Search Results: "nate"

13 June 2008

Russell Coker: I m Skeptical about Robotic Nanotech

There has been a lot of fear-mongering about nanotech. The idea is that little robots will eat people (or maybe eat things that we depend on such as essential food crops). It’s unfortunate that fear-mongering has replaced thought and there seems to have been little serious discussion about the issues. If (as some people believe) nanotech has the potential to be more destructive than nuclear weapons then it’s an issue that needs to be discussed in debates before elections and government actions to alleviate the threat need to be reported on the news - as suggested in the Accelerating Future blog [0]. I predict that there will be three things which could be called nanotech in the future:

  1. Artifical life forms as described by Craig Venter in his talk for ted.com [1]. I believe that these should be considered along with nanotech because the boundary between creatures and machines can get fuzzy when you talk about self-replicating things devised by humans which are based on biological processes.
    I believe that artificial life forms and tweaked versions of current life forms have significant potential for harm. The BBC has an interesting article on health risks of GM food which suggests that such foods should be given the same level of testing as pharmaceuticals [2]. But that’s only the tip of the iceberg, the potential use of Terminator Gene technology [3] in biological warfare seems obvious.
But generally this form of nanotech has the same potential as bio-warfare (which currently has significantly under-performed when compared to other WMDs) and needs to be handled in the same way.
  • The more commonly discussed robotic nanotech, self-replicating and which can run around to do things (EG work inside a human body). I doubt that tiny robots can ever be as effective at adapting to their environment as animals, I also doubt that they can self-replicate in the wild. Currently we create CPU cores (the most intricate devices created by humans) from very pure materials in “clean rooms”. Making tiny machines in clean-rooms is not easy, making them in dirty environments is going to be almost impossible. Robots as we know them are based around environments that are artificially clean not natural environments. Robots that can self-replicate in a clean-room when provided with pure supplies of the necessary raw materials is a solvable problem. I predict that this will remain in science-fiction.

  • Tiny robots manufactured in factories to work as parts of larger machines. This is something that we are getting to today. It’s not going to cause any harm as long as the nano-bots can’t be manufactured on their own and can’t survive in the wild.

  • In summary, I think that the main area that we should be concerned about in regard to nano-bot technology is as a new development on the biological warfare theme. This seems to be a serious threat which deserves the attention of major governments.

    12 June 2008

    Edd Dumbill: Gandi's VM hosting beta now closed to new users

    I've been experimenting with Gandi's virtual hosting service recently. In fact, this blog is now hosted on it. Gandi have created by far the easiest hosting service I've used. The web interface allows you to buy credit, create pre-installed virtual machines and log in, all in under 15 minutes. Add the ease of Ubuntu to the mix (just one of the preinstalled images you can choose from), and commissioning times for new services are low indeed. The hosting service is based on Xen, and allows you to dynamically change the resources your VMs can access (CPU/memory/disk), on a scheduled basis if required. It has an API which provides enough functionality for you to white-label hosting as part of your own web app. Gandi's hosting options
    Excerpt from Gandi's explanation of the amount of resource you can allocate to a virtual machine Gandi's service isn't yet as flexible as Amazon's EC2, but it comes at the problem from the other end — its initial offering "just works" as an alternative hosting solution, with the added flexibility their Xen infrastructure brings to the mix. Even with all its tool support, Amazon EC2 feels like stepping into an alternate universe. I'm pretty excited about the directions in which Gandi's service will develop. And yes, now I've told you all this, unfortunately you can't yet play with the beta service if you've not got an account already. The initial success means Gandi are closing new signups for a little time to concentrate on improving their infrastructure. The good news is that Gandi say this is the final step before the full release of the system. I can't wait! It's so good to see innovative, high-quality internet solutions coming from Europe.Join the conversation about this post

    Matthew Palmer: Womble's Word of the Week: Retrofit!

