After coming back from holiday where I made lots of photos and videos, I needed the possibility to import all those from SD cards to my fileserver running Debian unstable. To import the photos I used Digikam on Linux, that was no problem. But for the videos I needed iMovie and/or FinalCut Express on my Mac. I've looked into Kino and Cinelerra, but those Linux apps are awful. The problem was that iMovie is able to directly import from our Panasonic HD camcorder to the network storage. I was always forced to first import the fotoage to the drive in my MacBook Pro and copy it then to the Linux box onto a Samba share. The solution for that problem is to use netatalk/AFP. The Linux box appears as a Mac Xserve then. However, I quickly found some HowTos for configuring netatalk. One HowTo is from Mike Hughes and the other one can be found on disgruntled-dutch.com. If you follow these two HowTos you're quite close to have a working AFP service to interact with your Mac via Bonjour/Avahi. There are mainly two problems when you follow them. First, Mike Hughes has some illegal chars in his sample /etc/avahi/services/afpd.servicefile:

<!DOCTYPE service-group SYSTEM avahi-service.dtd >
<service-group>
<name replace-wildcards= yes >%h</name>

The quotation marks are the problem. Instead of you'll need normal " quotation marks. Or you can use the file on disgruntled-dutch.com. Next problem is the configuration of the shares. On both sites the examples are using cdb as CNID backend:

~/ "Home Directory" cnidscheme:cdb options:usedots,upriv

But this will give the following error:

Aug 3 23:30:29 muaddib afpd[8151]: Can't open volume "/home/ij" CNID backend "cdb"
Aug 3 23:31:26 muaddib afpd[8151]: Cannot find module named [cdb] in registered module list!

The solution can be found on forum.ubuntuusers.de (German): you'll need to change the cdb to dbd. So, the Home Directory share will look like this then:

~/ "Home Directory" cnidscheme:dbd options:usedots,upriv

Quite simple and easy. Now restart your avahi-daemon and netatalk services and have fun! When you want to use a share on your Linux server for TimeMachine backups, you'll need to add a "tm" to the options of your share.

For a while I ve been maintaining my own WordPress packages. I use quite a few plugins that weren t included in Debian, some of them have unclear licenses so they can t go in Debian while the rest would have to go in Volatile at best because they update regularly and often have little or no information in the changelog to describe the reason for the update so we have to assume there is a potential security issue and update it reasonably quickly. As I m maintaining plugin packages it seems most reasonable to keep maintaining my own packages of WordPress itself which I started doing some time ago then the version in Debian became outdated. Now WordPress isn t a convenient package to maintain, the design of it is that a user will upload it to their web space via FTP or whatever, it s not designed to be managed by a packaging system with the option of rolling back upgrades that don t work, tracking dependencies, etc. One example of this is the fact that it comes with a couple of plugins included in the package, of which Akismet is widely used. The Akismet package is periodically updated asynchronously from the updates to the WordPress package with the apparent expectation that you can just FTP the files. Of course I have to build a new WordPress package whenever Akismet is changed. Now there is a new default theme for WordPress called TwentyTen [1]. This theme ships with WordPress and again has updates asynchronously. Just over a week ago my blog prompting me for an update to the theme even though I hadn t consciously installed it I have to update because I don t know whether one of the other users on the same system has chosen it and because having a message about an update being required is annoying. The Themes update page has no option for visiting the web site for the theme and only offered to send it to my server via FTP or SFTP, of course I m not going to give WordPress access to change it s own PHP files (and thus allow a trojan to be installed). So I had to do some Google searching to find the download page for TewntyTen which happens to not be in the first few results from a Google search (even though those pages look like they should have a link to it and thus waste the time of anyone who just wants to download it). After downloading the theme I had to build a new WordPress package containing it I could have split it out into a separate package and have the WordPress package depend on it, but I ve got enough little WordPress packages already. It doesn t seem worth-while to put too much effort into my private repository of WordPress packages that possibly aren t used by anyone other than me. Plugins aren t as bad, the list of plugins gives you a link to the main web page for each plugin which allows you to download it. I wonder what portion of the WordPress user-base install via FTP to a server that they don t understand and what portion of them use servers that are maintained properly with a packaging system, my guess is that with the possible exception of WordPress.com most bloggers are running on packaged code. It seems to me that optimising for Debian and CentOS is the smart thing to do for anyone who is developing a web service nowadays. That includes files managed by the packaging system, an option to downgrade (as well as upgrade) the database format (which changes with almost every release), and an option for upgrading the database from the command-line (so it can be done once for dozens or hundreds of users). deb http://www.coker.com.au lenny wordpress I have a repository of WordPress packages that anyone can use with the above APT sources.list line. There is no reason why they shouldn t work with Testing or Unstable (the packaging process mostly involves copying PHP files to the correct locations) but I only test them on Lenny.

• [1] http://wordpress.org/extend/themes/twentyten

Even though I am late with this post, it is nice to say that I am writing here from this year s DebConf10, in NYC. Today (well, yesterday) was the day of the Cheese and Wine party and I think that it was cool, at least for the moments that I were there. This post, though, isn t technical in any sense. I only talks shortly about my impressions of the community, as this is my first DebConf ever (despite the fact that I have been using Debian since the late nineties). I was very pleased to have met Bdale Garbee. I saw him the other day arriving with Keith Packard, but I just didn t want to disturb them at that point. We only talked for, say, 2 minutes, and his was one of the nicest receptions that I had here. And there were some other people that were equally easy to approach, nice to talk with and, to my surprise, knew my name after some brief moments (yes, this does make a difference, especially when you are in a strange country, when you don t know anybody with whom you have worked for some years). Being involved in the organization stuff, one would think that Jimmy Kaplowitz would be so busy, but he was so kind. I had longer conversations with T ssia Cam es, Tiago Vaz (as always) and some other people that I had not yet had the pleasure of meeting in person. In particular, Daniel Baumann (who apparently is now crazy about our FISL and wants to drink all Guaran that he can get ), Chris Lamb and Ot vio Salvador and his mom. Those people are so cool and it is nice to discuss some legal issues among different continents in the lounge of their building at late night. Too bad that I am allocated to the other building. I am forgetting many other people (hey, it is 2 am here in NYC), but I would feel guilty if I had not mentioned at least three people more: Martin Michlmayr, Phil Hands, and Reinhard Tartler (who is uploading lame to the debian repository, as the patents regarding it are expiring or expired already). Thanks! P.S.: I just created an account on flickr that I hope to populate with some photos that I took here. And even with a nice squirrel.

