All mail clients suck. Some just suck less. But they all have their own peculiarities. mutt, for instance, is a full-featured text-mode mail client. As such, it's pretty popular amongst many Linux enthousiasts, including me. A common error made amongst mutt users is to talk about attaching a file in a mail, but then forgetting to actually do so afterwards. This is because mutt starts an external editor to allow you to edit the message in question, which since it's not mutt itself would seem to make it impossible to attach a file while you're editing a mail, requiring one to remember to actually perform the attach step. One solution to this problem could be to use the little script that Steve wrote, which will complain if you mention something about an attachment in a mail without actually attaching anything. While I'm sure it works to some extent, this kind of script has the downside that it's never going to be 100% correct in all cases (you might mistype the word 'attach', or you might use another word that you didn't think about when you wrote the script, or you might be replying to someone who sent you an attachment). However, a better way could be to realize that mutt does, actually, support attaching files while you're editing a mail text, by way of the 'Attach:' pseudo-header. It requires two steps:

1. Make sure that you have set 'edit_headers' to 'yes' in your configuration. This will cause mutt to fire your editor on a file that also contains the (relevant) headers for your mail, rather than just the body.
2. When you want to attach a file, rather than trying to remember to do so after exiting your editor, just add an 'Attach:' header to the headers section of your mail, with as argument a filename optionally followed by a description. When mutt finds that header, it'll attach the named file, and all is well.

Yes, of course, that does mean you'll have to change your habits, and actually remember to add the damn pseudo-header rather than be like me and still forget to attach files. But hey, can't help you with that.

Yesterday I released version 4 of dh-autoreconf, fixing two bugs, and introducing a new feature: Patching ltmain.sh to make -Wl, as-needed work. For this new feature, run dh_autoreconf with the as-needed option. dh_autoreconf will then patch all ltmain.sh equal to the system one (which should be all ltmain.sh files if libtoolize ran before or via dh_autoreconf). On clean, dh_autoreconf_clean reverses the patch again. So, if your package runs autoreconf, and patches ltmain.sh via a patch you can now do this automatically via dh-autoreconf and be future-proof. The only problem is that this might break once the patch no longer applies to libtool, at which point I need to update the package to include an updated patch. A solution for this problem would be to include the patch in libtool itself, as I proposed in Bug#347650. In case this works well, the option could also become the default which would make things even easier.
Filed under: Debian

You can see it from my blog activity as well, I simply lack time for lot of things. My Gammu mail folders are horribly full of unread mail, it took me there three months to release a new testing version and there are still some patches pending for review. On phpMyAdmin side I spend most time with my GSoC students, who progress really well, but that's pretty much all I can do there. The good news is that phpmyadmin.cz website has new maintainer and is again getting new content. Hopefully it will stay alive for longer time to bring back lost visitors. My Debian contributions are in still pretty good shape and I manage to fix important bugs, though my MPD related packages are still for sale. Still considering whether to go or not to go to Debconf, my decision will be probably based on fact whether I will get travel sponsorship or not (and when it would happen). Besides these free software activities I began to be more active in Spole n aktivity (in Czech) project for organizing various activities to spend free time. Occasionally I also contribute to OpenStretMap, but it's more or less random time when I notice something is wrong or when I manage to visit some place which is not that good mapped. The good thing is that Prague is pretty good shape there, so it does not motivate me to spend too much time on this :-). And of course there is my work at SUSE, working on usual L3 front and improving our Django based incident tracking tool. Maybe I should step down from some of these, but it would be pretty hard for me to choose which one...

Filed under: Debian English Gammu Phpmyadmin 2 comments Flattr this!

Craig Small gives a very bad advice on his recent post Debian Linux on HP DV6-6023TX. As soon as one loads such a binary graphics driver your Linux kernel is marked as tainted. Due to be running a proprietary module your box may behave strangely and is certainly not debuggable. Be aware that in such a case you are no longer running a free and open OS. What he actually wants is a very recent 3.0 linux image from experimental and to google for vga switcheroo, which leads to the following commit with explanations for /sys/kernel/debug/vgaswitcheroo/switch: vga_switcheroo: initial implementation (v15).

In a recently published article, Paul Vixie, past author and architect of BIND, one of the most popular internet domain server, explains why DNS servers should use anycast for increased reliability and faster answers. The main argument against unicast is that some resolvers may not be smart enough to select the best server to query and therefore, they may select a server on the other side of the planet. Since, you cannot go faster than light, you get a penalty of about 100 milliseconds in this case.

Unicast & anycast Most addresses that you handle are unicast addresses, i.e. the address of a single receiver. Any time you send a packet to an unicast address, it will be forwarded to this single receiver. Another common network addressing system is multicast (which happens to include broadcast). When you send a packet to a multicast address, several receivers may get it. The packet is copied as needed by some nodes. Anycast addresses allow you to send a packet to a set of receivers but only one of them will receive it. The packet will not be copied. Usually, the idea behind anycast is that the packet is sent to the nearest receiver. There is no universal way to determine if an IP address is an unicast address or an anycast address just by looking at it. For example 192.5.5.241 is an anycast address while 78.47.78.132 is an unicast address. ISC, which maintains BIND, operates the F root domain server, one of the 13 Internet root name servers. This server is queried by using 192.5.5.241 IPv4 anycast address or 2001:500:2f::f IPv6 anycast address. ISC has published a document explaining how anycast works. Several nodes around the globe announces the same subnet using BGP. When one router running BGP has to send a query to the anycast address, it will have several choices in its BGP table. It will usually select the shortest path and route the query to the corresponding router. Some nodes may choose to restrict the announcement about the subnet containing the anycast address. They are called local nodes (by opposition to other global nodes). This allows them to serve query only from their clients and use cheaper connectivity and hardware.

Lab Let s play with anycast by setting up a lab to experiment with it. We want to setup an IPv6 anycast DNS service using two global nodes, G1 and G2, and one local node, L1. We build some kind of mini-Internet. See :

Setting up the lab This lab will use UML guests for all nodes. For more details on how this works, look at my previous article about network labs with User Mode Linux. You first need to grab the lab:

$ git clone https://vincentbernat@github.com/vincentbernat/network-lab.git
$ cd network-lab/lab-anycast-dns
$ ./setup

You will need to install the dependencies needed by the script on your host system. The script was tested on Debian unstable. If some of the dependencies do not exist in your distribution, if they don t behave as in Debian or if you don t want to install them on your host system, you can use debootstrap to create a working system:

$ sudo debootstrap sid ./sid-chroot http://ftp.debian.org/debian/
[...]
$ sudo chroot ./sid-chroot /bin/bash
# apt-get install iproute zsh aufs-tools
[...]
# apt-get install bird6
[...]
# exit
$ sudo mkdir -p ./sid-chroot/$HOME
$ sudo chown $(whoami) ./sid-chroot/$HOME
$ ROOT=./sid-chroot ./setup

We are running a lot of UML guests in this lab. We assign 64 MB to each host. UML guests do not use host memory until they need it but because of cache subsystem, you can expect that each guest will use 64 MB of memory. This means that you need about 2 GB of RAM to run this lab. Moreover, each guest will create a file representing its memory. Therefore, you need about 2 GB of free space in /tmp too. Routers are named after their AS number. The router of AS 64652 is just 64652. Paris, NewYork and Tokyo are the exception. The lab will use only one switch but we will use VLAN to create several L2 networks. Each link in our schema is an L2 network. Each link will get its own L3 network. Those networks are prefixed with 2001:db8:ffff:. Leaf AS have their own L3 network 2001:db8:X::/48 where X is the AS number minus 60000. Look at /etc/hosts on each host to get the IP of all hosts.

Mini-Internet routing AS 64600 is some kind of Tier-1 transit network (like Level 3 Communications). It has three points of presence: Paris, New York and Tokyo. AS 64650 is an European regional transit network, AS 64640 is an East Asian regional transit network and AS 64610, 64620 and 64630 are North American regional transit network which are peering each other. Other leaf AS are local ISP. This is not really what Internet looks like but shaping our lab like a tree allows us to not deal with a lot of BGP stuff: we ensure that the shortest path (in number of BGP hops) from one client to one server is the best path. Each BGP router will get a basic BGP configuration containing only the list of peers. Since Paris, Tokyo and NewYork are in the same AS, they will use iBGP. They are fully meshed for this purpose but this does not provide redundancy because iBGP routes are not redistributed inside iBGP. A more complex setup would be needed to provide redundancy inside AS 64600. We don t use an IGP inside leaf AS as we should: for the sake of simplicity, we redistribute directly connected routes into BGP. While in my previous lab, I used Quagga, I will use BIRD in this one. It is a more modern daemon with a clean design on how routing tables may interact. It also performs better. However, it lacks several features from Quagga. The configuration for BIRD is autogenerated from /etc/hosts. We use only one routing table inside BIRD. This table will be exported to the kernel and to any BGP instance. Some directly connected routes will be imported (those representing client networks) as well as all routes from BGP instances. Here is an excerpt of 64610 s configuration:

protocol direct  
   description "Client networks";
   import filter  
     if net ~ [ 2001:db8:4600::/40 40,48  ] then accept;
     reject;
    ;
   export none;
 
protocol kernel  
   persist;
   import none;
   export all;
 
protocol bgp  
   description "BGP with peer NewYork";
   local as 64610;
   neighbor 2001:db8:ffff:4600:4610::1 as 64600;
   gateway direct;
   hold time 30;
   export all;
   import all;
 

