of your system is busted. As for slow startup time may well be slower than for apps written in C or Vala. There s a delay due to the JITter needing to compile all the libraries used by the application (we may AOT the most common libraries in a future Mono package version, at upstream s recommendation). Once an app is running, it should be fast compared to a Python app, and memory-light compared to a Java app. The new garbage collector in Mono 2.8 should also offer significant improvements to performance, especially under heavy workloads. Ubuntu s default GTK+ themes require Mono This is my favourite recent nonsense to emerge from the Internest. There are reports mostly restricted to IRC and blog comments, that (paraphrasing here) removing Mono removes the Ubuntu themes . Here s the reality: in Ubuntu 10.04, a new visual style was implemented throughout the distro. As part of this, small icons (e.g. notification area icons) were set to be black-and-white by default, and colourised when attention is needed (e.g. the power-off icon turns red when a reboot is needed, the messaging indicator turns green when there s a new message). All of these new monochrome icons are in a package named ubuntu-mono . Removing the ubuntu-mono icon package will also remove the new Ubuntu GTK+ themes, in the light-themes package. So there s your explanation: the themes have a dependence on some monochrome icons, not on the Mono framework.

The unofficial rc bug tracker currently knows about the following bugs:

In Total:	423
Affecting Squeeze:	317
Squeeze only:	107
Remaining to be fixed in Squeeze:	210

Of these 210 bugs, the following tags are set:

Pending in Squeeze:	15
Patched in Squeeze:	36
Duplicates in Squeeze:	22
Contrib or non-free in Squeeze:	7
Claimed in Squeeze:	2
Delayed in Squeeze:	7
Can fixed in a security Update:	11
Otherwise fixed in Squeeze:	18

Ignoring all the above (multiple tags possible), 126 bugs need to be fixed by Debian Contributers to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 255 need to be dealt with for the release to happen. Please see my older post for an explanation of the different numbers.