Today was the first day of DebConf proper, where all of the sessions were aimed at project participants. Bits from the DPL (Stefano Zacchiroli) Stefano delivered an excellent address to the Debian project. As Project Leader, he offered a perspective on how far Debian has come, raised some of the key questions facing Debian today, and challenged the project to move forward and improve in several important ways. He asked the audience: Is Debian better than other distributions? Is Debian still relevant? Why/how? Having asked this question on identi.ca and Twitter recently, he presented a summary. There was a fairly standard list of technical concerns, but also:

• A focus on quality, as defined by Debian s highly modular approach. Each package maintainer is an expert on the software they package, and Debian as a whole offers a superior repository of packages.
• The principles of software freedom, as embodied in Debian s Social Contract. The Debian community s current interpretation is a purist one, and Stefano cited the elimination of non-free firmware as a milestone in the upcoming Squeeze release. I wonder, though, how many of the audience, tapping away on WiFi-connected laptops, were able to do so without such firmware.
• The project s independent status, supported by donations and volunteers, which empowers it to make its own decisions, free of external impositions.
• Debian s ability to make decisions, as embodied in the constitution. This happens mostly through do-ocracy (individuals are empowered to decide questions concerning their own work), though larger scope issues are decided democratically. This one evoked a bit of a chuckle, as decision making in Debian is not always perceived as fully effective.

He pointed out some areas which we would like to see improve, including:

• Developers accepting shared responsibility for the release as a whole. Making one s own packages ready for release is necessary, but not sufficient. He cited evidence that the culture around NMUs is changing: historically, due to the do-ocratic system mentioned above, Debian developers have been somewhat territorial about their packages, and non-maintainer uploads were seen as stepping on their toes. However, recent experiments have indicated that this may no longer be the case, and Stefano encouraged more developers to help each other through NMUs.
• When making decisions, we should seek consensus, not unanimity. In a project with thousands of contributors, whose operations are open to the public, there will never be unanimous support for a proposal, and seeking unanimity leads to stalled decisions.
• In order to gain more contributors, Debian needs to welcome new and inexperienced contributors, as well as users (who can grow into contributors. He suggested reaching out to derivatives to find more of both. He decried the conventional wisdom that a thick skin should be a prerequisite for joining the project, pointing out that this attitude simply leads to fewer contributors. This point was met with applause by the DebConf audience.

All in all, I thought this was an accurate, timely and inspirational message for the project, and the talk is worth watching for any current or prospective contributor to Debian. Debian Policy BoF (Russ Albery) Russ facilitated a discussion about the Debian policy document itself and the process for managing it. He has recently put in a lot of time working on the backlog (down from 160+ to 120), but this is not sustainable for him, and help is needed. There was a wide-ranging discussion of possible improvements including:

• Editing the policy manual so that it is more readable start to finish as a document, rather than a reference
• Creating a closer linkage between lintian and the policy manual, so that best practices from lintian get documented, and policy changes are accompanied by new checks
• Separating the normative and informative parts of the policy manual

There was also some discussion in passing of the long-standing confusion (presumably among people new to the project) with regard to how policy is established. In Debian, best practices are first implemented in packages, then documented in policy (not the reverse). Sometimes, improvements are suggested at the policy level, when they need to start elsewhere. I m not very familiar with how the policy manual is maintained at present, but listening to the discussion, it sounded like it might help to extend the process to include the implementation stage. This would allow standards improvements to be tracked all the way through from concept, to implementation, to documentation. The Java Packaging Nightmare (Torsten Werner) Torsten described the current state of Java packaging in Debian and the general problems involved, including licensing issues, build system challenges (e.g. maven) and dependency management. His slides were information-dense, so I didn t take a lot of notes. His presentation inspired a lively discussion about why upstream developers of Java applications and libraries often do not engage with Debian. Suggested reasons included:

• They are not interested in Linux as a target platform
• Although their code is released under a free license, they are not interested in meeting Debian standards for freedom and license correctness
• They use Java because it is cross-platform, and so do not want to concern themselves with platform-specific issues
• Because Java applications are easy to download and run manually, they perceive relatively little value in the Debian packaging system

Collaboration between Ubuntu and Debian (Jorge Castro) Jorge talked about the connections between Debian and Ubuntu, how people in the projects perceive each other, and how to foster good relationships between developers. He talked about past efforts to quantify collaboration between the projects, but the focus is now on building personal relationships. There were many good questions and comments afterward, and I m looking forward to the Debian derivatives BoF session tomorrow to get into more detail. Tonight is the traditional wine and cheese party. When this tradition started, I was one of just a handful of people in a room with some cheese and paper plates, but it s now a large social gathering with contributions of cheese and wine from around the world. I m looking forward to it.