We do not export inter-router subnets to keep our routing tables small. This also means that those IP addresses are not routable in spite of the use of public IP addresses. Here is the routing table as seen by 64610 (use birdc6 to connect to BIRD):

bird> show route
2001:db8:4622::/48 via 2001:db8:ffff:4610:4620::2 on eth3 [bgp4 18:52] * (100) [AS64622i]
                   via 2001:db8:ffff:4600:4610::1 on eth0 [bgp1 18:52] (100) [AS64622i]
2001:db8:4621::/48 via 2001:db8:ffff:4610:4620::2 on eth3 [bgp4 18:52] * (100) [AS64621i]
                   via 2001:db8:ffff:4600:4610::1 on eth0 [bgp1 18:52] (100) [AS64621i]
2001:db8:4612::/48 via 2001:db8:ffff:4610:4612::2 on eth2 [bgp3 18:52] * (100) [AS64612i]
2001:db8:4611::/48 via 2001:db8:ffff:4610:4611::2 on eth1 [bgp2 18:52] * (100) [AS64611i]

As you can notice, it knows several paths to the same network, however, it only selects the best one (based on the length of the AS path):

bird> show route 2001:db8:4622::/48 all
2001:db8:4622::/48 via 2001:db8:ffff:4610:4620::2 on eth3 [bgp4 18:52] * (100) [AS64622i]
        Type: BGP unicast univ
        BGP.origin: IGP
        BGP.as_path: 64620 64622
        BGP.next_hop: 2001:db8:ffff:4610:4620::2 fe80::e05f:a3ff:fef2:f4e0
        BGP.local_pref: 100
                   via 2001:db8:ffff:4600:4610::1 on eth0 [bgp1 18:52] (100) [AS64622i]
        Type: BGP unicast univ
        BGP.origin: IGP
        BGP.as_path: 64600 64620 64622
        BGP.next_hop: 2001:db8:ffff:4600:4610::1 fe80::3426:63ff:fe5e:afbd
        BGP.local_pref: 100

Let s check that everything works with traceroute6 on C1:

# traceroute6 G2.lab
traceroute to G2.lab (2001:db8:4612::2:53), 30 hops max, 80 byte packets
 1  64652-eth1.lab (2001:db8:4652::1)  -338.277 ms  -338.449 ms  -338.502 ms
 2  64650-eth2.lab (2001:db8:ffff:4650:4652::1)  -338.324 ms  -338.363 ms  -338.384 ms
 3  Paris-eth2.lab (2001:db8:ffff:4600:4650::1)  -338.191 ms  -338.329 ms  -338.282 ms
 4  NewYork-eth0.lab (2001:db8:ffff:4600:4600:1:0:2)  -338.144 ms  -338.182 ms  -338.235 ms
 5  64610-eth0.lab (2001:db8:ffff:4600:4610::2)  -338.078 ms  -337.958 ms  -337.944 ms
 6  64612-eth0.lab (2001:db8:ffff:4610:4612::2)  -337.778 ms  -338.103 ms  -338.041 ms
 7  G2.lab (2001:db8:4612::2:53)  -338.001 ms  -338.045 ms  -338.080 ms

Let s see what happens if we shut the link between NewYork and 64610. This link is VLAN 10. Since vde_switch does not allow to shut a port, we will change the VLAN of port 9 to VLAN 4093. After at most 30 seconds, the BGP session between NewYork and 64610 will be torn down and packets from C1 to G2 will take a new path:

# traceroute6 G2.lab
traceroute to G2.lab (2001:db8:4612::2:53), 30 hops max, 80 byte packets
 1  64652-eth1.lab (2001:db8:4652::1)  -338.382 ms  -338.499 ms  -338.503 ms
 2  64650-eth2.lab (2001:db8:ffff:4650:4652::1)  -338.284 ms  -338.317 ms  -338.151 ms
 3  Paris-eth2.lab (2001:db8:ffff:4600:4650::1)  -337.954 ms  -338.031 ms  -337.924 ms
 4  NewYork-eth0.lab (2001:db8:ffff:4600:4600:1:0:2)  -337.655 ms  -337.751 ms  -337.844 ms
 5  64620-eth0.lab (2001:db8:ffff:4600:4620::2)  -337.762 ms  -337.507 ms  -337.611 ms
 6  64610-eth3.lab (2001:db8:ffff:4610:4620::1)  -337.531 ms  -338.024 ms  -337.998 ms
 7  64612-eth0.lab (2001:db8:ffff:4610:4612::2)  -337.860 ms  -337.931 ms  -337.992 ms
 8  G2.lab (2001:db8:4612::2:53)  -337.863 ms  -337.768 ms  -337.808 ms

Setting up anycast DNS Our anycast DNS service has three nodes. Two global ones, located in Europe and North America and one local one targeted at customers of AS 64620 only. The IP address of this anycast DNS server is 2001:db8:aaaa::53/48. We assign this address to G1, G2 and L1. We also assign 2001:db8:aaaa::1/48 to 64651, 64612 and 64621. BIRD configuration is adapted to advertise this network:

protocol direct  
   description "Client networks";
   import filter  
     if net ~ [ 2001:db8:4600::/40 40,48  ] then accept;
     if net ~ [ 2001:db8:aaaa::/48 ] then accept;
     reject;
    ;
   export none;
 

We use NSD as a name server. This is an authoritative only name server. The configuration is pretty simple. We just ensure that it is bound to the IPv6 anycast address (otherwise, it may answer with the wrong address). The zone file is customized to answer the name of the server:

#(C1) host -t TXT example.com 2001:db8:aaaa::53
Using domain server:
Name: 2001:db8:aaaa::53
Address: 2001:db8:aaaa::53#53
Aliases:
example.com descriptive text "G1"
#(C5) host -t TXT example.com 2001:db8:aaaa::53
Using domain server:
Name: 2001:db8:aaaa::53
Address: 2001:db8:aaaa::53#53
Aliases:
example.com descriptive text "G2"

If we try from C3, we may be redirected to L1 while we are not a customer of AS 64620. A common way to handle this is to let 64621 tag the route with a special community that will let know 64620 that the route should not be exported.

protocol direct  
   description "Client networks";
   import filter  
     if net ~ [ 2001:db8:4600::/40 40,48  ] then accept;
     if net ~ [ 2001:db8:aaaa::/48 ] then  
          bgp_community.add((65535,65281));
          accept;
      
     reject;
    ;
   export none;
 

The community used is known as the no-export community. BIRD knows how to handle it. However, we hit here some limitations of BIRD:

1. The correct way to let 64622 knows about this route is to build a BGP confederation for AS 64620 and let AS 64622 and AS 64621 be part of it. This means that those three AS will be seen as AS 64200 from outside of the confederation. Moreover, the no-export community would allow to export the route only within the confederation. This is exactly what we need but BIRD does not support confederations.
2. BIRD first selects the best route to export then apply filtering. This means that even if 64620 knows non-filtered route to 2001:db8:aaaa::/48, it will select the route to L1, filter it out and export nothing to 64622.

Therefore, we need to fallback to ask BIRD to not export the route to AS 64600, 64610 and 64630 on 64620. We could use a special community to filter out the route but we keep it simple and just filter the route directly.

filter keep_local_dns  
   if net ~ [ 2001:db8:aaaa::/48 ] then reject;
   accept;
 
protocol bgp  
   description "BGP with peer NewYork";
   local as 64620;
   neighbor 2001:db8:ffff:4600:4620::1 as 64600;
   gateway direct;
   hold time 30;
   export filter keep_local_dns;
   import all;
 

Voil . Only C4 will be able to query L1. If AS 64621 is missing, it will query G2 instead. One major point about anycast is to know that redundancy is done at the AS level only. If the name server on L1 does not work correctly, requests will still be routed to it. Therefore, with anycast, you still need to provide redundancy inside each AS (or stop advertising the anycast network as soon as there is a failure).

Beyond DNS Anycast can be used to serve HTTP requests too. This is less commonly used because your connection may be rerouted to another node while it is still running. This is not a problem with DNS because there is no connection (you send a query, you receive an answer). There are at least two CDN (MaxCDN and CacheFly) which uses anycast to ensure low roundtrip time and very high reliability. Setting up an HTTP server with an anycast address is no different than setting up a DNS server. However, you need to ensure maximum stability of the routing path to avoid the connection to be dropped while running. I suppose that this is done by hiring some high-level BGP expert. You can also mix unicast and anycast:

• anycast DNS answers the IP address of a nearby unicast HTTP server, or
• anycast DNS answers the IP address of an anycast HTTP server that will issue a redirect to an unicast HTTP server when downloading or streaming large files.