    In a perfect world, when we design some aspect of our infrastructure, we'd get it right the first time, and would never have to change our design once it had been deployed. Back in this world, however, we regularly have to change things as we expand our infrastructure. Sometimes we made a mistake originally, other times new requirements pop up. In either case we will end up doing things differently in the future than how it was done in the past. The danger here is that if you only create your new machines or services differently, you've got effectively two separate and different systems to maintain. This may not sound like much, until it happens again... and again... and again... and then suddenly you've got 18 different ways of setting up backups, depending on how long ago you set it up and (if you're really unlucky) who did it and what the phase of the moon was at the time. If you've been here before, you probably remember the pain of having some disaster happen and needing to fix it NOW NOW NOW, only to wade into the setup and realise that it's been done in a way that (you thought) died out six months ago -- and so you don't really remember how it works, and yeah, the documentation's been updated so many times since then that it doesn't mention the old way of doing things, and here comes your boss to ask how long it's going to be until it's all working again... If you haven't had this experience (yet?), you'll have to trust me when I say that it's no fun to hit an older, out-of-date system. It's especially painful because the most common reason you change things is because the old way sucked. So you turn up at a critical moment to fix something in a poorly documented and sub-optimally configured system. Fun, fun, funnity fun. There are only two ways to avoid this problem: never change the way you do anything, or else plan your changes so that retrofitting is part of the plan every time you're modifying an existing service. Assuming that never changing anything isn't an option, you need to plan to retrofit. When you're putting together the design for your system change (you do design your changes, right?) you need to audit what's out there, determine what's needed to bring it all up to date, and put together a plan to make that happen. It's like documentation and testing -- if you don't make an explicit effort to make it happen, it'll never get done. That sounds like a lot of work, and it is. Luckily, if you're already working in a well-maintained infrastructure you should only really have one existing config to upgrade, which shouldn't be too painful. However, if you've got a lot of machines to change there's no way around the fact that they've all got to be changed, and that can take time. If you accept that you don't want configuration skew, you can start to think about how to engineer your systems and processes to make it less of a hassle to keep everything up to date. Putting some extra thought into how you set things up in the first place so that it's easier to update is at the heart of this. Automating deployment is an easy way to take some of the pain away from rolling out new configs, but there's also plenty of smaller decisions that help with updating configs: putting everything in revision control, making extensive use of templating and pulling out common config fragments, and making sure that you've got good notes and records of what has been done where. The more you automate your deployment and maintenance, the less pain you feel when you need to retrofit. With something like Puppet, you can eliminate a lot of the pain because you're describing what you want done for all the relevant machines, and then the machines themselves work out what needs to be done to bring themselves up to date. With an advanced automation system in place, you can say "I want all my mail servers to have setting X turned on" and off they go and set the option. Or you might want to have some of your mail servers to have a different config setting, triggered based on a config setting or class of machine. Of course, you might not already have that config setting or class defined, so you'll need to add it. Don't forget to retrofit that new config setting or class to your existing machines. That might involve finding the config for all the existing machines and modifying them. Yep, no matter how much automation you've got you can't get away from the need to retrofit, but given the choice between editing a bunch of config files on my local machine (with all the power of my text editor to back me up) or logging into dozens of machines all over the globe to edit their configs and restart services (with all the risks of making a mistake) I know which one I'd choose...

    11 June 2008

    Christian Perrier: [life] Manu en su casa

    Yes, Manu Chao was really home yesterday in Paris Bercy. And he was obviously feeling like being home. The concert began at 21:30 and ended up at 00:30. Yes...that makes 3 full hours concert. All that for 25 euros. The crowd support, dance, participation was *amazing*. I often go to concerts in the Bercy arena and never saw the crowd in the upper rows being stood up all concert long. Radio Bemba played their usual tracks first. As usual, the very Manu way to mix songs, themes from all his carreer and mix them up, distord them and make new songs from old ones. This is what always made Mano Negra, then Manu Chao oncerts unique experiences. Just imagine 20,000 people singing Clandestino a capella, most of us not knowing any damn word of Spanish... After about 2 hours of magic without any stop, the very special moments came in. Manu, Gambit, Majiv (what a guitarist when playing rumbas de Barcelona!), Julio (de Barcelona!)...and all others were just feeling like being home with a few friends. So the encores lasted...and lasted...and lasted. They just didn't want to stop (Manu probably said about 3 or 4 times "c'est fini"). Then, they did something I never ever saw in a big 20,000 people concert since my first one back in....long time ago. Manu asked "do you have 5 more minutes?". So, they stopped for 5 minutes to get the guitars re-accorded(sp?)....the crowd just...waited...and the gig re-started again with songs from "Si Sib rie m' tait cont e", the special book-album he made with friends, inspired by the sad winters he spent in Paris in his early years. Soooooo special and, believe me, that *was* special. Seeing all roadies, crew, friends just dancing backstage and partying clearly showed this was not to always happen (this will probably happen again on today's concert). He was just feeling like home. And so were we. Not wanting to leave and shut down the light. Finally, at 00:30, all of us were dead tired and we just hugged around with Manu and left. Just like old friends. I don't know if that will happen everywhere in the upcoming tour (some dates in France, some in Europe, a few in USA....nothing unfortunately in South America as of now)....but if you have the opportunity to go to Radio Bemba concerts, just do it. And (IRC reference), really, Erinn, this was not about "ethnic music for white people" (really wondering where you got this idea...or if you were just kidding me). I dunno what Manu ever did to kill your ears, but just try again and, even more important, go to the gig in your fair city on August 22nd. Radio Bemba concerts will be cheap, about half the price of regular bug size concerts....just use that opportunity.

    Obey Arthur Liu: debian.org domainsquatted ? (1)

    debian.org domain squatted I was like “wtf?!”. Debian.org replaced by a link farm ? debian.org being actually domainsquatted is highly unlikely, so I started searching how this could happen. First, a little explanation of the setup : Now there are some peculiarities to the situation : Some hints : Now for the challenge : how could this happen ?