If you have seen me anywhere near my computer at DebConf, you probably have seen the face of a hurried, worried developer. Still, if you monitor my Debian-related activity, you will notice it is still quite low, even given my (much needed and very much enjoyed) vacations pre-DebConf. Yes, orga-team work is very time consuming, even if my role is far from central this year. And yes, DebCamp+DebConf are known for sucking time into social interaction, which is great but not so (formally) productive. And yes, I even took 1.5 days off to visit my family and a friend who live in the area... Still, I managed to release! \ / Release what? I have been working with Pooka for the last ~2 years on the Seminary on Collaborative Knowledge Construction. We assembled a group of ~10 speakers/authors, each of whom prepared a chapter for a book meant for publication. Pooka and me coordinated the work, which took a long time because it was also an interaction experiment (and because we both did it only in our free time). After the coordination work started fading, I took up the task of coming up with a way to translate it all into LaTeX (and fix a host of conversion bugs, and play with the available packages, and... Hey, I'm after all just a LaTeX newbie, and had to learn to tame the beast!), I stumbled upon that precious fact that makes so many projects release. I stumbled upon a deadline. We want to publish the book under the seal of IIEc-UNAM. Besides my workplace, it is a very well regarded university, and having its seal in our work is definitively a big plus. And the Publications Committee of my Institute is meeting this week - So I had to send our final manuscript by today. Having a deadline overlapping with DebConf sucks. But somehow, I managed to do the needed work to my complete satisfaction. The work is now in the Committee's hands, and I expect to have more news soon(ish). Oh, and where can you get our work? Well, if you register in our site, you will be able to read the whole contents. And once the book is approved and published, the whole work will be published online under a free (CC-BY-SA) license. BTW, that probably means I will have more time to fix my Debian bugs and pending stuff! \ /

When I created my on-line photo album, we had the year 2001 and there was nothing wrong with publishing ones photos in the Internet. It has been almost ten years now, and things have changed. Privacy is an issue, especially when it also affects your friends and family. The problem
So I needed to find some protection. These were my requirements:

1. I only want to protect parts of the site, as there are some pictures that I intentionally share with the public. This selection should be possible down to the individual image.
2. The solution should work without any dynamic server component besides the web server itself. This rules out any self-written CGI scripts as well.
3. One password, given to all my friends etc., is not sufficient as it might leak to unintended audience.
4. I do not want my visitors to have to register and remember yet another username and password just for my site. I also do not want to manage this user database.
5. I do not want to have do large changes to the file structure of my photo album.

This rules out most common options, e.g. protection by a .htpasswd file. Requirements 3 and 4 point to a solution based on OpenID. With OpenID, my visitors can authenticate against a service they already use (Google, Yahoo, etc.), relieving me from the burden of maintaining a user database and them from having to remember a password. There is a mod_auth_openid module for the Apache webserver, and it is even distributed with Debian in the libapache2-mod-auth-openid package. So requirement 2 is fulfilled. The tricky part is: How do we achieve OpenID protection for some images, and not for others. The solution I first played around with selectively enabling or disabling mod_auth_openid based on <FileMatch> directives in the Apache configuration, but it was not elegant and would not scale well. I have more than 20.000 pictures to manage, and have already selected over 5000 pictures to be shown without protection. My solution is based on a partial copy of the whole directory tree that contains all public files. To save disk space, these are just symbolic links to the real file in the protected location. Some mod_rewrite magic then takes care of giving the user the impression that all files are in the same location. I set up a small example of my solution, which has this directory structure:

.:
drwxr-xr-x 2 root root 4096  2. Aug 12:03 images
lrwxrwxrwx 1 root root   18  1. Aug 12:05 index.html -> private/index.html
lrwxrwxrwx 1 root root   18  1. Aug 12:05 login.html -> private/login.html
drwxr-xr-x 3 root root 4096  2. Aug 12:03 private
./images:
lrwxrwxrwx 1 root root 33  2. Aug 12:00 pleaselogin.png -> ../private/images/pleaselogin.png
lrwxrwxrwx 1 root root 28  2. Aug 12:03 public.png -> ../private/images/public.png
./private:
drwxr-xr-x 2 root root 4096  2. Aug 12:00 images
-rw-r--r-- 1 root root  267  2. Aug 12:03 index.html
-rw-r--r-- 1 root root   94  2. Aug 12:01 loggedin.html
-rw-r--r-- 1 root root 2091  2. Aug 12:03 login.html
-rw-r--r-- 1 root root   10 18. Nov 2009  protected.html
./private/images:
-rw-r--r-- 1 root root 4074  2. Aug 11:58 pleaselogin.png
-rw-r--r-- 1 root root 2670  2. Aug 11:58 private.png
-rw-r--r-- 1 root root 2043  2. Aug 11:58 public.png

As you can see, real files only reside in private/, outside of that, only symbolic links exist. The apache configuration protects the private directory and blends it into the main directory:

   <directory /var/www/nomeata.de/openid-test>
        RewriteEngine On
        # Abuse the login page as an error image
        RewriteCond % QUERY_STRING  \.(png jpg)
        RewriteRule ^login.html$ /openid-test/images/pleaselogin.png
        # Ship private files, if they exist, unless public files exist
        RewriteCond  $1 !^private
        RewriteCond  /var/www/nomeata.de/openid-test/$1 !-f
        RewriteCond  /var/www/nomeata.de/openid-test/private/$1 -f
        RewriteRule  ^(.+)$ /openid-test/private/$1
   </directory>
   <directory /var/www/nomeata.de/openid-test/private>
        AuthOpenIDEnabled        On
        AuthOpenIDDBLocation     /var/lib/apache2/mod_auth_openid/mod_auth_openid.db
        AuthOpenIDLoginPage      /openid-test/login.html
        AuthOpenIDTrustRoot      http://nomeata.de
        AuthOpenIDCookiePath     /
        AuthOpenIDCookieLifespan 2592000
    </directory>

A special trick handles the login page for protected images: If the login page is requested and the referrer indicates that the user tried to access a .png or .jpg file, apache will instead ship an image containing an error message. For my photo album I have a small Perl script that, given a directory with a private/ directory therein and a list of rules in form of glob patterns, will symlink matching files and remove symlinks that are not allowed any more.
What s next? As you can see, this does not actually protect the content. It only requires the user to authenticate, then everything is visible. To select which OpenIDs are allowed to access which code, some bugs will have to be fixed in mod_auth_openid first. There was little activity there recently, I hope that the project is not dead.