Last year the Psychologist and Baptist minister George Rekers who is famous for anti-homosexuality pseudo-science was discovered to be hiring gay escorts from Rentboy.com. Lots of LULZ there. But the story didn t end there. It turns out that George Rekers did some research on a child who ended up committing suicide as an adult, and the circumstantial evidence suggests that George s actions are directly related to the suicide [1]. The Rentboy.com affair doesn t seem so funny now. The Box Turtle Bulletin has a series of articles about Kirk Andrew Murphy s suicide and the roles of George Rekers and Richard Green in all of this [2], the articles are well written and generally appear to be well researched I recommend reading the articles if you can stomach them (lots of nasty stuff is described). The section answering the question of who s responsible for the mistreatment of Kirk Andrew Murphy [3] where they describe the use of ABA (AKA the Lovaas Technique) is interesting. Ivar Lovaas worked with George Rekers in such research and published a paper with him. The term ABA gets an immediate hostile reaction in the Autism community, but until now I hadn t realised why so many people hate it so much. It seems that to some extent I made the classic mistake of misjudging the reports of Autistic people who are unable to present their case well (as opposed to the psychologists who can present any position very well even if it s utterly insane). In the past I had the impression that ABA wasn t inherently bad, it was just implemented in a bad way in some cases now it seems that ABA was designed in an evil way right from the start. There is one massive problem with the Box Turtle analysis, he says Behavioral analysts don t dig around much into people s feelings, fears, dreams, family relationships or childhood memories. Indeed, in cases like autism, Lovaas s specialty, those avenues of exploration would be irrelevant . It could be that Jim Burroway (the Box Turtle writer) is merely quoting someone else without attribution, but even so saying that the feelings, fears, and dreams of a group of people are irrelevant is just awful, a statement that denies the humanity of a group of people can t be quoted without further explanation. In his article about ABA Jim refers to childhood Autism as a condition for which there is no hope for interior change [4]. I m not sure if he s just saying that Autistic children are incapable of learning or whether it s all Autistic people, in either case it s nonsense in terms of science and nasty as well. Generally I expect that members of various minority groups will show more sympathy to each other than they receive from the general population. Jim s posts are a great disappointment. I understand that he would be rather stressed about the horrible things that George Rekers et al did, but even so he should be able to avoid that sort of thing. Jim is obviously a very talented writer and can do better. One might think that Jim s posts use the word Autism to refer only to the people who are non-verbal (or in other ways less capable than the huge number of Autistic people who work for companies like Google and IBM). But that s no excuse either. You can find blogs and essays written by non-verbal Autistic people that describe their experiences if you care to search for them. It s obvious that they are people too and deserve to be treated as people not objects. Abusing Autistic children to try and make them impersonate NT children is no less evil than abusing children who don t fit gender norms.

• [1] http://edition.cnn.com/2011/US/06/08/rekers.sissy.boy.experiment/
• [2] http://www.boxturtlebulletin.com/what-are-little-boys-made-of-main
• [3] http://www.boxturtlebulletin.com/cuius_culpa
• [4] http://www.boxturtlebulletin.com/blind-mans-bluff

This is a follow-up on TDebs with some detail of how existing packages can be adapted to support TDebs.

$ cat debian/package-tdeb.tdeb

[gettextdir] po
[gettextname] package
[po4apodir] doc/po
[po4amandir] doc/package/man/
[po4acommand] po4a-build


What's happening then? Well, the first thing to take into account is that a lot of the values for these settings will be dictated by upstream, which is why it is necessary for maintainers to add this information as a support file in debian/. I tried determining all this information automatically but the script got far too long and still was far from complete.

• gettextdir - usually po but some upstream packages can support multiple po generation, so this allows for those.
• gettextname - the hardest thing to identify reliably, this is the name of the files to be installed in /usr/share/locale/lang/LC_MESSAGES/ and the name of the of the POT file.
• po4apodir - po4a is for documentation translation support, which is more variable, so a po4acommand field is available too.

Other changes
The (currently unsupported in Debian) XC-Package-Type: tdeb option is used in debian/control to mark a new or existing package as a TDeb. To use an existing package, it must comply with the rules for a TDeb including that it must be Architecture: all. The other rules centre around build issues. If any of the files in the existing package would require execution of any part of the normal build process of the package, these would have to be moved out of the package before that package could be a TDeb. The reason is that TDeb generation by translators needs to not require a full build environment for every individual package and must not risk modifying package contents in ways which are related to the build environment. So, unchanged images and other architecture-independent files are OK, any files which need build-dependencies are a problem. I don't know how many packages there are out there with such files. If you have a -data or -common package which contains translated data and that package also includes architecture-independent files, I'd be interested in knowing the name of the packages involved. If those packages also include files which are generated or modified within the package build, I'll be particularly interested in knowing about those source packages.
debconf
The most common use of TDebs during a release cycle is probably going to be debconf template updates by Christian and these are handled without needing a listing in the .tdeb file.
Other formats
I'm looking at QtLinguist support and it should be fairly straightforward using the .tdeb file arrangement.

Once that's done (in a branch, please - these can't be uploaded yet), the package can be tested with the soon-to-be-uploaded emdebian-tdeb package. The old content has been moved into the emdebian-grip-server package and the dependencies of the old version stripped back. The package contains two scripts dpkg-gentdeb and dh_gentdeb which I hope to get included into the respective packages in time for Wheezy. The idea will be that build systems (dh7, CDBS, debhelper-plain etc.) includes a call to the relevant script. (dh_ is just a wrapper around dpkg- in this case). This would allow maintainers to create the first TDeb, get that through NEW and then the fun starts. Once the translation mechanism is set up, I would like a nominated person (likely to be Christian if he agrees) to co-ordinate translation updates for particular packages to allow for a single upload including updates for many translations. This would be package_version+t1_all.tdeb and an appropriate .diff.gz or debian.tar.gz. No binary upload, no impact on testing migrations.

This is mostly theory right now but the scripts do exist in Emdebian SVN.

Still more testing to do but I hope to upload these scripts to unstable in the next few days.

A stumbled across Start Com a few months ago, an Israeli company that run a Certificate Authority (CA) called StartSSL with a root certificate in all the modern browsers and operating systems. Best of all they don t participate in the cartel run by the rest of the SSL certificate industry and offer domain validated certificates at the price it costs them to issue them nothing. I had the first opportunity to use their services today when I needed an SSL cert to secure the IMAP server I run for my parents and I was very pleased with the experience. The web interface is a bit weird and you have to jump through some strange hoops, but to save paying more money to the SSL certificate cartel it seemed more than worthwhile. Like most CAs these days the certificate which signs your server certificate is not the actual root certificate included in your operating system or browser, but an intermediate CA certificate which is in turn signed by the root certificate. This means that you have to ensure that your server includes the intermediate CA certificate alongside the server certificate so the client can validate the entire path back to the root. Unlike Apache which explicitly allows you to specify a certificate chain file, the openssl methods used by Cyrus 2.2 only seem to recognise a single CA certificate in the file pointed to by tls_ca_file. All as not lost however, as the openssl libraries are actually quite smart and will automagically determine which intermediate certs they need to bundle into the handshake if you install them appropriately under /etc/ssl/certs (at least on Debian). The trick is that you have to install the intermediate CA cert into a file named after the hash of the certificate, like so:

# wget http://www.startssl.com/certs/sub.class1.server.ca.pem -O /etc/ssl/certs/startcom-class1-intermediate.pem
# hash=$(openssl x509 -hash -noout -in /etc/ssl/certs/startcom-class1-intermediate.pem)
# ln -s ./startcom-class1-intermediate.pem /etc/ssl/certs/$ hash .0
# ls -l /etc/ssl/certs/$ hash .0
lrwxrwxrwx 1 root root 34 2011-06-13 07:43 /etc/ssl/certs/ea59305e.0 -> ./startcom-class1-intermediate.pem
Then in imapd.conf:

tls_cert_file: /etc/ssl/certs/your-server-cert.pem
tls_key_file: /etc/ssl/private/your-server-key.key
tls_ca_file: /etc/ssl/certs/startcom-ca.pem
Voila. Works everywhere I ve tried so far. Start Com Highly Recommended. I ll be using them for any future SSL certificate purchases (e.g. EV certs) that I need to make.