    10 June 2008

    David Moreno Garza: Small slips make great victories

    World, here's another one:

    1. e4 e5 2. Nf3 Nc6 3. Bc4 h6 4. c3 d6 5. d4 Bg4 6. h3 Bxf3 7. Qxf3 f6 8. Qh5+ Kd7 9. d5 Nce7 10. b3 c6 11. Ba3 c5 12. b4 cxb4 13. Bxb4 Rc8 14. Bb5+ Nc6 15. dxc6+ bxc6 16. Ba6 Ne7 17. Bxc8+ Qxc8 18. Na3 g6 19. Qe2 f5 20. exf5 Nxf5 21. g4 Nh4 22. O-O-O c5 23. Ba5 Be7 24. Nc4 Qa6 25. a4 Ng2 26. Qa2 Bg5+ 27. Kb1 Rb8+ 28. Qb2 Rxb2+ 29. Kxb2 Qxc4 30. h4 Bf4 31. h5 g5 32. Rhg1 Qe2+ 33. Ka3 Qxg4 34. Rd5 Qf3 35. Rgd1 Bc1+ 36. Ka2 Qxf2+ 37. Kb1 Qb2#  0-1

    I was again playing Black. White's 28th move is probably what killed him. He was ELO-rated almost one hundred points above me. I gained 34 ELO points. This is one of the sweetest moments of chess.

    Simon, what you need, is a PGN parser/extractor. Or a chess board with algebraic coordinate marks.

    Alastair McKinstry: Little Endian problems

    #include <stdio.h>
    #include <sys/types.h>
    int main(int argc, char *argv[])
     
    #ifdef LITTLE_ENDIAN
    	printf("Little Endian defined\n");
    #endif
     
    
    On Linux/x86, this prints outputs little-endian. Unfortunately it also does so on the IBM BlueGene (Linux, GNU Libc), which is, by default, big-endian. (Thanks to my colleague Honore Tapamo for discovering this). It turns out that this is due to <sys/types.h> including <endian.h>, which has:
    #define __LITTLE_ENDIAN 1234
    #define __BIG_ENDIAN    4321
    #define __PDP_ENDIAN    3412
    /* This file defines  __BYTE_ORDER' for the particular machine.  */
    #include <bits/endian.h>
       #ifdef  __USE_BSD
       # define LITTLE_ENDIAN  __LITTLE_ENDIAN
       # define BIG_ENDIAN     __BIG_ENDIAN
       # define PDP_ENDIAN     __PDP_ENDIAN
       # define BYTE_ORDER     __BYTE_ORDER
       #endif
       
       #if __BYTE_ORDER == __LITTLE_ENDIAN
       # define __LONG_LONG_PAIR(HI, LO) LO, HI
       #elif __BYTE_ORDER == __BIG_ENDIAN
       # define __LONG_LONG_PAIR(HI, LO) HI, LO
       #endif
    
    We're working on a code at the moment that has LITTLE_ENDIAN defined in Makefiles on Little-Endian architectures. This all needs to be changed to something like IS_LITTLE_ENDIAN to avoid this issue. POSIX requires that all symbols beginning with an underscore, followed by a Capital letter or another underscore, are reserved for "the system". Unfortunately the reverse does not appear to be true, and this then is a collision with a symbol that programmers thought was unique to the code being defined in system headers but with different meaning. Is there a standard for detecting byte order? There doesn't appear to be in POSIX. Linux / libc provides __BYTE_ORDER but what other Operating Systems does this work on ? Tags , , , , ,

    8 June 2008

    Andrew Pollock: [life] And we're back

    We actually got home last Sunday, but I've been too jetlagged, and then too busy with work to really have a chance to write anything... We got back in at around 2pm, but our bags fell victim to Heathrow's Terminal 5, and didn't arrive until around 11pm. I think I lasted until about 8pm, when I had to crash. Poor Sarah had to stay up until 11pm when they finally got around to delivering our suitcases. The week in Zurich was wonderful. The Zurich office is everything the photos make it out to be, and then some. One weird thing: apparently there's some Swiss regulation about how much you're allowed to cool a building in relation to the outdoor ambient temperature, so there's no air conditioning in the office. Instead, you can open the windows. Unfortunately, there's a fairly busy set of train tracks right beside the office, so it can get a tad noisy... It was a pretty warm week, I think around 30°C. I certainly prefer being colder rather than hotter when indoors, so found the lack of decent cooling to be a shame, given the rest of the building's features. That said, it was pretty amazing sweltering away in Zurich, and then looking up and seeing snow on the mountains. It was surprising how much of a temperature difference there was. On the last evening in Zurich, we went on a reconnoitre to try and find the river that we could hear (and see on the map) behind our apartment. We eventually found some street access to it, and it was another world back there. It was fairly thickly wooded, and the sunlight was heavily filtered through the trees, so it was cool and shady. The river was fairly fast flowing over some rocks in parts, which is what was making it so audible. The whole setting was absolutely beautiful. There were a couple of paths, and the whole thing felt like something out of a fairy tail. We think we stumbled onto a fox, but we're not sure. It's a shame we only discovered the place on the last day, as I'd have liked to have explored it further. I really liked Zurich. It was nice and flat, and had an excellent tram service. Monday Night Skate made me wish I'd packed my roller blades. We were wandering around on Monday night, and it felt like the entire city had donned skates and were going out. Apparently the authorities really get behind it, and close roads, and the police go along behind the pack and reopen the roads behind them and pick up the stragglers. Great way to encourage an active lifestyle. We've got all of our photos up now from the Europe trip, and they're here. This brings the total countries I've visited up to 10, excluding Hong Kong and Macau. I don't like selecting China when I generate this map, as I've never been to mainland China. Countries I've visited as of June 2008