Over the last couple of days I have been creating Debian Live Studio, a web-based service for creating Debian Live systems. After choosing between various options, you wait a few minutes and the server generates an ISO or USB stick image for download. I have a list of features I plan to implement but have put the service live so I can respond to feedback throughout DebConf. Please grab me. Regarding the current server infrastructure, I'm hosting this on a $15 virtual machine which will fill up in a few hours. If anyone can donate more serious hosting for this service please get in touch. You can check it out at: http://studio.debian.net.

The Flattr FOSS project is quite young so very few free software are currently listed in the dedicated directories. It s still advocacy time: if there are free software that you d like to flattr, please tell them and point them to Flattr FOSS. It s too early for any conclusion, but the feedback from users is good and it looks like that people using flattr to support free software are more generous than the average flattr user. You re great people! Anyway, it s time for me to give a few suggestions of projects to flattr.

1. My first recommendation is Project Hamster, it s a time-tracking application for GNOME but it has come a long way thanks to the work of Toms Bau is. I use everyday and it rocks.
2. My second recommendation is verallt, it s a Firefox extension that allows usage of Flattr even in places where it was not designed to be used: forums, mailing list archives, etc. The persons using Flattr just put [Flattr=20693] in their signature and the Firefox extension automatically replaces this text with a real Flattr button ready to be clicked. Thanks to Paul Da Silva for the nice idea and the first implementation!
3. My third recommendation is Mustard, it s a StatusNet client for the Android platform. More concretely you can install it on your Android phone to send updates to identi.ca while traveling. I have no Android phone but Mustard seems to be popular among owners of such phones!
4. My fourth recommendation is moreutils from Joey Hess. It s set of unix (command line) tools that nobody else thought of writing when unix was young (according to Joey himself). They are all very useful, I use more or less regularly isutf8 (verify if a file is UTF-8 compliant), combine (logical operations on lines of two files), pee (send standard input to two programs, very useful in git hooks when you want to run two programs that both consume the same data), sponge (ever tried grep -v foo file >file and lost your data? now you can use grep -v foo file sponge file ). And Joey is a long time Debian developer who has truly shaped Debian, he s behind several major Debian projects (debconf, debian-installer, debhelper, ). Big kudos to him!
5. My last recommendation is to flattr Andreas Gohr for his work as dokuwiki lead developer. There s no flattr button on dokuwiki s website but you ll find some in Andreas blog, just pick a dokuwiki related article like this one: Dokuwiki Birthday Bughunting Weekend. Dokuwiki is a simple wiki that works without any database (the pages are stored in flat files) and it s even commonly used to setup simple websites thanks to the numerous themes available.

Okay, that s it for this month. I ll try to keep a broad panel of software (desktop, command line, mobile, web, etc.). Since I have promoted a GNOME desktop application, I would like to be able to promote a KDE or XFCE application next month but I did not discover any KDE/XFCE project using Flattr do you know any? Please share in the comments if you find some. Also I wonder if you have decided of a flattr strategy Personally I m likely to flattr my favorites projects/persons each month and to flattr a few other occasionally as I discover them. What s your own strategy? 4 comments Support my work

So for one day a few days ago, I wasn't Wouter Verhelst, Debian Developer, but rather the above. I'm not usually very much interested in doing touristy things, but then on the other hand I'm of the opinion that you can't really claim to have been somewhere if all you've seen is the inside of a certain specific university campus. So, well, touristy things. I took the subway to about 10 blocks away from the very south of Manhattan, and then walked. I passed by city hall and what used to be the world trade center, but there wasn't much to see there construction sites are the same everywhere in the world. I moved on to "the battery", the south tip of Manhattan, and had an... interesting look at the Statue of Liberty in the distance. I thought about going there, but the tickets were sold out, so scratch that. Instead, I walked on to the Brooklyn Bridge (passing by Wall Street on the way), spent some time looking for the pedestrian's entrance to that bridge (which was slightly harder than would've thought it to be), and walked partway up the bridge. I wasn't interested in crossing over to Brooklyn, but it's an interesting bridge to walk on, and I had an interesting time. When I left the bridge again, it started raining. I don't mind a few drips on a warm day like that day, but this was more than that, and it started to bother me. So, rather than walking to the Empire State building, as I'd been planning, I decided to take the subway there. This did mean I missed out on the SOHO area, which I would've liked to see, but well, you can't have it all. The Empire State building is something you grow up hearing about, and I'd seen pictures of it. It has a somewhat distinctive silhouette, shown on several comparative graphics of high-profile skyscrapers. But none of that is even close to the real thing. Not that it's higher than I expected; on the contrary. But it does look different; its color is much lighter than I thought, and the distinctive silhouette isn't as distinctive once you're standing right next to the building. But, well, going up the building clearly shows that it is the tallest building of New York. There are other skyscrapers, but most of those seem to be little dwarves in comparison. The view is nice, up there, and I took some interesting pictures. The tickets aren't very cheap ($20), but not insanely expensive either. I don't regret doing this. (in case you were wondering: yes, the above picture is in the point of view of the one above that, and vice versa) By that time it was around 4 pm already, and I thought about going back to the Columbia campus. As I checked out my map for the most efficient route, I found that it probably would've been easier to walk to Times Square and take the number 1 train there which stops right in front of Columbia (but below the surface, obviously). So since I was going to have to go there, I figured I could just visit Times Square while I was at it. I must say I'm not very impressed by it. For starters, Times Square isn't actually a square, at least not as I'm used to that word. Broadway and 7th avenue happen to cross at a, for Manhattan, uncharacteristically sharp angle, which results in more space between buildings than usual. But it's still fairly small as a "square". They've fenced off a part of that space and put a bunch of chairs and tables there. This would be a cosy and inviting, "gezellig" place, if not for the very audible noise of the traffic still going on all around it, and the fact that everywhere you see, there's three layers of brustling and visually noisy adverts. It could have been a relaxing oasis in the middle of the city, but instead it's just as busy as everywhere else in Manhattan. But then, I guess that's what New York City is all about. At any rate, after spending about half an hour or so there, I walked over to the subway to get back to the venue just in time for dinner. The end of a nice, touristy, day.

