Due to a variety of people and places we want to see, Mika and I have regrouped around a more ambitious travel schedule in Italy for the next week or so. Our new plan is:

• August 23-27: Florence
• August 27-29: Verona
• August 29-31: Bologna
• August 31-September 1: Siena
• September 1-3: Rome

I know we'll have an organized LUG meeting in Siena. The rest of the period is a little more open. As always, if other free software, wikimedian, or like-minded folks are around and would like to meet up in any of those places, don't hesitate to get in contact. In related news, inspired by Florence and by Mika's domo-kun purse, I made a duomo-kun today.

Apparently this statements also holds true for frozen yogurt. An Austrian A1 spokes person has confirmed that the HTC Magic will not receive a 2.1 or 2.2 Android update. One can only wonder about the sugar HTC puts on top of regular Android that hinders themself to update their products. The Austrian A1 carrier sells you the device for a 18 month contract, but actively only supported it for 6 month. I must revise my previous positive review of the HTC Magic. Some HTC speaker had promised earlier this year an upgrade to at least 2.1: HTC Magic 2.1 upgrade. A SFR speaker had promised an update to current Android: HTC Magic and Nexus One 2.2 upgrade. The Webkit Android Browser can be easily tricked into leaking your user and passwords: Android Luecke. Beside the obvious that as a user one shouldn't give out to much data to untrusted third party this opens lots of Google accounts for criminal activity. The inability of the carrier to provide a secure and uptodate device is massively deceiving and certainly not appropriate handling of their defects liability.

Recently I was surprised to find that many of the rules I took for granted when dealing with an OpenPGP keyring, and the other activities associated with a web of trust, were new to some people I spoke to. These rules are born from a mixture of experience, accepted good practice, and wider reading, with a small dose of paranoia thrown in for good measure.

• Protect your secret keyring with file permissions. For GPG, your ~/.gnupg directory should not be readable by anybody else, including root (even though he could break in if he wanted). Mine is octal 700, and the secret keyring itself is 600.
• Create a revocation certificate, and keep online and offline copies (gpg --gen-revoke <keyid>). The revocation certificate is published to key servers by you in the event that you detect key compromise or loss. It s important that this is also well-protected, because the secret key is not required to upload it. Print a copy in bold and on good quality paper, so it will last a long time, and preferably keep them both off-site in a trusted location. Typing all those characters back in is a bore, but if your online copy fails it s better than being impersonated.
• Use a good pass-phrase, not a password. A pass-phrase is actually easier to remember than a string of random characters, without risk. It can be long enough to make brute-force attacks pointless, and if you re using the key a lot and can t be bothered to type it all the time, gpg-agent is a handy and safe tool. Your login password is not an acceptable pass-phrase for your secret key!
• Regularly refresh your public keyring from a well-connected keyserver. I detailed this in an earlier post; it s a case of calling gpg --refresh-keys once a week or so. This is the first line of defence against other people s keys being compromised, since without it you ll never know that your messages to them are now vulnerable. A well-connected server, like those in pool.sks-keyservers.net, matters since not all servers synchronise predictably.
• Rotate encrypting sub-keys regularly. This reduces the effect of a compromised key: if you rotate keys annually, a compromise only opens one year of mail. Small comfort, but every little helps. Don t delete the old keys though, just revoke them otherwise you won t be able to open mail from those senders who don t refresh their public keyrings.
• Keep your key offline and make a separated signing sub-key for day-to-day use. There isn t room to go into detail here, but you can export a signing sub-key with a relationship to your primary key material, so if it is compromised you can revoke it without losing all those carefully-collected signatures. The same goes for encrypting sub-keys. Adrian von Bidder has a guide to this, but he warns that it should be taken with a pinch of salt, so this isn t so much a rule as an interesting idea. I have not experimented with this yet.

And some rules about signing and signatures:

• Don t place too much store by signing parties. Parties are great for rapidly building a web of trust, but a part of that trust is to do with how the other party checks identities. I don t believe it s possible to establish that with just a few minutes chat and an identity check, so I never make a sig2 or sig3 on a key I met at a party. I m usually happy to do that later when I have an established relationship with the key holder, of course.
• Never upload your own signature to a key server. Apart from the fact that the key holder might not want their key published, you also have no way to prove that the key holder has access to the email address on their UID. It s much better to send the signature to them encrypted, which demonstrates that they the both key and can read mail at the address (the caff program is ideal for this).
• Give personal trust (the trustdb) carefully. Getting that message Good signature from in your mail client is really nice, but not at the expense of giving away trust where it is not deserved. In the same vein as not placing too much trust at signing parties, you should avoid the temptation to over-trust keys in your personal trustdb. Reputation on a mailing list is absolutely no substitute for observing the party taking care over their verifications when doing face-to-face signings.

Do you have other rules or guidelines that you use when dealing with keys and signatures?

there was a recurring catchphrase during DebConf10, worded something like "Debian derivatives are also our users", that appeared quite often in talks as well as in hallway chats.

I kept pondering about this idea, & I'm still not sure what to think about it, & what the "message behind the message" actually is: is it an intelligent new point of view, some new way of thinking, seeing an increase in our user base & therefore in our possibilities&responsibilities? or, on the contrary, is it an admission of "defeat", accepting in resignation that end users prefer other distros, & Debian can only cling to the idea of "derivatives as users" in order to maintain its raison d' tre?

in the beginning I liked the idea ("oh, I haven't looked at it that way yet"); over time I tended to hear the defending undertone stronger ("if nothing else we are at least useful as a base for other distros").

the phrase might have both aspects; & I'm still not sure neither how it was actually meant neither if I like it ...