I already blogged about S3TC support with Wine, but back then I wrote about problems to get that working on amd64 without a proprietary driver. Now I've figured out a way to get it working on amd64 with the free radeon drivers (Gallium versions). It's actually pretty simple, as most things are, once you figured it out. For 64 bit applications, you just need a recent Mesa version and the package libtxc-dxtn0. If you're using a card supported by the r600g driver, you first need a version of the Mesa package, which is build with the Gallium version of the r600 driver (the classic driver should work too, but I haven't tested that), like my unofficial Mesa packages (those packages were built for testing r600g, see this e-mail to debian-x). r600g users also need to set R600_S3TC_ENABLE=1, otherwise the driver won't attempt to load libtxc-dxtn0. For 32 bit applications (like Windows games run with Wine) the initial setup is a little bit more involved: in addition to the above you also need to update a few libraries under /usr/lib32: namely Mesa and libdrm (if you use my Mesa packages you need a i386 copy of libffi too). The quick and dirty approach is to download the i386 packages for libgl1-mesa-dri, libgl1-mesa-glx, libglu1-mesa, libdrm2, libdrm-intel1, libdrm-radeon1 and (if you use my Mesa build) libffi5. Unpack the packages (dpkg-deb -x) and move the files under /path/to/unpack/dir/usr/lib to /usr/lib32. Alternatively you can also build a new ia32-libs package (make sure you change the source.list file of ia32-libs to use at least testing as a base, otherwise you'll end up with basically the same versions as are in the current package). No matter how you updated your drivers you now need the 32 bit version of libtxc-dxtn0. debian-multimedia.org offers a packaged version. After installing all the previous packages, Wine should be able to display (most) S3TC-using programs (in case you use the r600g driver, make sure you have R600_S3TC_ENABLE=1 set). If you're using my Mesa builds you can drop the LIBGL_DRIVERS_PATH=/usr/lib32/dri part again from your Wine invocation. Please note, that there might be some S3TC-using applications with graphical glitches, when using the above method, as the support for S3TC in r600g is still marked as WIP.

See comments at the end about this 3rd version This is time again for yet another bubulle game: counting the number of developers per country. I already published such analysis in 2010 and 2009. So, here we are with the June 2011 version, sorted by the ratio of *active* developers per million population for each country.

Act: number of active developers
Dev: total number of developers
A/M: number of active devels per million pop.
D/M: number of devels per million pop.
2009: rank in 2009
2010: rank in 2010
June 2011: rank now

Code	Name	Population	Act Dev	Dev	Act/Million	Dev/Million	2009	2010	June 2011
fi	Finland	5374781	21	31	3,91	5,77	1	1	1
ch	Switzerland	7866500	21	26	2,67	3,31	2	2	2
mq	Martinique	397730	1	1	2,51	2,51			3
no	Norway	4964500	12	15	2,42	3,02	5	4	4
nz	New Zealand	4393500	10	15	2,28	3,41	4	3	5
ie	Ireland	4470700	10	13	2,24	2,91	13	9	6
se	Sweden	9354462	19	35	2,03	3,74	3	6	7
lu	Luxemburg	511840	1	1	1,95	1,95	8	5	8
de	Germany	81802000	155	221	1,89	2,7	7	7	9
at	Austria	8404252	15	25	1,78	2,97	6	8	10
fr	France	63136180	91	119	1,44	1,88	12	12	11
au	Australia	22632213	31	57	1,37	2,52	9	10	12
be	Belgium	11007020	15	17	1,36	1,54	10	11	13
uk	United-Kingdom	62008048	67	106	1,08	1,71	14	14	14
nl	Netherlands	16674600	18	37	1,08	2,22	11	13	15
dk	Denmark	5564219	6	10	1,08	1,8	17	17	16
ca	Canada	34480000	27	57	0,78	1,65	15	15	17
hr	Croatia	4429078	3	3	0,68	0,68	20	18	18
es	Spain	46030109	31	51	0,67	1,11	16	16	19
lt	Lithuania	3225346	2	2	0,62	0,62	28	19	20
cz	Czech Rep	10540748	6	6	0,57	0,57	21	20	21
it	Italy	60605053	33	47	0,54	0,78	23	22	22
bg	Bulgaria	7351254	4	4	0,54	0,54	25	23	23
il	Israel	7602400	4	6	0,53	0,79	24	24	24
us	USA	308745538	162	364	0,52	1,18	19	21	25
hu	Hungary	9979000	5	11	0,5	1,1	18	25	26
lv	Latvia	2245357	1	1	0,45	0,45	26	26	27
uy	Uruguay	3494382	1	2	0,29	0,57	22	27	28
jp	Japan	127960000	33	46	0,26	0,36	30	28	29
pl	Poland	38186860	9	13	0,24	0,34	29	29	30
cr	Costa Rica	4253897	1	1	0,24	0,24	31	30	31
pt	Portugal	10647763	2	4	0,19	0,38	27	32	32
sk	Slovakia	5429763	1	1	0,18	0,18	32	31	33
gr	Greece	11305118	2	3	0,18	0,27	33	38	34
ar	Argentina	40091359	7	9	0,17	0,22	34	33	35
sv	El Salvador	6134000	1	1	0,16	0,16			36
tw	Taiwan	23061689	3	3	0,13	0,13	37	34	37
br	Brazil	190732694	20	21	0,1	0,11	36	35	38
by	Belarus	9648533	1	1	0,1	0,1	35	36	39
mg	Madagascar	20653556	2	2	0,1	0,1	44	37	40
cu	Cuba	11239363	1	1	0,09	0,09		38	41
kr	South Korea	48758000	4	6	0,08	0,12	39	39	42
ec	Ecuador	14790608	1	1	0,07	0,07		40	43
cl	Chile	17224200	1	2	0,06	0,12	42	41	44
ro	Romania	21466174	1	2	0,05	0,09	45	43	45
co	Colombia	45925397	2	3	0,04	0,07	41	44	46
ru	Russia	142905200	6	7	0,04	0,05	43	42	47
za	South Africa	49991300	2	9	0,04	0,18	38	48	48
my	Malaysia	27565821	1	1	0,04	0,04			49
ve	Venezuela	29105632	1	1	0,03	0,03	40	45	50
pe	Peru	29496000	1	1	0,03	0,03	46	46	51
tr	Turkey	73722988	2	2	0,03	0,03	47	47	52
mx	Mexico	112322757	2	2	0,02	0,02	49	49	53
th	Thailand	63878267	1	2	0,02	0,03	50	50	54
eg	Egypt	80085862	1	3	0,01	0,04	51	51	55
in	India	1210193422	8	8	0,01	0,01	52	52	56
cn	China	1339724852	7	11	0,01	0,01	53	53	57
ua	Ukraine	45888000	0	0	0	0	48	53	58
			896	1450	61,79%

A few interesting facts:

• There are active DDs in 57 countries
• Martinique pops up at rank 3. As this French overseas "d partement" has its own ISO code, it is counted here separately from France, though Martinique inhabitants are French citizens. That's of course a though case but I consider that David did choose to use "MQ" in his record, which means this is important for him. Let's respect that wish.
• Norway is now ahead of New Zealand. One more DD since last count
• Sweden is ahead of Luxembourg. Two more DDs since last count
• France takes over Australia and Belgium. *seven* more DDs since last count!
• UK is ahead of Netherlands now. Three more DDs since last count.
• Denmark passes Canada and Spain (50% more DDs for DK), while Croatia passes Spain (because Spain lost 3 DDs).
• USA continues to go down (by 3 this time). We're constantly losing developers over there (-3 in one year).
• And we have a new country in this list as Malaysia now has a Debian developer. Along with Martinique (ahem), this makes two new "countries" in this list. No country disappeared.
• For the first time in 12 years, DebConf will be in a country (Bosnia and Herzegovina) that has NO Debian developer. This has to change.
• We have 23 more active Debian developers and 40 more developers overall.

v2 comment: This is the second version of this blog post. I have been pointed that the population I was using for "Ireland" is indeed the population of the entire island, so Republic of Ireland (Eire) plus Northern Ireland (Ulster). We may guess that people listing "IE" as their country are citizens of the Republic of Ireland, so the population to use is that of this part of the island. As a consequence, Ireland is bumped up to 6th rank instead of 9th. v3 comment: Doh. Since I'm doing this survey, I was always adding people using "sv" as country to Sweden. This is a quite common mistake and it was happening in the past. But now, there is only ONE developer who uses "sv" as country, this is Rene Mayorga and he definitely lives in El Salvador, not Sweden. As a consequence, Sweden lost one developer (but keeps its rank) and El Salvador now appears at rank 36. It is not a "new" country as Rene is DD for quite some time.

See comment at the end about this 2nd version This is time again for yet another bubulle game: counting the number of developers per country. I already published such analysis in 2010 and 2009. So, here we are with the June 2011 version, sorted by the ratio of *active* developers per million population for each country.