After I finished an re-read my epic post describing my first day and a half at Debconf10 I suddenly realised that if I continue to describe the rest of 13 days here in such style and verbosity this would become a book, a boring one at that, so I decided to limit myself to 2 posts for Debcamp and then a post a day for the Debconf. But about the first half of the Debcamp week there are things that are as usual and there are things that are not. Let s start with the usual bits: more people arriving every day, evening parties are getting more and more fun and wild (or so people say) and the Internet and power at the hacklabs magically becomes more and more reliable day by day, the cabling mess grows organically trying to spread out evenly and not overload any individual socket, extension cords with non-local plugs appear and spread the load some more, people stress out, volunteer, crash out and repeat. All in all nothing can stop the freight train of few hundred Debian developers determined to have fun. With out own DFSG-free definition of fun. (But this year we appear to be running very close to the edge on volunteers if we run out of those, there will be a train-wreck, so please volunteer!) Now off to the unusual stuff. The City is well it is cool and very, very impressive. It is not terribly different to me at least I am used to such structure of the city: grid based layout of the downtown city (with some parks) and then branching out to separate, but different across-the-river districts and then sprawling out to slightly chaotic suburbs. Riga is very much like New York in the design. The difference is that New York is 10-20 times larger: the areas are 10 times larger, the buildings are 3-4 times higher on average, the streets are 2-3 times wider and yet have more traffic and there are far, far more shops, shows and restaurants. Also there is the subway. It is a great thing in that it hides the size of the city take a bus downtown once, to find out what I mean it takes ages to drive the distance that takes 20 minutes on the subway. I like this city, I am getting a feeling, that I could live here without much problem for me. So far I ve only had this feeling in Riga and Berlin. On the other hand this is USA. I ve so far only encountered one bad thing about it, but it is a pretty big one food. Basically all food that I ve tried so far in the USA has been crap. It was tasty salt, sugars and fat took care on my brain thinking it s food, but underneath that it was pretty crap: there was no texture, no content, no soul. The John Jay cafeteria where we are eating lunch and dinner is better than the most other options, because it is an all-you-can-eat buffet where you can choose your poison and it was also the place where I had the best piece of food in USA so far a slice of pepperoni pizza, that had a bit of taste behind the fat. Also, surprisingly, the fast food options (McDonalds, Burger King, ) are better than the equivalents in Europe, far better. In fact the fast food is cheap and in some cases tastes better than regular food, so there is no wonder why people might prefer it in some situations. So it is easy to see how people just accept shoving bland fast food or bland all-you-can-eat food into their mouths and not think much about it and thus become fat and put undue stress on their health. I expect the average weight of Debian developers to increase by 5 kg by the end of the conference. If you want to prove me wrong, running with bubulle would help you a lot with that. Events downtown. New York is a huge city with a lot of events going on every day, so everyone should be able to find something of interest for them. For me it was the free tickets for tapeings of The Daily Show and The Colbert Report. I got into both of those and for me The Colbert Report was by far the better experience. For one you can not get into Daily Show without a ticket (some tickets show up on the web site on the morning of the shoot around 11am), while 18 people from the stand-by list at Colbert Report got in. At The Daily Show you stand in a live line with ticket holders in one line and stand-by line separate. If you have tickets and arrive around 3pm you should be fine any later than that and you risk to be standing outside even with a ticket. You find that out around 4.30pm when they hand out physical tickets you have one, you get in. If not you might rush over to Colbert Report where a more humane system is used a staffer takes down your name and email on a numbered list and then you can walk around until 5.30pm then they let the ticket holders in and after that call the names of stand-by people that get in. The Colbert Report studio is brighter, more colourful and closer to the action, also it is very rare that cameras block the view from the audience (which is common on The Daily Show). It might have also been my luck when I got on the most boring The Daily Show episode I can remember, ever. The best joke was a woman asking John is she could get a ticket for her friend in August. The warm-up act and crowd control at The Colbert Report was also way better: Colbert staff was hyper, security was ever-present, warm-up was funnier and very engaging (he grilled me for several minutes and I replied making the audience laugh very hard explaining that Latvia was like India of Eastern Europe in regards to IT exports) and Colbert himself was very gracious talking to us out-of-character before the show for a good 10 minutes. Location, location, location. The talk rooms and event rooms and hacklabs are spread out across multiple buildings and there is a lot of other activities going on in those buildings besides Debconf, so moving between place might be confusing for the first day or two. Also the rooms are quite dark that might cause a noise problem for me and the video team as we ll have to up the sensitivity settings on our gear. The video team is working on fixing that by throwing a bit more light on to the speakers. Elevators are wicked fast, but can also be confusing, because the ground floor is on a different number for different buildings it can be G, 1 or even 4. Usually on campus there is a star next to the level with the exit. The dorms. I am in the Carman building and it looks like its interior has not been updated since it was built large ceramic bricks with very visible gaps (for the interior walls), raise-to-open windows, huge aircon fans that take up the whole bottom of the window, plumbing from the 60ies (at least). The security is weird on one hand you have to give your room card to the guard when entering the building, but on the other hand the room cleaning crew can simply forget to close your door after they are done. Like this Thursday I returned to the dorm just before lunch only to find the door of my room open. No one was around and nothing was missing, but it s still worrying. In any case I am steadily uploading photos from Debconf 10 to my Flickr page and new stuff should show up every day.