MJ Ray has said that he needs occasionally to concatenate MP3 files and he wants those files to be free of junk in their middle. There are some nice things to say about this problem:

• Just using cat with MP3 files work because those files are headerless : the metadata in form of ID3v 1,2 tags is an addendum to the format. MP3 is also a format that can be conveniently used without containers/wrappers.That is not the case with AAC files, in general: AAC files that are not inside a container (e.g., Matroska or MPEG 4) are usually useless, unless you know (and can inform) some properties of them to th software that you are using. This is especially the case with AAC files that were compressed with some advanced things like spectral band replication (SBR).
• The tags for MP3 files (at least those in ID3v2) are supposed to be unsynchronized , so as to not be interpreted as audio data. What this means is that some byte sequences (a byte 255 followed by a byte with value at least 224) that are allowed as audio to say hey, I am a marker, process the
  next chunk of data, now have to be escaped if they are present in tags (so that you don t listen to garbage in the middle of a file i.e., you don t play the tag).

Related to this second point, the MPEG standards have a guideline that, if some data is not known by a decoder, for resilience purposes, it should be ignored. This obviously allows some newer features to be
implemented in a backwards-compatible manner and is nice. In other words, decoders should just skip those data and be done with it. Also regarding the second point, apparently, some versions of popular music players/manipulators have problems with unsynchronized data. There are many tools that one can use for removing unwanted, unsynchronized data from an MP3 file. For instance, you can use mp3diags, which is already conveniently packaged in Debian s repository. It is a recommended program for those purposes, indeed. There is another tool that serves that purpose as a side effect: mp3packer. Its purpose is, naively speaking, to losslessly shuffle the data inside an MP3 file so that it can be stored with fewer bits (saving more space for portable players, for instance). In the process of regenerating a new MP3 file, it discards some junk data and solves the original problem. Despite not being part of our repository yet, it is already packaged and
even a RFP bug exists.

There is apparently some MS-Windows software for navigating light aircraft in Australia. It takes input from a GPS device and knows the rules for certain types of common tasks (such as which direction to use when approaching an airport). My first question when I heard of this was so if the Windows laptop crashes does your plane crash? . But I ve been assured that paper maps will always be available. The requirement is for a touch-screen device because a regular laptop in the open position won t leave enough room for the control stick. So the question is, what is the best touch-screen Windows laptop? It must be relatively rugged spinning media for storage is unacceptable due to the risk of damage in turbulence, it should be relatively cheap (less than $1000), and can apparently have a somewhat low resolution for the screen. The pilot who asked me for advice on this matter is currently thinking of the ASUS Eee T91 which runs Windows XP home, has 16G of solid-state storage and a 1024*600 screen. I am concerned about the reliability of that system as the rotatable screen design seems inherently weak. The Smartbook concept sounds appealing, I don t expect that you would want to wait for a typical OS to boot while flying a plane. But those devices mostly use ARM CPUs and thus can t run MS-Windows. One particularly interesting device is the Always Innovating Touchbook [1] which has a detachable keyboard which would be handy for non-airline use. Unfortunately it seems that Always Innovating aren t doing production at the moment, they say The current Touch Book production is in stand-by and will resume in the summer when we will release our newest and craziest innovation well summer is almost over in the northern hemisphere so I guess that means there won t be anything from them for another 9 months. A device such as an iPad would also be a good option for looking at static documents. The pilot is considering using a MS-Windows PC to generate images and then viewing them on such a device. But he s not really enthusiastic about it. Are there any good and cheap touch-screen devices that run MS-Windows? Are there any particularly noteworthy PDF reader devices which would be better than an iPad for viewing maps while flying a plane? Is it possible to run a MS-Windows application that uses a GPS under Wine on a Netbook?

• [1] https://www.alwaysinnovating.com/touchbook/

...awesome. OK, I'm writing this while I'm still in USA, but there are so many things to say about these weeks that I can't write them in only one blog post. And, still, this one will be quite long as it will talk about hacking, running and sightseeing...:) Let's start about hacking: after all, this is the first reason for being there in US, isn't it? I cam to DebConf with a very long TODO list and, for the first time in seven DebConfs, I'm pretty happy with what I achieved from it:

• samba packages
  • I (shortly) discussed with Steve Langasek about samba packages. He will have to talk with upstream about 3.6 that unexpectedly drops symbols in libraries , so that we can upload it in experimental (and probably also offer a lenny backport)
  • We didn't decide yet about the version to have in squeeze. I know, the freeze happened in the meantime, so we should stick with 3.4.8 but I'm more and more convinced that we should have 3.5.4 instead as upstream should stop supporting 3.4 security-wise around June 2011. I think I can convince the Release Team that 3.4-3.5 upgrade is not to be disruptive with the freeze.
  • I hopefully fixed the 3.5.4 packages for lenny which we have in our unofficial repository at http://pkg-samba.alioth.debian.org. I didn't take time to check this properly, though, so feedback will be appreciated.
• Pootle/translate-toolkit/virtaal
  • These are usually maintained by Nicolas Fran ois but he has no time for them. So, I agreed with him that I would release new upstream versions
  • pootle 2.0.5 is now in unstable. I have to work on an RC bug, still
  • translate-toolkit 1.7.0 is now in unstable too
  • virtaal: I began working on new upstream release packaging
  • backporting: I planned to backport translate-toolkit and pootle as there is a strong demand for them for lenny servers but the above mentioned RC bug prevented me to do so
• D-I work
  • I partly reviewed and corrected the D-I l10n documentation
  • I reviewed and activated new debconf templates added by Otavio Salvador and Daniel Baumann to live-installer, then called for their translation
  • Support for locales with "@" in their name in localechooser: I looked at this but I need someone more clever than me in shell scripting to fix that. Until that's done, I deactivated Serbian (Latin), unfortunately.
• Various packaging work
  • New release for console-data (mostly l10n stuff aimed for D-I)
  • Uploaded ttf-dzongkha and ttf-inconsolata to s-p-u to fix two RC bugs in stable
  • Polish tasksel and have Otavio to upload it
  • Checked my own packages against Rhonda's list of RC bugs in stable
• Localization work
  • Pootle upstream French translation completed, for 2.1.0
  • Cleaned out the tracking robot for French l10n in Debian