    Russell Coker: Record Oil Prices

    MarketWatch reports that oil prices had the biggest daily gain on record, going up $11 in one day. They claim that this is due to an impending Israeli attack on Iran and a weak US economy. $150 per barrel is the price that they predict for the 4th of July. That’s an interesting choice of date, I wonder whether they will be talking about “independence from Arabian oil”… The New York Times has an interesting article on fuel prices [1]. Apparently sales of SUVs are dropping significantly. The US senate is now debating a cap on carbon-dioxide production. The NY Times article suggests that if the new “carbon taxes” could be combined with tax cuts in other areas. If implemented correctly it would allow people who want to save money to reduce their overall tax payments by reducing fuel use. Also as increasing prices will decrease demand (thus decreasing the price at import time) it would to some degree mean transferring some revenue from the governments of the middle east to the US government. The article also states that the Ford F series of “pickup trucks” was the most popular line of vehicles in the US for more than 20 years! But last month they were beaten by the Toyota Corolla and Camry and the Honda Civic and Accord. Now Ford needs to put more effort into their medium to large cars. With the hybrid Camry apparently already on sale in the US (their web site refuses to provide any information to me because I don’t have Flash installed so I can’t check) and rumored to be released soon in other countries Ford needs to put some significant amounts of effort into developing fuel efficient vehicles. According to a story in the Herald Sun (published on the 23rd of April), survey results show that 1/3 of Victorians would cease using their car to get to work if the petrol price reached $1.75/L [2]. Now the Herald Sun has run a prediction (by the assistant treasurer and the NRMA) that $1.75/L will be reached next week (an increase of just over 10 cents a liter) [3]. The good news is that there will be less pollution in Australia in the near future (even if $1.75 is not reached I am certain that the price will increase enough to encourage some people to use public transport). The bad news is that our public transport is inadequate at the moment and there will be significant levels of overcrowding.

    Axel Beckert: Bath Tub, Rubber Keyboard, Ratpoison and Opera

    I recently noticed that a very good way to safely read webcomics in the bath tub is an old laptop with a big screen (e.g. a IBM ThinkPad A-series like my 15” A31 which has a nice 1400×1050 resolution), a water proof keyboard, the screen-alike, keyboard only driven (hence the name) window manager ratpoison (other keyboard driven window managers like wmii or awesome probably will do as well as ratpoison) and a good keyboard driven web browser which can bind or by default has bound a key to follow <link rel="next" ... /> tags. Like Opera. Opera has bound the space bar to scroll one page down and if you reach the bottom of the page to go to the next page as labeled in the link tag. Additionally the full screen mode is helpful, too. Or the dream browser of all Emacs addicts, Conkeror, which has bound the function browser-follow-next to ]]. (Conkeror packages will hit Debian Experimental quite soon.) Or the GNOME feed reader Liferea which has bound Ctrl-Space by default to scroll down the content by one page and if you reach the bottom of the content go to the next unread item. With that equipment I can read my favourite web comics like Questionable Content (whose content seldomly is questionable :-) or Ozy and Millie (Think of a mixture of Calvin & Hobbes, Peanuts and Kevin & Kell) in the bath tub without drying my hands before reading the next comic or fearing water or health damage by the combination of water and computer. I just press one or two keys on the keyboard floating over my lap and have a good time.
    a keyboard floatiing in the bath tub close up of the floatiing keyboard
    BTW: I’ve got a blue, non-branded one (packaging reveals it as “AirTouch Keyboard”, probably manufactured by SanChuan Electronics, China) with swiss-german layout from ARP Datacom (whose website offers no permanent links and insists on session cookies *puke*), but those from Keysonic or from ROCK seem to be very similar — nowadays they are also available in illuminated, miscellaneous colors and wireless, but only IP65, probably because of the necessarily accessible battery compartment. But this kind of having fun still has optimisation potential: non-flexibel water-proof keyboard (IP67 recommended, so those IP66 keyboards and mice recently posted at UF LOTD are probably not tight enough), flat screen mounted above the bath tub, etc. ;-) Or maybe a completely water proof laptop if such thing exists — Does it? One more note: In Debian Sid and Lenny recently a new tool called keynav has been added, which allows you to control the mouse quickly using the keyboard only. So with Sid or Lenny, I don’t even need an waterproof mouse or trackball if an application insists on mouse usage. ;-)

    Kartik Mistry: .. and I got RC Bug!


    * #410703 Long pending. Help is required. Unfortunately, before I act on it, severity was raised to ‘grave’. See bug logs for more details. Patches are most welcome from Developers (I was told to not ask patches from users. Thanks!) And, I still don’t have Debian machine. The option is to get al-cheapo ASUS eee PC quickly to start whatever Debian work I can do or my dream is to wait and have Macbook :P

    7 June 2008

    David Nusinow: The Cognitive Load Of Web Development

    The most dynamic segment of the software industry that I'm aware of is web programming. Flamewars rage about frameworks and browsers and standards and whatnot, and the openness of the whole thing feels like some of the things that made me fall in love with computing as a whole and Free Software in particular. The problem with all that openness is that it's rather difficult to navigate. Aside from the obvious issues with browser incompatibilities, there's an enormous amount of software solutions on the server side, spanning languages, libraries, and frameworks. Each one is an ecosystem to itself, often being large and complicated.