Is Low Quality in Italian Academia related to the choice of Low Quality Software? Diego Gambetta and Gloria Origgi wrote an interesting paper titled L-worlds: The curious preference for low quality and its norms [1]. The paper describes how in Italian universities (and large portions of Italian life) there are covert agreements that both parties in a transaction (the employee and the employer or the buyer and the seller) will deliver less than agreed while pretending that they are offering the agreed exchange. People who offer high quality in exchanges are discriminated against because they make people who offer low quality in exchange feel guilty. Nathan suggests that this is the explanation for people choosing to pay for inferior software from Microsoft instead of getting superior software for free [2]. Now it does seem quite plausible that someone who is offering low quality goods in the manner of Italian academia would refuse to consider software from any company other than Microsoft, after all the easiest way of selecting software is to phone a MS representative and be told exactly what to buy. But I don t think that this explains even a significant fraction of the people who refuse free software. There is no direct analogy between bilateral agreements to produce low quality and the choice of MS Software because MS Software is quite expensive (they demand what would be considered a high quality trade in the jargon of the paper). If someone was to buy one of the cheaper laptops in Australia (around $650 new) and upgrade to the full version of Windows 7 along with purchasing the home version of MS Office then the cost of software would be almost as much as the cost of hardware. If they wanted one other MS product then the cost of MS software would probably be greater than the cost of hardware. Hardware costs are steadily falling and MS prices are only increasing, for people who use MS software we should expect that soon the MS tax will be the majority of the costs of running a typical PC. Good Reasons for Choosing MS One thing we have to consider is that there are people who have good reasons for using MS software. One example is the companies that depend on proprietary applications which are central to their business. When the entire company s data is stored in an undocumented proprietary database it s really not easy to change to a different application even when everyone in the company knows the software to be of amazingly low quality. If the vendor of the proprietary application in question decides to only support MS Windows then it s customers (victims?) have no choice about which OS to use. One interesting thing to note about such companies that are locked in to proprietary software is that the amount that they spend per year on license and support fees is usually greater than the cost of hiring one good programmer. If a few such companies formed a consortium to develop free software to manage their business where each company paid the salary of one programmer then after a couple of years of development they could move to the free software and reduce their operating expenses. Another category of users who have a good reason to choose MS is the people who play games seriously. If you want to play games then MS Windows does offer some real advantages. The price of games will usually be a fraction of the hardware cost (the serious gamers spend a lot more on hardware than most people) and MS Windows is apparently the best PC OS for commercial games. Personally I ve found that there are more than enough free games on Linux to waste my time, Warzone 2100 [3] is one that I currently play, and I ve tried Battle for Wesnoth [4] in the past and found it too time consuming and addictive. How a Preference for Low Quality could lead to Microsoft I think that everyone who has any significant experience in the computer industry has encountered companies that have large areas of low quality. This generally tends to be in large corporations as small companies can t afford the waste. In some large corporations Linux on the desktop is never considered, even when people are hired as Linux sysadmins and there are obvious productivity benefits to having the same OS on the desktop as on the servers (even if two desktop PCs are required so that proprietary software can be run on MS-Windows). Major wrote a good satire of the corporate IT non-working culture with a comparison to medical work [5], it illustrates the principle of a coalition to ensure low quality. He later documented how he was sacked by the low quality coalition at a company that uses a lot of Microsoft software [6]. So it does seem that when customers don t care at all about the quality of the result it does help drive some sales for Microsoft. But that doesn t explain the market share that they have. It takes a lot of work to get Market Share without Quality Microsoft has spared no effort in gaining market share. Every possible effort including buying out small competitors, aggressively FUDing competition, using all manner of legal attacks (including the threat of patent suits), and deliberately breaking standards has been used. I think it s reasonable to assume that the MS senior management are not entirely stupid, they do so many things that are unethical and possibly illegal because they know that they need to do so to maintain their market share. The result is that the market capitalisation of MS is almost as high as that of Apple and Apple makes vastly superior products. Given the amount of effort that MS uses to keep market share it seems apparent that they aren t just relying on customers not caring about quality. Should users have to Understand Computers? My observation is that most users don t want to know much about how their computers work. The desire to understand computers seems to be about as common as the desire to understand cars, people just want to buy one that looks good and have it work. The difference is that cars are very compatible while computers aren t. Cars have the same controls in the same places and large parts of the design are specified by law so that they can t differ between models. Proprietary software is usually intentionally incompatible with other software (both open and proprietary) to try and gain a competitive advantage. Hardware is often incompatible due to the rapid developments in technology and the requirements for new interfaces to take advantage of new features. In concept it seems reasonable for someone who is about to spend $30,000 on a car and $1000 on a computer (for hardware and software) to spend 30 times longer considering which brand of car to buy. One could argue that more than 30 times as much consideration should be given to the car as most people can t afford to discard a car that they don t like. As people spend a few minutes considering which brand of car to buy they can be excused for spending a few seconds considering which type of computer to buy. But once a choice has been made about which software to use it s very difficult to change to something else, while in comparison it s easy to drive a car that was manufactured by a different company. So a poorly informed choice made at an early stage can have costly long-term affects when buying software. If we had mandated open standards for file formats and data interchange then users would be able to make choices that don t result in their data being locked in to some proprietary format. Such standards could be set through government tender processes, if every government agency was to only buy software that complies with open standards then the proprietary software vendors would scramble to make their products less incompatible. The result would be that bad choices in purchasing software could become learning experiences that result in better purchases in future instead of being a lock on users that forces them to keep using the same software that doesn t satisfy their needs. Conclusion I think that the best thing about the paper by Diego Gambetta and Gloria Origgi is that it highlights the issue of low quality. No-one wants to be considered a loser, so maybe this can encourage people to strive for high quality (or at least try to make their work suck a little less). Regardless of the conclusion they eventually reach, it s probably good for people to occasionally wonder do I suck? .

• [1] http://www.sociology.ox.ac.uk/documents/working-papers/2009/2009-08.pdf
• [2] http://www.advogato.org/person/ncm/diary.html?start=405
• [3] http://wz2100.net/
• [4] http://www.wesnoth.org/
• [5] http://blog.ninbtma.org/2007/10/will-i-miss-it.html
• [6] http://blog.ninbtma.org/2007/11/just-forward-fucking-ticket_6090.html