As one can see, a lot of planned work happened while I still could maintain the usual flow of recurrent work with localization (Smith reviews, l10n NMUs). Some asked me why I didn't propose l10n sessions this year. Indeed, I wasn't feeling I could sustain animating them and I had no clear idea about which topic I could bring to be discussed. Last year, these sessions slightly killed my free time and I wanted to keep some this year for "impromptu" things. I didn't attend many talks, sorry for the speakers. The most I attended were during Debian Day, which I found highlyinteresting and motivating, just like Eben Moglen's talk. Marga's talk was also one I wanted to attend, though I regreted that things went mostly out of control during the talk (too many comments from the audience to allow Marga pushing her important points). As usual, I invested a big part of my time in "social" activities, the most proeminent being of course the Cheese and Wine party, which turned ut to be a great success. The help of my son Jean-Baptiste and the tremendous support of Michelle Lynn Hall helped a lot, though I still regret that we screwed about accessibility. I also ran a lot..:-)..that may be counted as social activities as I organized several group runs. The one I'm proud of has been participating to a local race, namely the Van Cortland Track Club Summer Series of cross-country running, in Bronx. We went there with no less than 10 DebConf participants and 1 kilt (hey, Luca!). All of us completed the race (that had 170 runners for 5 kilometers) and No l K the even finished 17th scratch and 2nd in his age/gender category. Besides that, we had a great run/sightseeing to Georges Washington Bridge (that links New Jersey and Harlem and offers an unusual view of Manhattan "from behind"). All this with a 17km run. We also ran several times in Central Park, and No l and me happened to go to Coney Island for the Day Trip by doing half of the trip by running (all around Manhattan and over the Broolyn Bridge), for about 20km. Then we "showered" in the Atlantic Ocean....:). At the end of DebConf, I think that I had my record broken with 112km run in 10 days and only one day *without* running. What about sightseeing? Well, this blog post is too long and we reach the end of Interstate-90, close to Albany, so that will be for an upcoming blog post. Aug 25th update: back home, so now I can publish this blog post...

FrOSCon was a blast. I had two booths of my own MirBSD and FreeWRT as well as shares of Debian and Grml. Well, MirBSD was run by Benny and gecko2 because I just didn t have any time for it, despite XTaran s help with the FreeWRT booth. All I did was the initial setup of both booths, while at the same time answering about three questions regarding FreeWRT in parallel. Wow. What a little small, open hardware can do to you. XTaran and I had fun and we ll do FreeWRT booths again; I managed to flash my two FON2100 devices ( La Fonera the FON2200 can use the same image, says nbd of OpenWrt) and will fix the port s remaining few bugs I found; XTaran will try to push the WL-500gPv2 development. The social part was nice as well, although I think the greek restaurant in the city will not be visited by me again. Anyway, if you didn t attend FrOSCon, your own fault Since the BitTorrent tracker used by MirOS is down, here s the link to the [updated 2010-08-28] current (FrOSCon 2010 Edition) snapshot s torrent, Triforce as usual. We ll probably rewrite torrent files for all our ISOs and publish them on the MirBSD website. I m currently considering OpenBitTorrent plus one or two DHT seed nodes with no statistics. Maybe with webseed. (Need to update the libtorrent/rtorrent MirPorts first, though ) Other options would be different trackers or running one of our own. I will announce the outcome as news entry, once done. On the plus side, the review process of mksh(1) in Android continues, and I fixed the realpath builtin to behave even more POSIX-ish.

I got this in my Debian mailbox the other day (it s an invitation to Facebook, in French):

Bonjour Jonathan,

Je vous ai invit rejoindre Facebook r cemment et je voulais vous rappeler que d s que vous serez enregistr , vous pourrez vous connecter [...]

Poete Bellon a invit xxx@xxxx rejoindre Facebook. If you do not wish to receive this type of email from Facebook in the future, please follow the link below to unsubscribe.

<script type="text/javascript"> var flattr_wp_ver = '0.9.12'; var flattr_uid = '32970'; var flattr_url = 'http://www.jwiltshire.org.uk/content'; var flattr_lng = 'en_GB'; var flattr_cat = 'text'; var flattr_tag = 'blog,wordpress,rss,feed'; var flattr_btn = 'large'; var flattr_tle = 'jwiltshire.org.uk'; var flattr_dsc = 'The public face of jwiltshire'; </script> <script src="https://api.flattr.com/js/0.5.0/load.js?mode=auto" type="text/javascript"></script>

Well, FrOSCon is over and it s time to sum up the event a bit. First of all: it was great! But it was also hot (I heard the air-condition is off during week-ends ) and busy. And still, it was great! :) Why? Mostly because of the people of course! It was esp nice to meet Rhonda in person (almost all other people [except the grml ones] in the Debian-and-Friends corner were the usual suspects who you see at every (big) FOSS/Linux event). I had some nice chats with Enrico (about Geany and Xfce) and Leo (about bley), besides of the usual when will Squeeze be released? and how does X work in Debian? with random people. When there are a lot of people, a key signing party isn t too far away. Thanks formorer for the orga! You still owe me a sig from FrOSCon 2008 ;) And if someone wonders why he/she got a sign-mail from me even when he/she wasn t at the FrOSCon KSP: I used the fact that I have to sign a lot of keys to sign even more (from the OpenRheinRuhr 2009 KSP and the BSP in M nchengladbach at the beginning of this year [yes tg, I even signed yours, hope you liked the MIME]). As usual I missed almost every talk I wanted to hear and end up with just one (the one about RegEx), which sadly wasn t good at all. I guess that s all I have to say about FrOSCon. Oh wait, no, there was a questionnaire which included the question whether I ll visit future FrOSCons. Of course! Hope to see ya all at MRMCD, OpenRheinRuhr, 27C3 etc So Long, and Thanks for All the Frogs!