    This makes it rather difficult to do certain aspects of web programming well. You are constantly switching between tools and languages, as well as coding paradigms, in order to build a web app in full. You'll be writing HTML, CSS, and Javascript on the client side, each with its own peculiarities. On the server side you'll probably have settled on one language with its own very different varieties of coding style and patterns. Some, like Ruby on Rails, are their own unique brand of language that makes you work both in the DSL (Rails in this case) and the parent language (Ruby here). Template engines often will do the same thing, such as in the case of Django.

    It's pretty obvious that having to juggle all these tools places a fairly large burden on the coder. Much to their credit, it's not difficult to work in any of these languages, but to work in them at a high level becomes more difficult the deeper and wider the software stack reaches. You get this a bit in systems programming, juggling C/C++ with a build system and a scripting language, but that's usually it. You can get that number of moving parts just on the client side of the web with HTML, CSS, and Javascript.

    Something interesting that seems to be happening is that people are moving to decrease this cognitive burden. One good example is the Google Web Toolkit which lets you write all your AJAXy client-side stuff in Java, and let it get compiled in to Javascript. That way you cut the languages you have to work in. A similar concept is behind Microsoft allowing Ruby (and Python, if I've heard correctly) in Silverlight. Alternately, you can bring Javascript (back) to the server side, which is the motivation behind Helma and Rhino on Rails (the latter of which I hope sees the light of day).

    Personally, I'm rooting for Javascript to not become an assembly language, but to take over the server side again. It's a capable and powerful language (much better than Java in my opinion), and we're collectively leveraging it very poorly. Rhino is interesting and has enormous potential, but it needs library binds in the worst way. Currently it's basically using Javascript to write Java, which is rather atrocious (COBOL in any language, etc) but with some Javascript-style wrappers around the Java classes it could be phenomenal. Alternately, there's Spidermonkey, which could be wrapped in a more capable shell with a good FFI, and we could easily have wrappers to our favorite Free Software libraries. This project seems far along here, but it's currently very windows-centric.

    There's a lot of potential here though. Unifying the development language for both web and system apps would benefit the Free Software desktop, and give us the ability to better integrate our stuff with the web. One of the best things about Free Software is that it dropped the barrier to entry in software development. I think we can repeat that success again here.

    6 June 2008

    Benjamin Mako Hill: Stumping for Revealing Errors

    Over the past couple months, I gave a couple talks on Revealing Errors -- my project to try and use errors to teach non-technical people about technology, the effects it has on our lives, and the ways in which we (as users) might want to control it. The first version was at LUG Radio Live USA and went off reasonably well. A couple weeks later, I gave a version of the talk again at PenguiCon which went great. Unfortunately, neither recording seems to have worked out. I'll be giving talks on the subject at least twice more this summer. The first will be on June 18th at Boston Linux Unix at 19:00 at MIT in E51-315. It will be my first talk to BLU in something like three years. I'm also currently scheduled to give an abbreviated version of the talk as a keynote at OSCON under the title Advocating Software Freedom by Revealing Errors. In addition to all that, I'm having a whole lot of fun updating the Revealing Errors blog (although not as often as I'd like) and am currently in discussions about publishing a longer version of the Revealing Errors article as a book chapter at some point in the next year. Thanks to everybody who has been supportive of the project and read the blog, has told their friends, and who has told me about telling technological errors they've seen around. Please keep it up!