Actually I was at the venue on Tuesday for a little while but my name wasn't in the system either because I has given my name in Unicode or, more likely, I had forgotten to check the "reconfirm" box on the registration form. For some reason Columbia U's DHCP server makes Minix lock up on boot. Also I left my laptops AC adapter at home. Some kind souls lent me their European adapters but they didn't work. (I have a set of international converters. Also unfortunately at home.) So after about three hours, my battery ran out and I had to leave. So we will pretend that never happened and instead call today day 1. (Wednesday I had some unexpected family stuff to attend to so that doesn't count either.) Today I first concentrated on tracking down why the boot process was hanging. The culprit seems to be nonamed a daemon Minix runs to do DNS resolution/caching etc. I'm consulting with the Minix devs to see what can be done about this. I added the cool MOTD banner you see above (made by Osmo). And I ported some more GNU software to match the versions in Squeeze. Tomorrow, the biggies gcc and perl, and seeing if I can get a dpkg binary that doesn't segfault.

On each last Friday of July the annual System Administrator Appreciation Day is taking place. Matt Simmons organized a SysAdmin Day Meetup to celebrate this event in New York. If you re in New York on 30th of July consider registering yourself (it s free and takes just a few seconds). If you are participant of the Debian Conference in New York and are already hacking at the DebCamp you might want to join our group of Debian people who plan to show up, currently consisting of Paul Wise, Lars Wirzenius, Thomas Lange and myself. If you plan to join please ping me so we can show up at the SysAdmin Day Meetup together.

Here at DebConf10 the schedule is starting to get really packed of events, which is great! About a half of those events are BoFs (in the IETF sense), i.e. discussion sessions among people interested in specific topics. (Other conferences use "BoF" to refer to impromptu, non-scheduled, and spontaneous events, while at DebConf we have traditionally submitted, reviewed, and scheduled BoFs in advance.) As most DebConf regulars, I've attended quite some BoFs in the past and I share with others the impression that the quality and usefulness for the project of BoFs varies substantially from BoF to BoF. That's why I'd like to share a BoF recipe, which comes from possibly the best organized BoF I've ever attended. As it happens with all good recipes (and with free software), I've took the liberty of customizing it a bit.

---

DebConf BoF HOWTO have a coordinator A good BoF should have a coordinator, which is usually (but not necessarily) the person who proposed the BoF in the first place. The role of the coordinator encompasses at least 2 tasks: preparing the BoF in advance (read below) and moderating the discussion to ensure everybody get a chance to participate. prepare in advance A good BoF is more than just getting together, vaguely knowing the BoF topic, and ... discuss. Mind you, it might work very well that way too, but the chances of having a successful BoF are much higher if attendees arrive prepared. That is quite simple to achieve. It just takes the BoF coordinator to prepare some working questions and/or detailed discussion topics, and advertise them as such. That way potential participants can make up their minds, recall experiences that they want to share, note down comments they want to bring into the discussion, etc. In my experience, the BoF time will then be used in a much more productive, exciting, and ultimately fun way. Most BoFs can also benefit from a few introductory slides on the BoF topic, to ensure all participants start from a common ground. The last slide could contain a brief recap of the working questions, so that the audience have them handy. don't be exclusive Debian is not a company and Debian contributors are not employees, therefore we cannot expect all relevant people to attend a specific BoF, just if they had to. As usual, the risk of cutting off community members who cannot attend should be mitigated as much as possible. To that end, minutes are just great; after the BoF, minutes should be posted where appropriate, and possibly uploaded to Penta as event attachments. ... but taking minutes is just boring and not everyone is good at that (for instance, yours truly used to suck at taking minutes, even if I'm trying to get better ...). If you have a trusted participant which is good at taking minutes, great, go for it! If you don't, use collaboration. During past DebConfs as well as at UDS this year, I've been shown a nice way of doing that. It takes a dedicated projector in the BoF room showing some real-time, collaborative editing facility (e.g. gobby). With such a setup, people usually just start taking minutes collaboratively, although explicitly inviting the audience to do that is a very good idea. Ideally, the room should have two projectors, one for supporting slides, another for collaborative minutes taking. In case there is only one, as it is usually the case for DebConf, it's probably better to use it for minutes and switch to them as soon as supporting slides are over.

---

gobby.debian.net for BoF minutes at DebConf10 For DebConf10, the DebConf team has setup a gobby (infinote) server at gobby.debian.net. Just do the following in order to be ready for collaborative minutes taking:

    # apt-get install gobby-0.5
    $ gobby-0.5 -c gobby.debian.net

(Note: you shouldn't use the non versioned gobby package as it uses a different protocol and doesn't support undo, which is quite risky; see Debian bug #590753 for more background.) As the naming convention for DebConf10 minutes, using document names that start with dc10- sounds sensible.

---

comments welcome! So, what do you think of the above suggestions? Do you have further best practices to share on BoF organization at DebConf? Leave a comment or mail me. In the end it would be nice to author a proper "DebConf BoF HOWTO" document for further reference. Thanks to Gregor for his feedback on early versions of this post.