Now that I've mentioned the general timeline of a DebConf, let's talk about the "global team", "local team", and decision processes.Who is the "global team"? Basically, it is the active people on the debconf-team IRC channel and mailing list. Anyone can contribute, but we know who is who. Those with the most moral authority tend to be those who have organized a past DebConf or been involved for many years, and their opinions always have a high weight. Many of them are still around.So then how are decisions made? It's a combination of consensus-based and "whoever want to, do it". We discuss ideas based on what experienced people have seen work/not work, what new people want to try, and perhaps most importantly, who can make it happen. (this is where you fit in). There aren't necessarily leaders picked beforehand, instead leaders develop themselves. Overall, this is similar to any other team in Debian.There aren't formal gatekeepers who can veto anything, but if someone sees a problem, they should speak up and get critical mass of people to fix things. Those who hold the money (SPI, FFIS, the DPL) of course will monitor our processes and would intervene if someone started going off course.Typical global team tasks are fundraising, travel sponsorship selection, talks, registration.The local team starts out as the winning bid team. They started out figuring out local logistics for their venue, and up until arrival, they are the ones who are handling the local tasks (venue, food, accommodation, entertainment, day trip, Debian Day outreach). They should keep the global team updated on their status and what they are arranging, so that the experienced ones on the global team can give feedback. Global people will, of course, get involved here where they see fit and can help.The local team shouldn't exist in isolation though, anyone local is highly encouraged to get involved in "global team" tasks. The more coordination and bi-directional help we have, the better.It isn't the job of the local team to put on all of DebConf themselves. They aren't selected and left with free reign, they should integrate with and understand the history of DebConf, and then work on whatever improvements they want, whether they are local or global.
So in short, there are the names "global team" and "local team", but really, it's all one big Debian team. Those who are interested work and make things happen through a consensus-driven process. Things aren't always perfect: we have conflict, disorganization, leadership turn-over, lack of volunteers, lack of time, all the usual things that happen in volunteer organizations. I think most people want to work towards this ideal, and we hope that this series of posts will help us to improve. Most importantly, when you see something you'd like to work on, you can get involved.Tags: debconf

long time no RC bug posting. in july I was at the Munich BSP, & during DebCamp/DebConf I had the excuse of being one of the judges of the RCBC (which was the only reason for the freeze, I'm sure :)).

to keep up with the tradition of posting about my other RC bug activities, here comes a short list. as you can see most of the work was done in or around the pkg-perl group; luckily I often only have to upload packages prepared by ansgar, carnil, & others.

• #560634 src:libparse-debianchangelog-perl: "libparse-debianchangelog-perl: FTBFS: tests failed"
  upload NMU prepared by Ansgar
• #578458 src:libcoro-perl: "libcoro-perl: FTBFS: E: Caught signal 'Terminated': terminating immediately"
  use different backends for different architectures - didn't work :/ (pkg-perl)
• #580479 libdbd-mysql-perl: "libdbd-mysql-perl can access out of string and call craches"
  upload new upstream release, prepared by Ansgar (pkg-perl)
• #582410 libgtk2-perl: "libgtk2-perl: FTBFS on mips: Failed test 'callbacks encountered'"
  don't run tests that need an X server (pkg-perl)
• #585471 webgui: "webgui: License of www/extras/yui/examples/treeview/assets/js/json.js is considered non-free"
  upload new upstream release prepard by SquOnk
• #588118 libmoose-perl: "libmoose-perl [ia64]: test failures"
  upload with patch from Niko (pkg-perl)
• #590409 src:libdbd-anydata-perl: "libdbd-anydata-perl: FTBFS: Can't call method "params" on unblessed reference at /usr/lib/perl5/DBI/DBD/SqlEngine.pm line 721."
  upload NMU prepared by Ansgar (pkg-perl)
• #590453 libgtk2-perl: "libgtk2-perl: Gtk2::Dialog and descendents signal produces different response to ->run()"
  upload new version prepared by Jeffrey (pkg-perl)
• #591108 src:jabref-plugin-oo: "jabref-plugin-oo: FTBFS: package org.antlr.runtime does not exist"
  add .jar to classpath
• #591113 src:libwebservice-youtube-perl: "libwebservice-youtube-perl: FTBFS: tests failed"
  upload fixed package prepared by carnil (pkg-perl)
• #591120 src:libhtml-formfu-perl: "libhtml-formfu-perl: FTBFS: failed test"
  upload fixed package prepard by carnil (pkg-perl)
• #591166 src:nama: "nama: FTBFS: tests failed"
  upload new upstream release prepared by ansgar (pkg-perl)
• #592981 src:jifty: "FTBFS: failed tests t/TestApp-Plugin-SetupWizard/t/001-basic.t with libyaml-syck-perl 1.12-1"
  upload patched package prepared by ansgar (pkg-perl)
• #593012 src:libdevel-ebug-perl: "FTBFS: test t/pad.t fails with libyaml-syck-perl 1.12"
  upload patched package prepared by carnil (pkg-perl)

I hope we as a project can keep up the momentum to fix the remaining RC bugs, & see a release in a not so far future.