Act: number of active developers
Dev: total number of developers
A/M: number of active devels per million pop.
D/M: number of devels per million pop.
2009: rank in 2009
2010: rank in 2010
June 2011: rank now

Code	Name	Population	Act Dev	Dev	Act/Million	Dev/Million	2009	2010	June 2011
fi	Finland	5374781	21	31	3,91	5,77	1	1	1	1
ch	Switzerland	7866500	21	26	2,67	3,31	2	2	2	2
mq	Martinique	397730	1	1	2,51	2,51			3	3
no	Norway	4964500	12	15	2,42	3,02	5	4	4	4
nz	New Zealand	4393500	10	15	2,28	3,41	4	3	5	5
ie	Ireland	4470700	10	13	2,24	2,91	13	9	6	6
se	Sweden	9354462	20	36	2,14	3,85	3	6	7	7
lu	Luxemburg	511840	1	1	1,95	1,95	8	5	8	8
de	Germany	81802000	155	221	1,89	2,7	7	7	9	9
at	Austria	8404252	15	25	1,78	2,97	6	8	10	10
fr	France	63136180	91	119	1,44	1,88	12	12	11	11
au	Australia	22632213	31	57	1,37	2,52	9	10	12	12
be	Belgium	11007020	15	17	1,36	1,54	10	11	13	13
uk	United-Kingdom	62008048	67	106	1,08	1,71	14	14	14	14
nl	Netherlands	16674600	18	37	1,08	2,22	11	13	15	15
dk	Denmark	5564219	6	10	1,08	1,8	17	17	16	16
ca	Canada	34480000	27	57	0,78	1,65	15	15	17	17
hr	Croatia	4429078	3	3	0,68	0,68	20	18	18	18
es	Spain	46030109	31	51	0,67	1,11	16	16	19	19
lt	Lithuania	3225346	2	2	0,62	0,62	28	19	20	20
cz	Czech Rep	10540748	6	6	0,57	0,57	21	20	21	21
it	Italy	60605053	33	47	0,54	0,78	23	22	22	22
bg	Bulgaria	7351254	4	4	0,54	0,54	25	23	23	23
il	Israel	7602400	4	6	0,53	0,79	24	24	24	24
us	USA	308745538	162	364	0,52	1,18	19	21	25	25
hu	Hungary	9979000	5	11	0,5	1,1	18	25	26	26
lv	Latvia	2245357	1	1	0,45	0,45	26	26	27	27
uy	Uruguay	3494382	1	2	0,29	0,57	22	27	28	28
jp	Japan	127960000	33	46	0,26	0,36	30	28	29	29
pl	Poland	38186860	9	13	0,24	0,34	29	29	30	30
cr	Costa Rica	4253897	1	1	0,24	0,24	31	30	31	31
pt	Portugal	10647763	2	4	0,19	0,38	27	32	32	32
sk	Slovakia	5429763	1	1	0,18	0,18	32	31	33	33
gr	Greece	11305118	2	3	0,18	0,27	33	38	34	34
ar	Argentina	40091359	7	9	0,17	0,22	34	33	35	35
tw	Taiwan	23061689	3	3	0,13	0,13	37	34	36	36
br	Brazil	190732694	20	21	0,1	0,11	36	35	37	37
by	Belarus	9648533	1	1	0,1	0,1	35	36	38	38
mg	Madagascar	20653556	2	2	0,1	0,1	44	37	39	39
cu	Cuba	11239363	1	1	0,09	0,09		38	40	40
kr	South Korea	48758000	4	6	0,08	0,12	39	39	41	41
ec	Ecuador	14790608	1	1	0,07	0,07		40	42	42
cl	Chile	17224200	1	2	0,06	0,12	42	41	43	43
ro	Romania	21466174	1	2	0,05	0,09	45	43	44	44
co	Colombia	45925397	2	3	0,04	0,07	41	44	45	45
ru	Russia	142905200	6	7	0,04	0,05	43	42	46	46
za	South Africa	49991300	2	9	0,04	0,18	38	48	47	47
my	Malaysia	27565821	1	1	0,04	0,04			48	48
ve	Venezuela	29105632	1	1	0,03	0,03	40	45	49	49
pe	Peru	29496000	1	1	0,03	0,03	46	46	50	50
tr	Turkey	73722988	2	2	0,03	0,03	47	47	51	51
mx	Mexico	112322757	2	2	0,02	0,02	49	49	52	52
th	Thailand	63878267	1	2	0,02	0,03	50	50	53	53
eg	Egypt	80085862	1	3	0,01	0,04	51	51	54	54
in	India	1210193422	8	8	0,01	0,01	52	52	55	55
cn	China	1339724852	7	11	0,01	0,01	53	53	56	56
ua	Ukraine	45888000	0	0	0	0	48	53	57	57
			896	1450	61,79%

A few interesting facts:

• Martinique pops up at rank 3. As this French overseas "d partement" has its own ISO code, it is counted here separately from France, though Martinique inhabitants are French citizens. That's of course a though case but I consider that David did choose to use "MQ" in his record, which means this is important for him. Let's respect that wish.
• Norway is now ahead of New Zealand. One more DD since last count
• Sweden is ahead of Luxembourg. Two more DDs wince last count
• France takes over Australia and Belgium. *seven* more DDs since last count!
• UK is ahead of Netherlands now. Three more DDs since last count.
• Denmark passes Canada and Spain (50% more DDs for DK), while Croatia passes Spain (because Spain lost 3 DDs).
• USA continues to go down (by 3 this time). We're constantly losing developers over there (-3 in one year).
• And we have a new country in this list as Malaysia now has a Debian developer. Along with Martinique (ahem), this makes two new "countries" in this list. No country disappeared.
• For the first time in 12 years, DebConf will be in a country (Bosnia and Herzegovina) that has NO Debian developer. This has to change.
• We have 23 more active Debian developers and 40 more developers overall.

This is the second version of this blog post. I have been pointed that the population I was using for "Ireland" is indeed the population of the entire island, so Republic of Ireland (Eire) plus Northern Ireland (Ulster). We may guess that people listing "IE" as their country are citizens of the Republic of Ireland, so the population to use is that of this part of the island. As a consequence, Ireland is bumped up to 6th rank instead of 9th.

The DreamPlug is like a GuruPlug Server-Plus with a few notable differences:

• A separable power supply and thus none of the heating problems that plagues the GuruPlugs. My GuruPlug neither has a fan nor overheats, but other people seem to whine about these things incessantly
• Sound card with TOSLINK out
• Instead of 512 megs of NAND, it has 2 megs of SPI flash and a 2-gig microSD card inside
• It doesn't come preloaded with Debian

So let's say you want to put Debian on your DreamPlug. You do, of course, because running some other operating system is in poor taste, and you'd be embarrassed telling your friends. How do you do it? You can't use d-i. Let me back up. In the onboard SPI flash, there is a copy of Das U-Boot. This is a fork of mainline U-Boot, with no complete and corresponding source available. To the casual observer, this might look like an egregious GPL violation, but, on the other hand, no one seems to know how to rewrite the SPI flash except from U-Boot itself, so if you happen to corrupt said flash, your plug is bricked and openocd can't save you. I would be happy to be proven wrong on this last point, but for not let's assume that you're screwed and unable to replace your boot loader with free software. The next problem is the kernel, which lives on the microSD card. This is potentially free software, though I can't swear that complete and corresponding source code is available. What I can claim is that linux-2.6.33.6.tar.bz2 on Google Code will build a Linux that works on the plug. I will also point out that this doesn't match Linux 2.6.33.6 from kernel.org. Some other time I should rant about ARM Linux but for now I will just say that if you use the U-Boot of questionable provenance and either the Linux that's shipped with the plug or the one at the above link, you will be able to boot a mostly Debian system. I'll mention the third exception later. One thing you can do is to take the plug apart, remove the microSD card from its slot, and then stick it into a reader that you can then manipulate on another machine. If you're choosing this route and wish to take this opportunity to replace the microSD card with something larger than 2 gigs, keep in mind that you'll have to either preserve the uImage file from the first partition or build a new one. I am not fond of cross-architecture anything. I prefer to do things natively rather than cross-compile or foreign-debootstrap, and I own enough armel boxes that I can do this easily. So at this point I would just debootstrap a new Debian base onto the second partition of the microSD card. The first partition contains the uImage (which is your Linux image in a wrapper), and must be a FAT filesystem since you can't replace your boot loader with something that can read a better filesystem. The second partition will be your rootfs and can be whichever filesystem your Linux can read. If you do not have another armel system to play with, you might want to familiarize yourself with Marco's Sheevaplug instructions. You can install to a USB stick as well. Just remember that U-Boot needs a FAT filesystem containing the uImage on it and that you can't use a kernel in Debian yet. You'll also want to ignore the instructions regarding U-Boot, since that must be done differently. I'll be back later with some more details.

This is time again for yet another bubulle game: counting the number of developers per country. I already published such analysis in 2010 and 2009. So, here we are with the June 2011 version, sorted by the ratio of *active* developers per million population for each country.