A new paper of ours was just published. If you re curious about all that Semantic Web and Linked Data hype and how it would impact forges and other software development tools, and the link with Open Source development platforms, then, read this :

Weaving a Semantic Web Across OSS Repositories: Unleashing a New Potential for Academia and Practice
(DOI: 10.4018/jossp.2010040103)
Authors: Olivier Berger (Institut Telecom, France); Valentin Vlasceanu (Institut Telecom, France); Christian Bac (Institut Telecom, France); Quang Vu Dang (Institut Telecom, France); St phane Lauriere (Mandriva, France)
in International Journal of Open Source Software & Processes (IJOSSP) Volume: 2, Issue: 2 (2010), Pages: 29-40 pp.

Here s the abstract:

Several public repositories and archives of facts about libre software projects, maintained either by open source communities or by research communities, have been flourishing over the Web in recent years. These have enabled new analysis and support for new quality assurance tasks.
This paper presents some complementary existing tools, projects and models proposed both by OSS actors or research initiatives that are likely to lead to useful future developments in terms of study of the FLOSS phenomenon, and also to the very practitioners in the FLOSS development projects.
A goal of the research conducted within the HELIOS project is to address bugs traceability issues. In this regard, the authors investigate the potential of using Semantic Web technologies in navigating between many different bugtracker systems scattered all over the open source ecosystem.
By using Semantic Web techniques, it is possible to interconnect the databases containing data about open-source software projects development, which enables OSS partakers to identify resources, annotate them, and further interlink those using dedicated properties and collectively designing a distributed semantic graph.

Keywords : RDF, forge, archive, bug, semantic, semantic Web, ontology, database, repository of repositories,
interoperability, bugtracker, OSLC-CM, Debian. The journal is published as closed content on paid access, but you may ask us, should you need to read a draft version. This is an extended version of an earlier position paper presented at WOPDASD 2009. This work was conducted in the frame of the System@tic Paris-Region cluster (http://www.systematic-paris-region.org/), with funding of the Paris Region council.

I had planned long for this Debconf and with the experience from the previous times I did all I could to reach one goal minimise stress. I think I got it right this time. First of all I got my company (Accenture) pay for the whole thing, so I did not have to worry about sponsorship queue (but instead I must gather and deliver them back some knowledge gained from the conference should be easy). I also managed to get a direct flight there is a weekly flight Tashkent-Riga-New York on Sundays and I got a ticket for that both ways. This took many hours off the travel time and reduced the stress a ton. Then I also did all the prudent travelling things: mostly reading the New York page on Wikitravel. This told me (among other things) what metro line to take to get the best view of the city. And for luggage I took a backpack (for the laptop and walking around) and a roller (for the clothes). I learned a lot from the Up in the air movie, it really teaches one how to take stress out of travel. This went very well in the beginning I took a bus to the airport early, checked in, breezed trough security and then waited and waited. The boarding only started half an hour after we were scheduled to depart. But I can not complain, because the flight attendant called my name (among a few others) just before boarding and changed my ticket I was bumped up to business class . It has been many years since I ve flown a regular (non-budget) airline and now first time ever in the business class! We got regular class meals, but at least we got to sit in the big chairs with lots of leg room. It was great! I bought a paper book (from Charles Stross) to read during the flight, because that is the only thing you can do during take-off and landing and I had some stuff to listen to in my iPhone. I tried sleeping and I think I managed to kill a couple hours that way too. It sure helped combat jet lag later on. When I arrived, I had my immigration and customs forms filled out. Latvia is on the USA Visa Waiver program, so I just had to fill out a form online prior to the trip to get a permission to enter USA. I only had one printout of the Waiver confirmation page and my airline took that before giving me a boarding pass, so I had no paper copy to give to the guy at the USA border, but he did not even ask for it he only took the two forms I filled out, scanned my passport, took my fingerprints (all fingers) and a photo. Then he gave me back the customs for (stamped) and I could go get my luggage. After that it was just a matter of walking trough customs and giving the customs official the pre-filled and stamped customs form. I was not stopped further. The AirTrain was a bit confusing you just get on the AirTrain and go where you need to go, you actually pay at the place where AirTrain connects to metro, so when you are coming from the airport you are actually paying ($5) when you are exiting the AirTrain system. There are plenty of AirTrain people that will give you an AirTrain ticked for $5 cash right there or you can use a machine to get it (where you can also pay with a card). The machines also take AmEx, but you must know the PIN code, if your don t know the PIN of you AmEx card (like I don t know the PIN of my corporate AmEx) you can only buy MetroCards at news stands, but there you will not find the unlimited ride tickets only 5 or 10 ride tickets are available. Next I screwed up a bit and thus got a bit lost in the New York metro system. The Wikitravel recommends to take the AirTrain to Jamaica station and from there take J or Z line into the city for the best views. I went to Jamaica and got into the first metro train that came on to the platform. Unfortunately, that was the E line train and it does not cross with J or Z lines after that, so I was stuck. To complicate the situation E line is under repair, so after a few stops the trains diverted to the F line and I had to scramble to figure out where to get out to get to the 1 line where Columbia University is. I ended up spending more than an hour in the metro, but I got there in the end. So I emerge from the 116th street metro station directly in front of the campus entrance gate and it starts raining. A thunderstorm swept across New York as soon as I stepped outside the metro station, so I took shelter a the side of the building. It kept raining. After a few minutes decided that I don t want to wait any more, so I put all my electronics into my backpack and went towards the dorm where my room was. The rain was warm, people around me were playing and running around in the wet grass, it was fun. The guard showed me where to go to check in. It was really simple sign here, here is you magnetic stripe key, have fun. And the room was just as spartan bed, desk, chair, closet, bathroom and a large fan under the window. The first night I did not know that I could actually turn that fan down, so I slept to the sound of full fan blasting, much like on the airplane. The dorm looks ancient it looks like it was build in the 60s and never changed since then. I mean, I ve lived in worse places, but people would at least change wall sockets or faucets or ceiling paint every other decade or so. The newest things here were the magnetic locks on the doors and a TV and a mini fridge in the hallway. After dropping my things I went off to the Mudd building across the campus to check in with people in the hacklab. It was just starting to take shape, but many great and familiar people were already there. It was like walking into a family home same warm welcome smiles and that great feel of belonging to the group. After I quick chat I went off downtown. The plan was that I left my old Canon 400D camera back at home and that I would buy a new Canon 550D here in New York on arrival. Unfortunately I underestimated the travel time on subway and by the time I got back downtown most shops where already closed. I got to checking out a Best Buy and was told there that they don t have 550D in stock. Next morning I went for a full scale search B&H Photo Video store, J&R Express, another BestBuy none of them had the Canon 550D (aka T2i) in stock in a body-only configuration. BestBuy had a few sets with the kit lens, but I did not want paying 100$ extra for something I already have. The last option was Adorama and I got lucky I nabbed the last 550D they had and it was body-only. Now I was back, with a camera in my hands and the Debconf10 could really begin!