DebConf10 ended 2 weeks ago, I m back in Bosnia and I needed some time to recalculate everything that happened to me in last month This was my third time in NYC, and NYC as a city never left me empty handed, in every possible sense! And am seriously considering option of moving back one day, whether to get my Masters/phD or just do work we ll see what future holds for me DebConf10 I was in organization team for DebConf10, but if you put me aside, what s particularly interesting is that there was a total number of 7 Bosnians on DebConf10, two of which were government officials. I must note this wasn t our complete team, and what s most important of all is that they all pretty much volunteered as much as they could, of course, besides good will to help Debian, but also to at least somehow prepare themselves for organization of DebConf11. It s also worth noting that this was their first DebConf, and I as a leader of the team must say I m proud on how well they performed. I m sure by being highly active in volunteering they have learned as much as they could when it comes to how it s done and were able to see good and bad sides of DebConf10 organization team. Of course, I d also like to thank DebConf10 team for their superb work, perfect Venue selection, their hospitality and being incredibly friendly and helpful to all of us. As I said in one of my lectures, it s kinda unwritten rule that every next DebConf has to top the previous one, and that being said it s going to be almost impossible to compete with this year bid, but being Bosnians we re up for the challenge My DebConf10 Pictures: Semi-private album FaceBook public link (no registration required) DebConf11 DebConf10 was busy period for all of us, but I don t want to start complaining since even though we ve done enormous amounts of work so far, the real challenge lays ahead of us. With DebConf10 behind us, the thing we should process now is it s our turn now, we re next Before anything, I d like to thank Government of Republika Srpska for their full financial support, which was one of the preconditions to even get this bid. With their full support + sponsors, we ll be able to get great amount for sponsorships, for you to come to Banja Luka from the most remote places, and also in case you need visa for them to help you in getting one. Government support is just too precious in any way you want to take it. We would also like to invite you to DebConf11 in Bosnia (Banja Luka) next summer, we also invite all of you to our communication channels (mailing list, irc) since we would really like to get involved as many people as we can. Besides all of you enjoying DebConf11 next year, we would like you to help us in giving directions since we re a young team Besides Debian people, I d like to invite anyone who think he/she could help, or want to get involved, especially individuals/organizations/LUG from whole region! It s also important to stress that in all of our communication means, we do speak English, so please do not hesitate if you have any sort of question/suggestion/whatever. For those interested in next DebConf11, most important page you should follow is our wiki page, where you can find all information and which we keep updated in timely manner: http://wiki.debconf.org/wiki/DebConf11/BanjaLuka Communication/Links Languages we officially support are: English, Bosnian, Serbian and Croatian Mailing list:
http://lists.debconf.net/mailman/listinfo/debconf11-bosnia IRC:
#debconf11-bosnia on irc.debian.org / irc.oftc.net Twitter:
#debconf11 tag
http://twitter.com/absinthesyringe (shameless self promotion ) Facebook:
Official DebConf11 FaceBook group DebConf10 Adnan Hodzic DebConf11 in Bosnia (Introduction and Invitation):
Lecture video high quality (205mb)

See you next year!

(this is a post in two parts) At the BoF of GPG Key Management: Best Practices, dkg had two immediate recommendations for improving WoT resilience:

• Regularly refresh your local keyring from the key servers;
• If you have spare space and transit, provide a key server to take part in the pool.

Regular Refreshes This is important because unless keys are refreshed, changed expirations and (more importantly) revocations on keys are never made known to you. Making regular refreshes is easy, though I was surprised to hear people had experienced difficulty with it it s a simple entry to cron, like: 0 0 * * 1 /usr/bin/gpg --refresh-keys to run at midnight on a Sunday, or any other convenient time. Append > /dev/null to make it silent unless there are errors. Provide a key server This is nearly as trivial a refreshing the keyring, but it does take some disk space (on my machine, 4G for the decompressed dump from another server, 7.4G for the database itself and a few hundred MB for other stuff. Supposedly the dump can go after a full database build, but as I m not constrained I haven t bothered). The sks package in Lenny and Squeeze manages the database and answers to clients. However, take care to follow README.Debian carefully, since if the permissions on /var/lib/sks or /var/log/sks aren t set right it will silently fail and much head-scratching will ensue. Building the database for the first time takes some hours even on a reasonably quick machine, and takes a lot of CPU time, so it s probably best done overnight. Once sks is running, it needs to catch up from the date of the key dump to now (which is why a recent dump is always a good start). To do that, it should be listed in the pool.sks-keyservers.net and therefore needs gossip peers. http://code.google.com/p/sks-keyserver/wiki/Peering is an excellent guide, though the version of sks in Lenny does not support multiple listening addresses for either the recon or hkp processes. When a small enough delta between the server and its peers is reached, it s included in the DNS pool for use by other clients.