Act: number of active developers
Dev: total number of developers
A/M: number of active devels per million pop.
D/M: number of devels per million pop.
2009: rank in 2009
2010: rank in 2010
June 2011: rank now

Code	Name	Population	Act Dev	Dev	Act/Million	Dev/Million	2009	2010	June 2011
fi	Finland	5374781	21	31	3,91	5,77	1	1	1
ch	Switzerland	7866500	21	26	2,67	3,31	2	2	2
mq	Martinique	397730	1	1	2,51	2,51			3
no	Norway	4964500	12	15	2,42	3,02	5	4	4
nz	New Zealand	4393500	10	15	2,28	3,41	4	3	5
se	Sweden	9354462	20	36	2,14	3,85	3	6	6
lu	Luxemburg	511840	1	1	1,95	1,95	8	5	7
de	Germany	81802000	155	221	1,89	2,7	7	7	8
at	Austria	8404252	15	25	1,78	2,97	6	8	9
ie	Ireland	6197100	10	13	1,61	2,1	13	9	10
fr	France	63136180	91	119	1,44	1,88	12	12	11
au	Australia	22632213	31	57	1,37	2,52	9	10	12
be	Belgium	11007020	15	17	1,36	1,54	10	11	13
uk	United-Kingdom	62008048	67	106	1,08	1,71	14	14	14
nl	Netherlands	16674600	18	37	1,08	2,22	11	13	15
dk	Denmark	5564219	6	10	1,08	1,8	17	17	16
ca	Canada	34480000	27	57	0,78	1,65	15	15	17
hr	Croatia	4429078	3	3	0,68	0,68	20	18	18
es	Spain	46030109	31	51	0,67	1,11	16	16	19
lt	Lithuania	3225346	2	2	0,62	0,62	28	19	20
cz	Czech Rep	10540748	6	6	0,57	0,57	21	20	21
it	Italy	60605053	33	47	0,54	0,78	23	22	22
bg	Bulgaria	7351254	4	4	0,54	0,54	25	23	23
il	Israel	7602400	4	6	0,53	0,79	24	24	24
us	USA	308745538	162	364	0,52	1,18	19	21	25
hu	Hungary	9979000	5	11	0,5	1,1	18	25	26
lv	Latvia	2245357	1	1	0,45	0,45	26	26	27
uy	Uruguay	3494382	1	2	0,29	0,57	22	27	28
jp	Japan	127960000	33	46	0,26	0,36	30	28	29
pl	Poland	38186860	9	13	0,24	0,34	29	29	30
cr	Costa Rica	4253897	1	1	0,24	0,24	31	30	31
pt	Portugal	10647763	2	4	0,19	0,38	27	32	32
sk	Slovakia	5429763	1	1	0,18	0,18	32	31	33
gr	Greece	11305118	2	3	0,18	0,27	33	38	34
ar	Argentina	40091359	7	9	0,17	0,22	34	33	35
tw	Taiwan	23061689	3	3	0,13	0,13	37	34	36
br	Brazil	190732694	20	21	0,1	0,11	36	35	37
by	Belarus	9648533	1	1	0,1	0,1	35	36	38
mg	Madagascar	20653556	2	2	0,1	0,1	44	37	39
cu	Cuba	11239363	1	1	0,09	0,09		38	40
kr	South Korea	48758000	4	6	0,08	0,12	39	39	41
ec	Ecuador	14790608	1	1	0,07	0,07		40	42
cl	Chile	17224200	1	2	0,06	0,12	42	41	43
ro	Romania	21466174	1	2	0,05	0,09	45	43	44
co	Colombia	45925397	2	3	0,04	0,07	41	44	45
ru	Russia	142905200	6	7	0,04	0,05	43	42	46
za	South Africa	49991300	2	9	0,04	0,18	38	48	47
my	Malaysia	27565821	1	1	0,04	0,04			48
ve	Venezuela	29105632	1	1	0,03	0,03	40	45	49
pe	Peru	29496000	1	1	0,03	0,03	46	46	50
tr	Turkey	73722988	2	2	0,03	0,03	47	47	51
mx	Mexico	112322757	2	2	0,02	0,02	49	49	52
th	Thailand	63878267	1	2	0,02	0,03	50	50	53
eg	Egypt	80085862	1	3	0,01	0,04	51	51	54
in	India	1210193422	8	8	0,01	0,01	52	52	55
cn	China	1339724852	7	11	0,01	0,01	53	53	56
ua	Ukraine	45888000	0	0	0	0	48	53	57
			896	1450	61,79%

A few interesting facts:

• Martinique pops up at rank 3. As this French overseas "d partement" has its own ISO code, it is counted here separately from France, though Martinique inhabitants are French citizens. That's of course a though case but I consider that David did choose to use "MQ" in his record, which means this is important for him. Let's respect that wish.
• Norway is now ahead of New Zealand. One more DD since last count
• Sweden is ahead of Luxembourg. Two more DDs wince last count
• France takes over Australia and Belgium. *seven* more DDs since last count!
• UK is ahead of Netherlands now. Three more DDs since last count.
• Denmark passes Canada and Spain (50% more DDs for DK), while Croatia passes Spain (because Spain lost 3 DDs).
• USA continues to go down (by 3 this time). We're constantly losing developers over there (-3 in one year).
• And we have a new country in this list as Malaysia now has a Debian developer. Along with Martinique (ahem), this makes two new "countries" in this list. No country disappeared.
• For the first time in 12 years, DebConf will be in a country (Bosnia and Herzegovina) that has NO Debian developer. This has to change.
• We have 23 more active Debian developers and 40 more developers overall.

Here is my first official Google Summer of Code report. As I still had classes, the first week of coding was rather slow. However, after my first phone call with my mentor, Matt Zimmerman, things started to pick up. I spent most of my time working on a dashboard/portal for the Debian Derivatives Exchange (DEX). We decided that the best approach to this would be to store as little information ourselves as possible. Instead, we will try to pull most of our information from other sources, such as Debian s BTS. The main advantage to this is that package maintainers do not need to change any of their workflows, but they still get to benefit from DEX s work. Currently, I have a python script that gets a list of usertags and bugs for debian-derivatives@lists.debian.org from the BTS. This script will end up getting run by cron. It stores the information it gets in static HTML files. Finally, JQuery and Javascript are used to present the final dashboard to the user. I created a mockup showing how this looks. I also have a functioning website that looks and acts like the mockup, but the code is not publicly available yet (see below). DEX uses Alioth to host its git branches and website. I have spent some time trying to familiarize myself with the recent changes that have taken place on Alioth, as well as trying to figure out the best way to store and execute my script to generate the website. So far, it looks like people are still deciding on the best way to handle having websites that are updated from VCS hooks (due to things being split between vasks and wagner). I will continue to look into this, and might try using an alternate host until things settle down. Next, I plan to work on updating the dashboard to provide a way to edit, store, and display certain extra fields of information. This is necessary for certain pieces of information that are not appropriate for adding to bugs and in a few other cases. I will also be taking some time to talk to a few people who were active contributors to the last DEX project. This will allow me to learn more about their experience, find out what changes they feel should be made to make things run smoother, and get feedback on my current Summer of Code work. Finally, although I have been posting updates on my Summer of Code work to my blog [2][3], Matt thinks that having all of this information in one place will be useful. As a result, I will be creating another wiki page about the project that will contain all of the information people need to know. This page will be updated as the summer progresses. I am also hoping to have my code available in a public VCS by the time of my next progress update so that people can check it out and provide feedback. In addition to the dashboard, I will be working on creating a few other tools to assist with the creation and tracking of new DEX projects. I will also be coming up with a way to generate graphs to visually allow us to track our progress on projects versus time as well as show the work done by people at the individual level. This last task is part of a goal to get more people involved in the DEX project. While we may only be a few weeks into the actual Google Summer of Code, I have already learned a lot of new things. I am looking forward to working more with Matt and other members of the community over the course of the summer.

Philipp is a Debian developer since 2005 and a member of the release team since 2008. Since he took the responsibility of Stable Release Manager, the process has evolved for the best. I asked him to explain how the release team decides what s fit for stable or not. His work on the buildd infrastructure is also admirable but I ll let him describe that. My questions are in bold, the rest is by Philipp. Who are you? I m a 24 year old Computer Science student, living in Karlsruhe, Germany. As a student assistant I m currently in two jobs: one is taking care of getting our university IPv6 network in shape, or rather generally getting fringe technologies into the network. The second is taking care of a s390x machine in the basement which my faculty got sponsored recently. In my spare time I tend my Debian duties and I m active in the student council (Fachschaft) as a sys-admin, software developer and until recently as treasurer. I got accepted as a Debian Developer in 2005. I m only really active since I was invited to join the Release Team in early 2008 after I contributed rewrites of some scripts that got lost in a disk crash of ftp-master. In late 2008 I also took on wanna-build/buildd duties. What s your notable achievement within Debian? For one I worked on the deployment of a single buildd/sbuild combination over all of our buildds and I rebased it on the sbuild in the archive several times already. All buildds basically look the same on all architectures, with only few variations. The chroots are now also created in a mostly predictable manner. Then we finally got build autosigning after years of constant poking. However the policy decision to allow it was made by the ftp-masters anyway, for which I m grateful, as it eases the workload of the buildd maintainers, the Security Team and the Release Team quite a bit. On the release side there s the integration of volatile into the proper structures of Debian. But there I m guilty for choosing the bad name squeeze-updates is, in comparision with security s squeeze/updates. Let s see if we can improve that for wheezy. The policy for stable updates have changed over time. Can you summarize what kind of updates are allowed nowadays? All the changes that were made to the policy were driven by the aim to keep stable (and to some lesser degree oldstable) usable throughout its lifetime. I have to admit that we got slightly more liberal in what we accept since I took over. The previous stable update policy included the fixes of critical bugs that break the system in interesting ways and security fixes. We also opened up the possibility of including important fixes for annoying bugs on a case-by-case basis. The whole don t update that much part of the stable release management is rooted in let s don t change the behaviour of a running system and let s have as few regressions as possible . We currently try to counter that with a review process that only allows self-contained fixes that were tested in unstable first, if applicable. In the future I d also like to have a feedback process that includes the users of the packages to report problems more early. In fact that s also why we now send calls for testing to debian-stable-announce one week in advance (see this mail as an example). So stable is updated through point releases that happen roughly every two months for stable and roughly every four for oldstable. They are accompanied by announcements and new CD/DVD sets. To be able to push some updates with less delay to our users and to avoid that they have to pick them from proposed-updates, there is stable-updates. The current policy for this suite is available in this post on debian-devel-announce. It boils down to everything urgent like tzdata, regression fixes and volatile packages. We noticed that some packages in stable just weren t useful anymore when they got updated through volatile. Hence those are folded into stable, too. We also relaxed the rules a bit so that leaf packages like clive, that rely on external websites not to change their URLs, can be updated too. If somebody wonders what happened to the and a half releases Those were intended to mark the inclusion of new hardware support (mostly by including a co-installable new kernel version). This kind of flag point release is thankfully no longer needed because our marvellous kernel team now backports certain hardware drivers to the kernel version in stable. They have some trouble soliciting test feedback for them, though. It would be cool if more people using stable could respond to their calls for testing. What are your plans for Debian Wheezy? Luckily the wanna-build/buildd side isn t much dependent on release cycles. The stable release management also just takes care of what gets dumped on them by the testing RMs. The near-term goals are certainly:

• getting d-i to use some development process in the archive that s compatible with the normal flow of packages into testing and
• hopefully getting wanna-build to use a sane SQL layout and hence better performance

Apart from that my work is mainly squashing the bugs on buildd.debian.org for the wanna-build part, so if you want something fixed, you need to report it, I m afraid. You have several roles within Debian, in particular stable release manager and member of the wanna-build team. Which role do you enjoy more and why? So the regular duties of the SRM, apart from setting up policies, are reviewing requests for uploads to proposed-updates, accepting them, chasing builds and scheduling point releases. It s mainly steady work. As for the Release Team it s working in a fabulous team where everyone s doing an awesome job. For me the wanna-build role is holding the things together and fixing up stuff that breaks while the world continues to evolve. And occassionally taking a stab at the ftp-masters. So rather different. My heart is probably siding with the buildd side because it s infrastructure but release work is fun, too. What s the biggest problem of Debian? Mainly that we re not quick in picking up new technologies and that we got slow on innovation. Distro-wide changes are usually a very big effort to coordinate and to finally complete. I guess people should be able to push fixes for release goals more eagerly into the archive. Also it seems to me that many DDs are actually disengaging from the release process, especially during the freeze but also before, which makes me a bit sad. However I m still not sure how we could counter that. As we re all volunteers you can t suddenly make others love the idea of releasing something together, I guess. Do you have wishes for Debian Wheezy? It s getting old, but there s certainly multiarch. Also a usable Python 3 is something I d really appreciate. Is there someone in Debian that you admire for their contributions? Peter Palfrader did an awesome job of getting a nicely working team together for DSA and got many tasks as automated as they are now. It s a pleasure to work with them and setting up a new buildd is, for example, a real breeze. He also developed a sane archive snapshot service, kudos for that.

---

Thank you to Philipp for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

3 comments Liked this article? Click here. My blog is Flattr-enabled.

I say this after probably 48 hours of what I estimate is a sustained 60 kB/s of brute force SIP traffic from 61.146.178.173 has been sent my way. I'd very cheerfully sign up for a service that had all Chinese IP addresses null routed, and provided a proxy server for any HTTP access. I have no business needing direct IP connectivity to China, and I certainly do it not want it from China to me. I was pleasantly surprised to be able to call up Comcast's Business Class technical support tonight and ask them if they could null route the above IP address, and they seemed to imply they could (they opened up a ticket for a level 2 person to do something at least). Now if only I didn't have to pick up the phone to interact with Comcast's Business Class technical support, it'd be just lovely. I'm just glad I'm not in Australia where this would be blowing my monthly quota and/or causing me to receive excess usage charges. Bloody UDP. You can firewall it off, but it keeps coming. My initial stopgap Netfilter rule counted 1.5G of traffic before I replaced it with an adaptation of my SSH brute force mitigation rules, and the new rule has seen nearly 5G of traffic now. It's one thing to try to brute force something, but to keep trying after you stop getting responses is just plain stupid.

I've finished importing the usenet archive for oldusenet. The fun part was parsing the dates to put the posts in order. No date format was really required on usenet, and so a wide variery of formats were used. Some posts didn't have a Date, but a guess could be made from their Message-ID. Some posts had absurd dates (ie, 1969, 1995), others had dates that were correct in every way.. except the year was left out (oops). One early post had a date of "_". Still, this excerpt of my code managed to parse the rest and so gives a fairly complete picture of how messy dates can possibly be. Read and weep.

  p anyzone "%d %b %y %T"       "15 Jun 88 02:27:41 GMT"
, p anyzone "%a, %d %b %y %T"       "Thu, 22 Jun 89 20:02:03 GMT"
, p anyzone "%a, %d-%b-%y %T"       "Thu, 15-Jun-89 18:01:56 EDT"
, p anyzone "%d %b %y %T"       "8 Jan 90 14:07:27 -0400"
, p anyzone "%d %b %y %H:%M"        "4 Oct 89 19:56 GMT"
, p anyzone "%a, %d %b %y %H:%M"    "Thu, 23 May 91 02:13 PDT"
, p anyzone "%a, %d %b %Y %T"       "Thu, 23 May 1991 07:07:00 -0400"
, p anyzone "%a, %d %b %Y %H:%M"    "Sat, 18 May 1991 17:28 CDT"
, p anyzone "%d %b %Y %T"       "11 Apr 1991 12:02:01 GMT"
, p anyzone "%d-%b-%y %H:%M"        "24-Mar-90 14:22 CST"
, p anyzone "%d %b %y, %T"      "22 May 91, 16:31:37 EST"
, p anyzone "%d %b %Y %H:%M"        "30 June 1991 17:15 -0400"
, p anyzone "%a, %d %b T  %T"       "Fri, 8 Feb T  09:49:39 EST"
-- special cases
, p (tzconst est) "%a %b %d %T EST %Y"  "Tue Jan 11 12:44:36 EST 1983"
, p (tzconst est) "%a %b %d %T EST %y"  "Tue Jan 11 12:44:36 EST 83"
, p (tzconst edt) "%a %b %d %T EDT %Y"  "Tue Jan 11 12:44:36 EDT 1983"
, p (tzconst edt) "%a %b %d %T EDT %y"  "Tue Jan 11 12:44:36 EDT 83"
, p (tzconst utc) "%a %b %d %T GMT %Y"  "Thu Nov  1 23:14:37 GMT 1990"
, p (tzconst pdt) "%d %b %y %T -7"  "11 Jun 91 15:41:21 -7"
-- dates with no timezone specified are guessed
, p nozone "%d %b %y %T"        "9 Jan 90 09:33:59"
, p nozone "%d %b %Y %T"        "10 APR 1990 05:25:28"
, p nozone "%a %b %d %T %Y"     "Fri Feb  6 00:19:47 1981"
, p nozone "%a %b %d %T %y"     "Fri Feb  6 00:19:47 81"
, p nozone "%Y-%m-%d %T"        "1981-11-12 18:31:01"
, p nozone "%y-%m-%d %T"        "81-11-12 18:31:01"
, p nozone "%a, %d %b %y %T"        "Sat, 13 Apr 91 08:37:57"
, p nozone "%a, %d %b %Y %T"        "Sun, 16 Jun 1991 13:23:02"
, p nozone "%d %b, %Y %T"       "1 May, 1991 00:00:00"
, p nozone "%d %b %y %H:%M"     "8 Jan 88 18:03"
, p nozone "%a, %d %b %y %H:%M"     "Wed, 29 May 91 17:14"
, p nozone "1 %b %d %T %Y"      "1 Jan 08 20:59:08 1991"
-- this has to come near the end, as it matches greedily
, g nozone "%a %b %d %T %Y ("       "Wed Oct 27 17:02:46 1982 (Tuesday)"
, g nozone "%a, %d %b %y %T +"      "Tue, 21 May 91 16:46:01 +22323328"
-- extract date from message-id headers
-- (used for messages with no Date field)
, g nozone "<%Y%b%d.%H%M%S."        "<1989Jul6.214048.28313@jarvis.csri.toronto.edu>"

(Parsing the often ambiguous, malformed, etc timezones was fun all its own too, of course.)