    5 June 2008

    Christian Perrier: [life] Barcelona rocks

    (update with right spellings for Catalan names, thanks Guillem) So, we (Elizabeth and /me) spent four days in May-end in Barcelona...without my laptop. That was already 2 weeks ago but it took me time to cook this blog entry..:-) Indeed, we enjoyed that a lot. That city is deeply appealing and friendly, and welcoming, and etc. Elizabeth found a good, though expensive, hotel in the city center, close to La Rambla (career Junta de Comer for those who care)....but far enough from La Rambla's noise..:-) The city is of course full of tourists...just like us...but, in some way, it absorbs the "load" very well and it doesn't look like the Touristorama that Paris turns into from May to September, for instance. It probably comes from the city having several interesting places to go without hard "hot spots" where all international buses of hurried folks run around like a sheep cattle...:-) Of course, we went to the "famous" places and, well, we enjoyed them a lot. For instance, the city hot spot, namely La Sagrada Familia... I wouldn't really have guessed that I would enjoy it that much. I was expecting something crazy and full of religious crap, just like Paris' "Sacre Coeur". I actually found a marvel of modern architecture. The portal of Passion is....astonishing and its modern sculpture framework is full of emotion. The inside, though still under huge work left me thrilled. That forest of pilars, the size of the ceiling and the elegance of all this is....wonderful. Really, I hope I'll live enough to see the end of this. We spent more than 4 hours there... La Rambla is as well somethign one has to enjoy. Of course full of crappy tourist-oriented stuff....but also a really living place and a place where one just want to "ramble on". We visited Park G ell on Friday with the best weather we had. Just sitting there on the terrace and enjoy the sun and some music by a quite good trumpetist was a great first introduction to the week-end. We wandered a long time around Montjuich hill, enjoying the view on the city. Definitely a place I would love running in if I was a Catalan. We also wandered through Gr cia which was a separate village in the past, though close to city's center. Nice walk in small places. Go there on evenings. The Musuem of the City's history is also a place to go. Great visit of remainings of the Roman and post-Roman city, under places just near to the cathedral. We were also lucky to see the Corpus Christi procession with Giants and related things (interrupted by rain, unfortunately) as well as attend a local "sardane" contest on a small place close to the cathedral on Saturday. Just friendly and nice being sitting there. We also went on some event I have no idea about, which featured some kinds of "fratenities" of people in a procession, with many giant flags (I mean *really giant*: about 5-8 meters high and held by one single person). We followed them for 1-2 kms in the avenues around the University after seeing them from the bus...:-) Barcelona's transport system is great. We had the great idea to buy "Barcelona cards" which just give you free access to bus, trains, metro, tram and several reduced fees to museums and such other places. This way, we could go around the city without walking too much and be too tired... If you do so some day, just use busses. They go everywhere, are very fast and they come often, even on Sundays. The metro is faster but you don't see the city. My favourite bus line is 24. Another option is the bicycle rental system. It seems fairly easy to use and, just like Paris V'lib, you find bicycles everywhere. Just remember that you'll ride in Spain (the same stands for Paris...) so buy eyes for all around your head. I still have so many things to say about Barcelona, but I want to complete that blog entry. In short, go there and enjoy. It deserves it. Ah, and if you live in Barcelona (and are not veg'), just try the "Biblioteca" restaurant in Junta de Comer o (I hope I remember the name well...anyway there are not that many restaurants in that street). We went there two nights in a row just because we wanted to try more stuff from their great menu..:-).

    Marc 'Zugschlus' Haber: Serial Console Server for the Poor II

    This is the second installment of my article about the Serial Console Server for the Poor. First installment here. The last part of the article having covered the hardware and the udev part creating the device nodes, this part addresses the part of the software that connects the user to the device node. The idea of the software side is to allow users access only to certain serial ports without giving out a shell account on the server itself. Communication between user and the console server should be encrypted (which certainly means ssh), and users should be able to authenticate both with a key and with a password. Serial parameters (baud rate, parity, stop bits etc) should be configured on the console server to keep this possible error source away from the users. For years, I have been thinking about using UUCP’s cu to access the serial port. This time, it’s not going to be used because it offers a shell escape which cannot be turned off. That would give a user shell to the users indirectly, which is not what I want. Minicom seems still to be the most-used application to access a serial port. I have never understood the sense of using a terminal emulator inside a terminal emulator, especially if one has to break the terminal emulator’s habit of trying to initialize a non-existent modem. So I settled on the application that I usually use to access a serial port: ser2net. This is a Linux implementation of Cisco’s “reverse telnet” feature which “connects” a TCP port to a serial port with a given set of parameters. For example,
    4016:telnet:600:/dev/USBserial6:38400 8DATABITS NONE 1STOPBIT banner
    
    connects TCP port 4016 with /dev/USBserial6 with an 38400 8n1 parameter set. If you telnet to localhost 4016, you’ll find yourself talking to the device connected to the appropriate serial port. This moves the security risk to the telnet client, which - unfortunately - offers a shell escape function from the telnet command line reachable with the escape character. The only way to remove this is to use the -E command line option, which turns off the escape function completely. This unfortunately excludes the user from cleanly quitting the telnet session, so the only way to get out of a telnet -E is to have the remote side close the serial port (which ain’t happening on a serial console) or to kill the telnet process, for example by closing the carrying ssh session. That’s a turn-off, but one that one can live with. Now, the only challenge left is to have the appropriate telnet client started automatically for the user. I decided on connecting this to the account being connected to, so that ssh USBserial4@hostname will automatically do the right thing. Since password authentication needs to work (optionally), this precludes the use of the command modifier in an authorized_keys file. Another possibility to force a command being executed on login is to set it as the users’ login shell in /etc/passwd. One drawback: The command must not have any parameters, so one needs to pass needed parameters to the program some other way. Additionally, the program must be listed in /etc/shells or it will be silently ignored. My /etc/passwd entries look like
    USBserial2:x:1002:1002:USBserial2,,,:/home/USBserial2:/usr/local/sbin/serialconnect-shell
    
    with /usr/local/sbin/serialconnect-shell looking like
    #!/bin/bash
    set -eu
    case “$(id --user --name)” in
      USBserial1) PORT=“2011”;; 
      USBserial2) PORT=“2012”;;
      USBserial3) PORT=“6013”;;
      USBserial4) PORT=“6014”;;
      USBserial5) PORT=“2015”;;
      USBserial6) PORT=“2016”;;
      USBserial7) PORT=“6017”;;
      *) echo “called from unknown account, terminating.”; exit 1;;
    esac
    telnet -E localhost $PORT
    