I'm a keen amateur photographer and have been since I was at school. Of course back then it involved smelly chemicals, strange lights and dark rooms. The expense and hassle of film eventually did it in for me and in 2000 I bought my first digital camera. After a series of increasingly sophisticated devices, back in 2007 I bought a Nikon D80 and soon thereafter I discovered that you can do things with raw camera files that have some analogies to the darkroom processing of my youth. For most of the time since then I've used UFraw for processing my raw images, combined with increasingly sophisticated batch files to harass it into shape. It has increasingly frustrated me that UFraw doesn't do several things that are essential to processing most files, since once the image leaves that programming it usually ends up in an 8-bpp processing path. It seems to me that the saving the processed image into an 8bpp format like jpeg is the last step before leaving the image alone. Of course this can't always be the case since sometimes a judicious use of the 'Resynthesizer' plugin can make some unsightly elements just disappear, or one needs to carefully apply some censorship to the 14 year old in the background so that the 7 year-old's parents can put the photo on the mantelpiece without worrying about what Granny will say about how much better children's manners were in her day. I'm hoping too, that when I have grandchildren I'll be able to tell them that 'in my day we only had 8 bits per pixel, and we were lucky', but The Gimp isn't there yet, no matter how much promise Gegl seems to offer. The thing that has particularly annoyed me is sharpening. UFraw doesn't, and as a result my workflow has either involved applying some blanket sharpening, much like the camera does, or moving the image into a second tool just to apply some sharpening. This week has been particularly demanding, as the school asked me to 'take some photographs of the production'. So of course that's a thousand-odd photos that I want to do a cull down to a hundred or so, and then I want to quickly do justice to the good ones so I can move on to other stuff. Well this time my frustration with UFraw hit that ceiling that got me to try something else. I've done this in the past, and found myself going full circle and ending up right back at UFraw with a few extra lines added to my script, but this time I tried rawstudio and in processing the 'can you do the class shots overnight please' test it produced much nicer results in much less time than I have ever been able to with UFraw. So I've switched, and the more I use it the more convinced I am that UFraw will be getting uninstalled pretty soon. That's not to say that rawstudio is perfect: it isn't. In particular it has some user interface failures that are kind of annoying to me, but they aren't enough to stop me using it. In fact I liked it so much that I immediately had to pull the nightly repository and build that, just to get the new saturation handling. The user-interface niggles that do get to me are:

• The keyboard key to switch between zoom 1:1 and zoom to fit is '*', which I have to access with 'shift' down since I'm on a laptop. This was less bad when I discovered I could right-click, but it's still annoying. 'z' would be a much better choice for right-handers, or '/' for left-handers. Or perhaps they could both be made to work. When working on an image I often want to switch between some particular area and the whole image when checking colour balance, sharpening, noise, etc, so this is one of the most used keyboard functions.
• Using the mouse wheel to adjust sliders varies greatly in it's effect. A single detent for contrast or saturation often overshoots the useful range, so I have to drag the fiddly slider a fiddly pixel-and-a-half to go from a contrast of 1.00 to 1.03.
• Not all modifications to an image show in the UI. When I crop or align an image RawStudio remembers the settings for these things (which is fantastic) but if I come back three months later I might not realise I'm looking at a cropped image. I can see all of the hue, saturation, sharpening and so forth, but there should be something in the UI to indicate that the crop and alignment have happened also.
• It confuses me what settings get applied to a fresh image. I seem to get some kind of random selection of which DCP profile is being applied, and there's no way to set a default sharpening or noise reduction. Of course some of this is hard: noise reduction defaults really need to change depending on camera & ISO, and sharpening defaults probably should vary by lense and aperture too, to some extent.
• The icon view runs across the top, taking up important screen real-estate. On my widescreen laptop I'd like the option to run it vertically where otherwise there's wasted space.

Things that I immediately love, over what UFraw gave me:

• Sharpening.
• Straightening images.
• Cropping images (in some versions of UFraw this works, and in some it's broken, but the UI is useless in all of versions I've seen).
• Colour profiles.
• Lens corrections.

Things that I immediately miss from UFraw:

• White balance presets.
• Wavelet noise reduction.

There are a bunch of things that RawStudio also does that I haven't particularly found a use for yet, but which I suspect I will quite like when I do. The image classification and stuff seems likely to be useful, for sure. In choosing to switch RawStudio I also looked at RawTherapee, which has recently relicensed under the GPL, but I chose RawStudio because it has vastly better performance on my laptop, and because I found the interface much more immediately accessible. RawTherapee also exceeds what UFraw can do in many ways, and looks like it might be useful for the really difficult cases, but learning to drive it with any facility could take some time. Especially if you only have an i7 740QM with 6G RAM, it would seem.