A DebConf doesn't just happen in a few months. It's not even a year, it's closer to two or two and a half. I've only been through two cycles, and I think this process has happened for the last three or four DebConfs. This post will talk about a "brief" summary of the general DebConf timeline, with elaboration on all the bits later. This post describes the preparation of DebConfN in year 20XX.
At DebConfN-2 (mid 20XX-2), there is a talk where interested groups can describe their location and how it would be suitable for a DebConf. This consists of a short presentation and discussion, but not many details by this point. No decision is made here.Throughout late 20XX-2, teams develop their bid as best they can. The last two years there has been a nominal deadline of December 31 20XX-2 for submitting a bid, but like all DebConf deadlines it's more for guidance than a real deadline. There are various checklists and templates to provide guidance here, which I'll describe later.Early 20XX-1 brings a lot of work to finalize bids, and then the actual selection process. There is a burst of mailing list traffic where people ask questions and help each other refine their bids. There are several meetings where bid teams give their status and people can ask questions. In February or March, there is a selection meeting.After the decision meeting, there is a big round of cheers but people soon refocus on DebConf N-1 since it is more urgent. Ideally, most of the people involved in DebConfN help with DebConfN-1 both because DebConfN-1 needs help, but also to learn how to make DebConfN go well. The DebConfN local team keeps working in the background doing whatever is needed to prepare for their conference.At DebConfN-1, there is a talk where the DebConfN team presents their progress to the DebConf attendees and tries to build support.Late 20XX-1 brings the end of the previous conference and time for N's localteam to really start getting stuff done. Throughout the last part of the year, we try to work out enough details for registration to begin: final conference dates, locations, accommodation, etc.Registration opens in early 20XX. The exact dates for opening/sponsorship deadline/reconfirmation/etc all depend on how early in the year the conference will be. There are nominal deadlines published, but they usually slip. With our limited volunteer base, it's hard to make things go according to schedule, but things always work out.Around this time, the fundraising team really starts working hard. Also, the travel sponsorship team needs to meet to decide who gets funded. The talks team needs to issue a call for events, read, and select them. The video team needs to make sure that they will be ready for the DebCamp setup period. There are many more things I'm forgetting, too.In the months before arrival, it becomes kind of crazy from a local perspective. There are many things to get organized before people arrive, mainly focusing on food, accommodation, and venue space logistics.Once DebCamp starts, things get even more complicated, but we have a flood of experienced DebConfers from around the world come in, and they all know a bit and can help out. DebCamp is effectively the DebConf preparation week to the organizers. DebCamp becomes DebConf, and much bigger, once all attendees arrive.Eventually, people leave and everyone goes home. This doesn't mean local stuff is over - I'm still engaged in DebConf10 wrap-up, making sure everyone gets paid and everything is returned.Mid to late 20XX brings a brief period of rest for most people.There is one last thing to do, though: the DebConf final report. This describes the events of DebConf, and is very useful for getting sponsors. It is also a valuable reference for future years looking back on the lessons learned. You can browse past final reports in our archive . Because everyone is tired, this too frequently gets pushed off until early 20XX+1, when DebConfN+1's fundraising team needs it. A frantic rush finishes up the missing pieces and it's done.
So, there you have it: a rough outline of the timeline of a DebConf. It extends from mid 20XX-2 to early 20XX+1, more than two and a half years. This post nowhere near describes all the details that go into DebConf, almost any of the paragraphs above could be made it's own post. Stay tuned for them.Tags: debconf, debian

Linux People and Voting Chris Samuel (a member of LUV who s known for his work on high performance computers and the vacation program) has described why he s voting for the Greens [1]. His main reasons are the Greens strong support of human rights and for science-based policy. Paul Dwerryhouse (a member of the Australian Linux community who s currently travelling around the world and who has made contributions to a range of Linux projects including SE Linux) has described his thoughts about the Filter Conroy campaign [2]. He gives a list of some of the high profile awful candidates who could possibly win a seat and therefore deserve a lower position in the preferences than Conroy. SAGE-AU and Voting for the Internet There has been some discussion by members of the System Administrators Guild of Australia (SAGE-AU) [3] about issues related to the election. As you would expect there was no consensus on which party was best. But there was a general agreement that the Greens are the only significant party to strongly support the NBN (National Broadband Network fiber to the home in cities and fast wireless in rural areas) and to also strongly oppose censoring the Internet. SAGE-AU has an official position opposing Internet filtering, and while the organisation hasn t taken a position on the NBN it seems that the majority of members are in favor of it (I am in a small minority that doesn t like the NBN). So it seems that political desires of the SAGE-AU members (and probably most people who care about the Internet in Australia) are best represented by the Greens. Note that SAGE-AU has no official policy on this, the above paragraph is based on discussions I ve had on mailing lists and in private mail with a number of SAGE-AU members. Also note that not all the SAGE-AU members who agree that the Greens advocate their positions on Internet issues plan to vote for them. The Green support for the NBN is based on the importance of the Internet to all aspects of modern life, the social justice benefit of providing decent net access for everyone (particularly people in rural areas) is very important to the Greens. I still oppose the NBN and believe that it would be better to just provide better ADSL in all suburbs, better net access (through whichever technology works best) in rural areas, and fiber to the central business areas. But the NBN isn t really that important to me, human rights and a science based policy are much more important and are the reasons why I ve been supporting and voting for the Greens. No Wasted Votes One thing to note is that the Australian electoral system is designed to avoid wasted votes. There are two ways of considering a vote to be wasted in Australia, one is if you live in an electorate where both the upper and lower house elections have an almost certain result such that no expected swing can change the outcome I doubt that this is possible for any region in Australia given the way the upper house elections work, although a large portion of the lower house seats have a result that is almost certain. The other way of having a wasted vote is to vote for someone who doesn t actually represent you. Lots of people mindlessly vote for a party that seems to represent them, either they identify with unions and vote Labor every time, they regard themselves as conservative and vote Liberal every time, or they live in a rural area and vote National every time. The Labor and Liberal parties don t differ much in policies and members in safe seats typically don t do anything for the people who elected them. If you generally support the policies of one of the major parties then it can be a good tactic to give your first preference to a minor party. For example if you tend towards Labor then vote Greens first and preference Labor over Liberal. The result will be that your vote will count towards Labor in the lower house and it sends a message to Labor and prevents them from being complacent. Before Australian elections there is always some propaganda going around about wasted votes, this is usually part of a deliberate campaign to try and prevent people from voting for smaller parties. Because the news has many mentions of wasted votes in US elections (which are watched closely in Australia) it seems that some Australians don t realise that there are significant and fundamental differences between the political systems in Australia and the US. Volunteering Last time I checked the Greens were still accepting volunteers to hand out how to vote cards, so if you want to do more for the Greens than just vote for them then this is one way to do it. If you want an uncensored Internet with freedom of speech and a lot of investment in infrastructure (as well as good support for all human rights) then you really want to help the Greens win more seats at the election on Saturday.