I was laid off a couple of months ago, and have been thinking about what I want to do next. Actually, I've mostly been writing code for my pet projects, but earning a living again is occasionally on my mind. I would, very much, like to earn a living while deveoping interesting free software that I would like to use myself. There's a bunch of options available:

• I could go work for one of the large companies that use free software, and hope to find a position where I can help develop the tools they use. This would perhaps be the easiest option.
• I could perhaps find a job at a smaller company that specilizes in the development of some parts of the free software stack, or develops a Linux distribution.
• I could join or found a startup that develops free software and thinks it has a business model around it.
• I could learn web programming, and develop interesting online services that people would be willing to pay for.
• I could do consulting gigs, either via my own company (back in Finland), or by getting employed by one of the free software oriented consulting houses that exist. Again, I might need to learn some new skills, since most customers are looking for work in parts of the development stack I'm not experienced in, such as the kernel, or want web or mobile app development, neither of which I know.
• I could try to crowd-fund development of software I think the world needs, and hope to get paid enough to make a living. This would be a special case of doing consulting: I would be selling very small amounts of work to a fairly large number of customers.

In this blog entry, I want to think about that last option. Here's I imagine it would work: I would post a list of things I would like to do, estimates of how much work they'd be, and a hourly price. People would tell me how many hours of work they'd like to pay for. I would then do the work, send everyone their bill, and they'd pay it. In the ideal world, this would be an awesome way to fund development. I could, for example, write some automated tools for system testing of Debian, to help with release management, or I could finish Obnam. And that's just two things I'm already working on: there's no end of things I would like to develop, if I didn't need to worry about my next meal. However, this is not without problems. To start with, it might look like I'm trying to blackmail the world: "pay me, or this software won't be written". That's not a problem in the general case, but it'd easily look like that if the work would be to, say, maintain Debian packages. As a Debian developer, I should keep my packages in good shape whether someone is paying me or not. I would need to be careful to keep things ethical here. Another problem would be the issue of being realistic: would there be enough people willing to pay me, and how long would that last? That partly depends on the pricing. Although my needs are fairly modest, I do live in a country that is fairly expensive to live in. If I started doing this, it'd be easy for someone in a country it is cheaper to live in to compete on price (and they might well be better than I am, too). Then again, since there's no end of things to do, perhaps we could both make a living. Would you pay someone to develop free software by the hour? How much? How often? What should the software do?

Every time I think I have them done this happens

Since my laptop features WWAN connectivity, I purchased a 3G mobile broadband plan from SFR, a French mobile phone company. I took the cheapest one available: 250 MB per month for 10 .

Optimizing transparent proxy by SFR While browsing, I was curious about the fact that there were multiple accesses to non-public IP, like 10.141.0.4. I was browsing the mobile version of Le Monde, a French daily newspaper. I enabled Chromium developer tools and watched what happened in the Network tab. All images were served from IP like 10.141.0.4. Looking at the HTML source code, I discovered that <img> tags were rewritten to point to those images. The smaller one were identical to the original one but the larger ones (more than 50 KB) were of reduced quality (and therefore reduced size). <img> tags were not the only one to be rewritten. <style> and <script> tags that were pointing to external resources (with a src attribute) were also rewritten to include the CSS or the javascript inline. Before:

<script src="http://s1.lemde.fr/js/lib/jquery/1.5.1/jquery.js"></script>

After:

<script oldSrc="http://s1.lemde.fr/js/lib/jquery/1.5.1/jquery.js" NG="replaced">
/*!
 * jQuery JavaScript Library v1.5.1
 *
 * Copyright 2011, John Resig
 * Dual licensed under the MIT or GPL Version 2 licenses.
 * http://jquery.org/license
 * [...] */
</script>

This means that each page that includes jQuery, a popular javascript library, as an external resource, will be turned into a page that includes the whole jQuery code which is about 85 KB. Each page will weight more than 85 KB instead of relying on an external and cacheable resource. Nowadays, most browsers support HTTP keep-alive which allows to serve multiple resources into a single request. There are two cases:

1. If the resource is served from the same server as the HTML page, keep-alive would enable to get almost the same result without hindering the cache: the browser would first request the HTML page, then the javascript resource into the same TCP connection. There is a small penalty of about 100 ms to let the browser request the second resource. The browser may decide to open another connection because the initial document is not loaded yet. Some browsers may even negotiate this additional connection before needing it. In this case, it can use this idle connection at no cost. Otherwise, we may fall in the second case.
2. If the resource is served from another server (like in the example above) or if the browser does not have an idle connection ready for reuse, it would download the resource in parallel with the help of another connection. It will only costs about 300 ms of additional time due to the establishment of a new TCP connection with the server. Those 300 ms are a very small price to pay compared to the 2 seconds needed to download 85 KB for each page. Moreover, other static resources will likely be downloaded from the same server and therefore, this is 300 ms the first time and about 100 ms for additional resources (round-trip time for a new HTTP request into the same TCP connection).

UPDATED: In a previous version of this article, I confused pipelining and keep-alive mechanisms. While keep-alive allows to reuse an existing connection to download a new resource, only one request at a time by connection could be issued. Pipelining allows to push additional requests in the same TCP connection without waiting for answers. As noted by ric Daspet in a comment, pipelining is disabled for most browsers. However, keep-alive is well supported. Searching on the web for oldSrc and NG="replaced", I find very little information about what is used. It seems that such a feature may also break some scripts, like TinyMCE, trying to get additional resources relative to the path where the script is installed. It appears that SFR is using a product from Flash Networks called Harmony Gateway. I have asked SFR more info about this and if it was possible to disable the use of this feature but got no answer so far. I have retried a bit later and there was no rewriting for Javascript and CSS. Images were still degraded and served by a special server. The next day, my requests did not travel through a transparent proxy anymore (no more Via header in answers). Each try was done at a different location. The proxies may be installed at some locations only and configured differently. Another explanation is that SFR silently disabled this functionality for my account. If it was done correctly, such an accelerator service could be be proposed as an opt-out option since most users would appreciate faster page downloads. If you care about network neutrality, you can disable this option. Of course, it needs to be properly advertised, for example as a free option in your mobile plan.

Setting up our own optimizing proxy Google provides mod_pagespeed as a solution to optimize a website on the fly. This is an Apache module. It is targeted at optimizing your own website but since Apache can act as a regular proxy, it seems possible to enable mod_pagespeed for any website. That s pretty easy to setup if you don t mind using a precompiled version of mod_pagespeed. Download mod_pagespeed. I have downloaded the 64bit version for Debian.

# touch /etc/default/mod-pagespeed
# dpkg -i ~/download/mod-pagespeed-beta_current_amd64.deb
Selecting previously deselected package mod-pagespeed-beta.
(Reading database ... 277699 files and directories currently installed.)
Unpacking mod-pagespeed-beta (from .../mod-pagespeed-beta_current_amd64.deb) ...
dpkg: dependency problems prevent configuration of mod-pagespeed-beta:
 mod-pagespeed-beta depends on apache2.2-common; however:
  Package apache2.2-common is not installed.
dpkg: error processing mod-pagespeed-beta (--install):
 dependency problems - leaving unconfigured
Errors were encountered while processing:
 mod-pagespeed-beta
# apt-get install -f
[...]
Unpacking apache2.2-common (from .../apache2.2-common_2.2.19-1_amd64.deb) ...
Processing triggers for man-db ...
Setting up apache2.2-common (2.2.19-1) ...
[...]
# apt-get install apache2-mpm-worker
[...]
Unpacking apache2-mpm-worker (from .../apache2-mpm-worker_2.2.19-1_amd64.deb) ...
Setting up apache2-mpm-worker (2.2.19-1) ...
Starting web server: apache2.
# a2enmod proxy_http
Considering dependency proxy for proxy_http:
Enabling module proxy.
Enabling module proxy_http.
To to activate the new configuration, you need to run:
  /etc/init.d/apache2 restart

Then, we modify /etc/apache2/mods-enabled/proxy.conf:

ProxyRequests On
<Proxy *>
    AddDefaultCharset off
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Proxy>

Of course, this makes little sense to run the proxy on your laptop since you don t want to download the non-optimized content over your WWAN link. You need to run it on another server and therefore allow your laptop to access it. Also, we need to modify /etc/apache2/mods-enabled/pagespeed.conf to add the directive ModPagespeedDomain * to let mod_pagespeed rewrite any page. You should restart Apache after that. Now, check if the proxy is working:

$ curl -six http://localhost:80 http://www.lemonde.fr/   grep ^X-Mod-Pagespeed
X-Mod-Pagespeed: 0.9.17.7-716

All is working! Let s try a very simple site, like Debian Backports. It features one HTML file and two CSS files: We downloaded a total of 8 KB (compression included). Let s use our proxy and try again: mod_pagespeed succeeds in reducing the size of the HTML file and combined the CSS files. Moreover, it minified the resulting CSS file. There seems to be a bug in Chromium that display incorrect transfert sizes (including in the timeline representation) when using a proxy. I have checked with Wireshark that the overall quantity transferred was about 8 KB. The gain is very thin here but you can imagine that you will get better results on larger sites. mod_pagespeed seems to handle well most sites. However, it only optimizes pages that already are in its cache. The first time you grab a page, you will get the unoptimized version. I don t know if it is the expected behaviour.