    Just for reference, here are the appropriate entries in /etc/ser2net.conf:
    2011:telnet:600:/dev/USBserial1:9600 8DATABITS NONE 1STOPBIT banner
    2012:telnet:600:/dev/USBserial2:9600 8DATABITS NONE 1STOPBIT banner
    6013:telnet:600:/dev/USBserial3:115200 8DATABITS NONE 1STOPBIT banner
    6014:telnet:600:/dev/USBserial4:115200 8DATABITS NONE 1STOPBIT banner
    2015:telnet:600:/dev/USBserial5:9600 8DATABITS NONE 1STOPBIT banner
    2016:telnet:600:/dev/USBserial6:9600 8DATABITS NONE 1STOPBIT banner
    6017:telnet:600:/dev/USBserial7:115200 8DATABITS NONE 1STOPBIT banner
    
    If one wants to authenticate for a given serial port with an ssh key, all you need to do is put the appropriate key into the authorized_keys file of the appropriate account, and you’re all set. I do sincerely hope that I didn’t put any blatant security goofs into this setup, but if I did, you’ll tell me in the comments, right? Just one more challenge for my valued readers: The port numbers in my ser2net.conf have a system. Can you explain it to me?

    Russell Coker: BIND Stats

    In Debian the BIND server will by default append statistics to the file /var/cache/bind/named.stats when the command rndc stats (which seems to be undocumented) is run. The default for RHEL4 seems to be /var/named/chroot/var/named/data/named_stats.txt. The output will include the time-stamp of the log in the number of seconds since 1970-01-01 00:00:00 UTC (see my previous post explaining how to convert this to a regular date format [1]). By default this only logs a summary for all zones, which is not particularly useful if you have multiple zones. If you edit the BIND configuration and put zone-statistics 1; in the options section then it will log separate statistics for each zone. Unfortunately if you add this and apply the change via rndc reload I don’t know of any convenient way that you can determine when this change was made and therefore the period of time for which the per-zone statistics were kept. So after applying this to my servers I restarted the named processes so that it will be obvious from the process start time when the statistics started. The reason I became interested in this is when a member of a mailing list that I subscribe to was considering the DNSMadeEasy.com service. That company runs primary DNS servers for $US15 per annum which allows 1,000,000 queries per month, 3 zones, and 120 records (for either a primary or a secondary server). Based on three hours of statistics it seems like my zone coker.com.au is going to get about 360,000 queries a month (between both the primary and the secondary server). So the $15 a year package could accommodate 3 such zones for either primary or secondary (they each got about half the traffic). I’m not considering outsourcing my DNS, but it is interesting to consider how the various offers add up. Another possibility for people who are considering DNS outsourcing is Xname.org which provides free DNS (primary and secondary) but request contributions from business customers (or anyone else). Updated because I first published it without getting stats from my secondary server.

    4 June 2008

    Zak B. Elep: Making Net-Akismet play with TypePad AntiSpam

    I've been getting a lot of blog spam lately; it appears that Akismet is slipping. Fortunately, there's a new Akismet-compatible alternative at TypePad AntiSpam which I read about from Justin Mason's post. And it being perl, I decided to try it out here on my blog (never mind it being Blosxom, as long as it uses Frank Hecker's feedback plugin that in turn uses Net::Akismet. But alas, the current version of Net::Akismet doesn't support user-supplied REST endpoints, so I added it, and promptly filed a report on the CPAN. Hopefully it gets included in the next release very soon. As for the Blosxom feedback plugin, tweaking it to use the new feature in Net::Akismet was a cinch, so only the real test (of incoming spam filtered by TypePad) remains. Hopefully it does work. [PS: Looks like the first line in blosxom posts don't like package-like names such as Net::Akismet (during editing my blog title disappeared on the render!) Needs to be looked at later...]

    3 June 2008

    Marc 'Zugschlus' Haber: Serial Console Server for the Poor I

    The serial port is still the way to access network components out of band. It is slow, but reliable, and remarkably well standardized. It does not have technical whiz-bangs that can fail when one needs things to just work. That makes it the natural way to access critical infrastructure and still being sure that this access vector still works when most other things are down. Every communication link has two sides, so there is a market for devices with a network link and a bigger number of serial ports to connect the actual devices to. Commercial vendors have a broad choice of serial console servers. Most of them, especially the small products with five to ten ports, are quite expensive, so I have been investigating how do build a serial console server with el cheapo hardware. USB comes to mind here, of course.
    Picture of the fully equipped USB hub
    The hardware side is actually quite easy: A seven-port USB hub, and seven USB-to-serial adaptors (using the widely-deployed Prolific PL2303) are easily purchased for well below a hundred Euros, and naively connected. In my test setup, connected to the hp compaq nc8000 that my blog readers should know only too well by now, the hub does not even need to have its power supply connected. The notebook can power the hub and the seven adaptors just fine. When the UMTS card is plugged in, the ttyUSBx device nodes appear in the order of plugging in the devices. When the system is booted, the order is not very predictable, so one needs - again - udev to give predictable device node names. udevinfo is an important tool to obtain the data set of an USB device which is available to match a device and to act appropriately when it is connected. udevinfo sorts the devices into a tree and shows the relationship of the devices, which device is “behind” which other device from the system’s point of view. udevinfo’s output starts at the leaf of the device tree and shows the information for each node up the tree until its root is reached. One pitfall is that one can only match against the leaf and _one_ other node more up the tree. So you cannot do matches like “the pl2303-based device connected to port 3 on hub 2-3 will be designated USBserial3”. If you try this, your rule will silently be ignored. This is a major turn-off in udev’s implementation. I didn’t try it on sid, but etch definetely shows this behavior. So one can only match like “the tty on the USB subsystem connected to port 3 on hub 2-3 will be designated USBserial3”, but that’s probably as good as it’ll get. The cause for my hub having only seven ports clearly shows itself when one looks at the udevinfo outputs of the fully equipped USB hub: The adapters are connected to ports 1, 2, 3, 4.1, 4.2, 4.3 and 4.4. The seven-port hub is actually two four-port hubs in a single case, with the second one connected to the first one’s port 4. This reflects itself, of course, in the udev rules necessary to address the adapters by the hub port they’re plugged in:
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.1”, \
       SYMLINK=“USBserial1”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.2”, \
       SYMLINK=“USBserial2”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.3”, \
       SYMLINK=“USBserial3”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.4.1”, \
       SYMLINK=“USBserial4”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.4.2”, \
       SYMLINK=“USBserial5”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.4.3”, \
       SYMLINK=“USBserial6”
    SUBSYSTEM==“tty”, SUBSYSTEMS==“usb”, DRIVERS==“usb”, \
       KERNELS==“*-*.4.4”, \
       SYMLINK=“USBserial7”
    