• [1] http://www.csamuel.org/2010/08/17/why-im-voting-green-on-saturday-21st-august
• [2] http://weblog.leapster.org/archives/163-Why-Victorians-should-not-put-Senator-Conroy-last.html
• [3] http://www.sage-au.org.au/

Since I didn t actually come home from Debconf, but instead took a further week s holiday and lazed around by the beach, I haven t sat down to write anything about it yet. Most importantly, I should say thank you to Joey Hess, Steve McIntyre and Stefano Zacchiroli for arranging the Debconf Newbies programme, without which I would have been stuck at work watching the videos again (though this does have the advantage of seeing three talks at once). Every year I am astounded at the generosity of certain companies who sponsor the conference, since I ve experienced for myself the difficulty of trying to put a corporate price on free software even more so to specifically sponsor newbies, who by definition probably aren t as active in ways that interest sponsors than more established developers. Right up to the day I flew I was nervous (as in any social situation) at meeting so many new people in one go, on my own, and long way from home after all, it s not really easy to back out and go home after that But in fact, everybody I met was warm and friendly, and very supportive in all sorts of ways. I got to see and hear many talks; in the first two days alone:

• Supporting Debian machines for friends and family
• Debian at a large Dutch university
• Why is GNU/Linux Like a Player Piano?
• Bits from the DPL
• Packaging Python modules and applications
• The Unity desktop environment
• Collaboration between Debian and Ubuntu

And of course social events, like Cheese and Wine, Keysigning (handy for putting faces to names), many nights in the third hacklab, a day trip to Coney Island, a privileged viewing of the most nerdy organ in the world, and a trip up the Empire State building: The campus was ideally suited to such a conference, and apart from the mugginess we had excellent weather. I discovered that I rather enjoy watching baseball and that one should repeat the application of sunblock after paddling. But what I enjoyed most of all was being in the same area as so many eminent Debian people, and being so inspired by them to be even more involved technically and socially. I hope to see you all again soon!
<script type="text/javascript"> var flattr_wp_ver = '0.9.11'; var flattr_uid = '32970'; var flattr_url = 'http://www.jwiltshire.org.uk/content'; var flattr_lng = 'en_GB'; var flattr_cat = 'text'; var flattr_tag = 'blog,wordpress,rss,feed'; var flattr_btn = 'large'; var flattr_tle = 'jwiltshire.org.uk'; var flattr_dsc = 'The public face of jwiltshire'; </script> <script src="http://api.flattr.com/button/load.js?v=0.2" type="text/javascript"></script>

After reading Do It Tomorrow, I was inspired to try some of the techniques that Mark Forster proposes. I commented in the review about the closed list system, which I'm still mostly using with some success. But I also started playing with the initiative slot. In his system, the initiative slot is first thing in the morning each (eligible) morning, which is used for a special project that you want to make forward progress on. There are several criteria for choosing a task for the initiative slot. One of the strongest is dealing with a backlog. Since I'd been feeling guilty about the backlog of Debian Policy work that had built up, that seemed like a good choice. I picked up Debian Policy backlog clearing as my initiative starting at the beginning of June after the AFS and Kerberos Best Practices Workshop, with a goal of getting the open bug count below 100. This has been very instructive, both from a time management perspective and from a Debian Policy perspective. Here are a few things that I learned on the Policy side:

• The open bugs against Debian Policy by and large represent real work that we should tackle in the Policy document. They're not all fully thought-out proposals, but I didn't find much that I could simply close (apart from a set of bugs requesting additional common-licenses, once I had an analysis tool). From time to time, we've thought about timing out old bugs that have not made any forward progress, but this experience leads me to think that would serve us poorly.
• It takes me about an hour on average to resolve a Policy bug. That includes all the fast five-minute typo bugs (well, ten minutes; I need to improve my Policy workflow to be a bit more efficient in the commit process). Some bugs take easily ten hours or more, such as #504880. I think this is on par with or a bit slower than resolving typical bugs in compiled software I package, and much slower than Lintian, where bugs take about a half-hour on average to resolve, I think.
• Most Policy bugs are making no forward progress because no one has written wording and started iterating on that wording. There are some exceptions, and this process seems to go better for me than it has for some other contributors, but if I pick up a bug and start drafting wording changes, I can usually bring the bug to resolution in about a week, often less. This implies to me that our process for making Policy changes is reasonable but we need more targetted help. This was discussed at the BoF at DebConf and on the list afterwards and I now have three people who have volunteered to supply some of that targetted help and need to get more organized to make use of that offer.
• The normative (rule-affecting) versus informative (informational and documentary) distinction in Policy is tricky and unclear, and most bugs end up becoming normative. While I think our system for dealing with normative bugs is reasonable, this does slow down fixes. I can commit informative changes without review and then tweak them if people object, and it would be nice to fix more wording issues that way, but it's hard to avoid getting tangled up in normative issues.