I have always liked learning and understanding history. Since I discovered him, for a couple of years already I always try to catch Javier Garciadiego's program Conversaciones sobre historia, Saturday 9AM in the Horizonte 108 radio station (can be listened to online). This program started by going over the events just before the beginning of the 1910 revolution in Mexico - and along slightly over five years, one hour per week and following different threads, the program has reached the end of the Cristiada, in the early 1930s. Garciadiego has a very nice, followable, amenable way of telling history, and I have recommended his program to many friends. This last June, I spent some days in Guatemala City, for DrupalCamp Centroam rica. I stayed with my good Colombian friend, Dilson, and at his house he had framed a poster of the History of the Civilizations. Of course, I got my nose close to it, guessing as many faces as possible in the lot. And he showed me his last Christmas present: Two books, each of them with 6 CDs. One is Historia de las Civilizaciones, the second one is Historia de las independencias. They are made by Colombia's very well known and well regarded historian Diana Uribe. I copied the CDs in order to listen to them later And wow, was I impressed! Diana Uribe makes a great narrative about topics that to some people would seem boring and dry. As I said, I have always found passion in understanding the human processes that have shaped civilization and brought us all the way to where we stand now. Well, Diana Uribe manages to bring more "normal" people to this passion. While looking for information on her to share in this blog post, I found so many places offering download of her disks, with apparently young people talking about how she has got them all so excited and interested in history... That's, I think, the best "thank you" any academician can get: having non-specialists say how her work has opened up the passion of one of the world's least sexy professions to them. And yes there are so many "thank you" and "I want" commentaries, so much of what I would call "fan mail", that it took me a bit to find an online library carrying both works. And yes, at ~US$50 each, I do intend to buy them. Now, why am I writing this today? Well, yes, because I finished listening to the series today, but besides During this year, most of Latin American countries conmemorate their 200 years of existence. Most of the independentist struggles in the continent started in 1809-1810. And today is the "partying" day in Mexico Says the legend that in the night between September 15 and 16, 1810, a priest who is always painted as old and charismatic called on his small town urging the people to rise and fight for independence, and as a result of that, only 11 years later Mexico was a fully independent country, spanning from Costa Rica to California, and... well, a nice and very idealized myth. A century later, in 1910, after a very long stability and growth period (attained mostly through repression, the same abstract thing named as "the people" rose against the dictator Porfirio D az, who had been Mexico's president for 30 years. The revolution deeply changed the social face of the country, but politically... After ~15 years of fighting, the result was that a 30 year long dictatorship was replaced by a 70 year long one... And our political system still has not evolved beyond that model. Now, comparing what has not improved nor even stayed the same but went backwards... A century ago, the festivities of the hundred years of independence were a time for showing pride, for showing to the guests from more "civilized" countries how ours was by then a modern, thriving country worth believing in, worth investing in: Besides the important, majestic and well built monuments that were erected and still stand today (i.e. the Column of the Independence or Hemiciclo a Ju rez, many institutions that would socially shape the next century even after D az's death, even after he had been declared not the role model we wanted after all were born: The National University (nowadays the most important university in Latin America), the National School for Professors, the Railroad Technical School and many others (see Javier Aranda's note for some more details)... The celebration was well-thought and planned. Of course, it didn't go into some darker corners, the country was as uneven and unfair as it can be for the poorer indigenous population (which back then was a majority), and what not. But this year? Well, we are expecting an impressive show tonight (which I won't see, even though I'd like to, as I no longer have a TV and even if I had wanted to go downtown for the celebration, different government branches are insisting we should just sit and watch it by TV at home as it can be too crowded... so not even that was well thought out Of course not every Mexican can go to the same square and see the same de-facto president do the ritual, but some more redundancy could be thought, spreading acts through all of the city instead of concentrating the festivities all along Reforma. But anyway Leaving aside our current de-facto ruler's inabilities to do anything worthy, which are already well known and documented... I took this opportunity to listen to a great work, and am most happy to do it, and to be able to share it with you.