    These rules will only work for a similary structured hub that is directly connected to the notebook. If there are more hubs in between the “final” hub and the host, the address matched against in the KERNELS matches are going to have a different structure. In the test setup, the first two parts of the address needed to be wildcarded since these addresses keep changing when the host is booted or the hub plugged out and in. So I guess that these udev rules are probably going to fail miserably when more hubs and/or USB-to-serial adaptors are connected. But if one does not do too many changes, things are just fine, and it is possible to put numbers on the USB hub ports and be sure that the USB-to-serial adaptor connected to port 4 is going to be /dev/USBserial4 in the host system. I tried plugging in and out the adaptors in random order, unplugged and plugged the hub itself, booted the host, and the relationship between the port and the device node was stable. In the test environment, I only tested one adapter at a time, but all these tests were successful as well. I guess that many more of these adaptors will eventually need a powered USB hub, but with seven adaptors on a single hub, the power from the USB host is sufficient to live without extra power on the hub. And, I guess, there is some hard limit for the number of USB adapters being used, and some soft limit when managing the ports and adapters is going to get harder. But, I think that a site in need of more than, say, sixteen serial ports on the console server can afford a “real” console server from one of the major vendors, which can be accessed via ethernet, UMTS, ISDN and whatever you can think of. This concludes the hardware part of my serial console server for the poor. Tomorrow, I’ll blog about the software side needed on the host to allow the serial ports to be accessed from the network while still being reasonably secure. The next article will involve ssh, /etc/passwd shells, /etc/shells, a small perl script, ser2net and telnet. And, shell escape is the cue word for grey hairs sprouting on my head.

    2 June 2008

    Luciano Bello: looking for a sponsor to travel to defcon16

    The last weeks have been very active. A lot of e-mails from people and magazines, a lot of congratulations and a lot of free beer made me feel like a rock star :) Thanks a lot to everyone. I really appreciated that.

    And maybe this petition would sound you like an abuse of this situation. And maybe you are right.

    The fact is, I need an sponsor to travel to Defcon16, in Las Vegas, the next August. I need a flight ticket, 3 or 4 nights in a hotel and 2 meals per day.

    I've been accepted to explain the Debian/OpenSSL problem and I'm dying to be there. If you work for a company which is looking for a nice way to say "thank you", please consider this option :)

    Contact me at luciano <alt+64> debian.org for more details. Thanks.

    update (13 minutes later): I just received confirmation from the Black Hat organization to be an alternative speaker there too! So I will need to fund 5 extra nights... :D

    Russ Allbery: podlators 2.1.0

    Switching to Perl 5.10 for Debian unstable uncovered a bunch of little problems with the Pod::Man based on Pod::Simple that's included with it. I've unfortunately been slow to fix those problems due to being buried in other work, but this release finally cleans up the ones that have been reported, namely: However, the big change is that pod2man now supports a -u (--utf8) option saying to not munge input characters into ASCII and *roff escapes that only work with troff and instead output literal UTF-8 characters and assume one's man program can cope. This will now be true of Debian as of lenny. I have no good ideas for how to do the transition, since the resulting *roff is not portable and, if copied to another system, can even cause deficient nroff programs to segfault. One of the goals of Pod::Man was always to produce portable *roff output, so this option is not the default. However, it is clearly the Right Thing To Do for systems whose man and/or nroff are sufficiently intelligent; any other option either requires embedding groff-specific character escapes (same portability problem) or corrupting non-ASCII characters badly (the previous approach). Any bright ideas welcome. In the meantime, people who know they're working on systems with modern nroff and man can at least get correct output now. Hopefully podlators 2.1.0 will make it into lenny (as part of the Perl package, since it's a Perl core module), either as 5.10.1 if upstream is fast enough or as a Debian-local modification. (We definitely need a new Perl release before lenny; #480428 would be embarassing and is already driving me nuts by producing spurious output from lots of cron jobs. I'm thinking about asking for an upgrade of the priority.)

    Next.

    Previous.