Things I learned on the time management side:

• I didn't work from a closed list, which is frowned on for dealing with backlogs. I'm not sure if this ended up being a problem or not. The correct approach, in theory, is to work out a system for dealing with new incoming work, make sure that system is in place, and then process backlog independently of all new work. I never did that. I never separated out the backlog into a closed list that would get smaller. I suspect I should have, although I'm not sure of a good way to do that in the BTS in an area where we're already using usertags for another purpose.
• The point of the initiative slot is to unblock something or to clear a backlog, but the initiative slot is supposed to rotate. It's not a good way to deal with something that's going to take a long time to resolve. In retrospect, I was excessively ambitious with my goal. Even apart from not working from a closed list, I can average about a half-hour a day on the initiative slot, which at an hour a bug and a starting point of 160 bugs would mean 120 days to reach my goal. That's too long for one task to dominate the initiative slot.
• The initiative slot really works. We brought the bug count on Policy down from about 160 to 126 over the course of those two months, and I don't think much changed other than my level of activity and of course the normal effect of other people getting more involved when someone is visibly doing work. The bug graph is impressive. It's very obvious when I started working, and also very obvious when the ramp-up to DebConf started and I stopped having time to have a daily initiative slot.
• Doing something that's unrelated to my day job in the initiative slot creates an odd tension, and I'm not sure how to deal with that. On one hand, one of my standard time management failure modes is to spend too much time on work and not enough time on non-work tasks. On the other hand, that's partly because I'm hypersensitive to not focusing enough on work and overcompensate, and taking time each morning to do non-work things doesn't help that. I'm not yet sure what to do about this.
• One of the failure modes of initiative slots that I'm already noticing is that when I move something out of that slot, rather than continuing to work on it at a normal pace, I have a tendency to stop working on it altogether. This doesn't work, particularly if it was used for backlog clearing. I just build up another backlog and then have to use the slot to clear it again. This means I need to give more attention to my time management outside of that slot.

I stopped using the initiative slot while travelling and haven't gotten back into the hang of regular time management since I've gotten back. I haven't yet decided whether to leave Policy work in the initiative slot for right now but change the goal, or whether to swap it out for something else. I'd like to keep momentum, but I'd also like to start using that slot for other things. Still pondering.

17 years I guess the puberty is almost a thing of the past and you re getting all grown up and stuff. You certainly changed for the better in the last years. Ok, a few rough edges here and there but overall a quite impressive development. You re already forking regularly and even your offspring is quite handsome. No wonders with those genes if you ask me. Thanks to Ian for starting probably the best Linux distribution out there. I hope you are proud of what you ve started (I certainly was when I met you two years ago) and someone is killing a few beers with you right now. Also big thanks to all the Debian Developers, Maintainers and contributors for making Debian what it is today. Keep up the good work!

* So, here is late report! Sometime back Praveen started discussion at DebianIndia mailing list about having MiniDebConf kind of conference here in India. MiniDebConfs are generally focused on development rather than at introduction to Debian . But, since this was our first attempt, out focus was more on to introduce Debian to student community and after writing this after 5 days I realize that we ve done good job! Many thanks to Joerg Jaspert for setting up Mini website: http://in2010.mini.debconf.org/ Praveen got bunch of sponsors, many thanks to CDAC and other sponsors for making event happen with testy food and tea that kept me awake. Now what really happened at Pune? My flight was nice. I went to guest house of COEP (the host college, 2nd old engineering college in India) and took some rest and called Praveen. He was already at computer lab and setting up Virtualbox and other things. We had two places hall and lab. Unfortunately, both were at different buildings and subway between them I discussed with couple of students and we went to dinner at late night. Pro. Abhijit who was kindly give permission to use lab and college hall was another source of energy. He is handling many FOSS events in college and probably only faculty who encourage students to use and learn FOSS. The Day 1 started with long lines of registration process. As we had around 200 registration, turn out of students were 100% on first day. Hall was almost full. Dr. Shashikumar from CDAC gave nice lecture about contribution which was well received. Praveen and Onkar then took the stage and gave nice introduction about Debian. I met Onkar first time. We had really nice discussion ranging from becoming Ubuntu MOTU to his Powerbook s adapter. After that Vikram took lively session on i18n and l10n in Debian and I took boring session on Contributing to Debian . Yet another boring session from me was Developer Toolbox . Packaging workshop by me at hall made many faces to yawn heavily while Onkar and Praveen handled it nicely at Lab. Main reason for yawning was Wifi and my Macbook s capacity to deal with ndiswrapper and crappy broadcom s drivers. (Note: I should get nice machine.) I met Sham first time. I met Kushal once again and felt energetic again! Day 2 As we expected number was very low compared to Day 1. So, we closed hall and moved entire stuffs to Lab only. Vikram took again nice session on Debian Edu . It was very interactive and I should learn something from his act of presentation. Another nice thing from Day 2 was discussion with BOSS Linux team. Hold on. Lets keep some old woes aside. They are basically doing what their bosses are telling. Developers were clueless about Sending patches to upstream. Their bugzilla had Zorro bug reported. I made promise to follow-up on this and set-up patches from boss at somewhere depending upon their response. That mail is my draft let me finish it by weekend. Pavi and others took video from session. It will be nice if someone will post it somewhere We then continued on discussing bugs and packaging area. It was amazing to see Praveen become DM during conference and also to see: upstream, maintainer and sponsor in one room. I really had nice food at dinners. Mango Mastani was nice. Beer was nice. How can I forget discussion with Ramki, Ninad, Pro.Abhijit, Praveen, Pavi and others after dinner? So lets work for MiniDebConf 2011 now!