About two weeks ago I got a Wifly-City G2000, the world's most powerful 802.11bg wireless network card. It features 2000mW which is 10 times more than the legally allowed limit of 200mW in Switzerland (or 2 times more than the allowed 1000mW in the USA, 5 times more than the allowed 400mW in Brazil, or 20 times more than the allowed 100mW in the EU). Contents The adapter is sold as a set named Wifly-City AVATAR-4PA with some accessories. click on the images for full resolution The box prominelty lists Linux compatibility and contains the following part:

• 1x Wireless Network Adapter with standard USB Type Mini-B
  (blue top face, black rear side)
• 1x 7dbi omnidirectional Antenna (black; SMA)
• 1x 10db directional Antenna (black; SMA)
• 1x 1m USB Cable (black; one Type A to Type Mini-B)
• 1x 5m USB Y Cable¹ (transparent; two Type A in Y to Type Mini-B)
• 1x Suction Cup (black)
• 1x 8cm Mini-CD with drivers and a manual

The adapter has a Realtek 8187L chipset. This is particulary nice since there is no firmware needed for this chipset (therefore no questinable binary-only firmware blob). Also, it works out of the box with any Linux as of kernel version 2.6.30 and newer. I tested it on lenny with kernel backports, vanilla squeeze and vanilla sid. In all of these setups, it works out of the box without any configuration whatsoever - just plug it in and it works. I know that this is how it is supposed to be but still, I am always surprised again when things just work. For those who care, this is the output of dmesg when plugging in the card...

[...]
usb 1-1: new high speed USB device using ehci_hcd and address 6
usb 1-1: New USB device found, idVendor=0bda, idProduct=8187
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: RTL8187_Wireless_LAN_Adapter
usb 1-1: Manufacturer: Manufacturer_Realtek_RTL8187_
usb 1-1: SerialNumber: xxxxxxxxxxxx
usb 1-1: configuration #1 chosen from 1 choice
phy1: Selected rate control algorithm 'minstrel'
phy1: hwaddr xx:xx:xx:xx:xx:xx, RTL8187vB (default) V1 + rtl8225z2, rfkill mask 2
rtl8187: Customer ID is 0xFF
Registered led device: rtl8187-phy1::tx
Registered led device: rtl8187-phy1::rx
rtl8187: wireless switch is on
usbcore: registered new interface driver rtl8187
ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: direct probe to AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: direct probe responded
wlan1: authenticate with AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: authenticated
wlan1: associate with AP xx:xx:xx:xx:xx:xx (try 1)
wlan1: RX AssocResp from xx:xx:xx:xx:xx:xx (capab=0x411 status=0 aid=5)
wlan1: associated
ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
wlan1: no IPv6 routers present
[...]

...and this is the output of lsusb:

Bus 001 Device 006: ID 0bda:8187 Realtek Semiconductor Corp. RTL8187 Wireless Adapter

Special Offer I have played with the card for some time now and am really pleased with it. It works nicely with all the standard tools (aircrack-ng, kismet, etc.). The only bummer is that the card is quite expensive. Fortunately, we could arrange a good deal for Free Software people where the store selling it does not make any money on it: instead of 89 USD you can get it for 68 USD (including everything). If you are interested in getting one and you are comming to DebConf 10 in New York between 2010-07-25 and 2010-08-08, you can write an email to Ralph Amissah or speak to Ralph personally during the event. ¹ I have no idea why they are shipping with a Y cable because the adapter does not need one. However, it does not disturb and in case I ever need an Y cable, I now have one :)

Sometimes I write things that are for myself, and later decide to release on the off-chance other people might be interested. I've hated procmail for a long time, but it is extremely flexible, and for the longest time I figured since I'd got things working the way I wanted there was little point changing. When it comes to procmail there are few alternatives:

• Exim filters.
• Maildrop.
• Email::Filter

Unfortunately both Exim and Email::Filter suffer from a lack of "pipe" support. To be more specific Exim filters and Email::Filter allow you to pipe an incoming message to an external program - but they regard that as the end of the delivery process. So, for example, you cannot receive a message (on STDIN), pipe it through crm114, then process that updated message. (i.e. The output of crm114). Maildrop does allow pipes, but suffers from other problems which makes me "not like it". My own approach is to have a simple mail-sieve command which is configured thusly:

set maildir=/home/steve/Maildir
set logfile=/home/.trash.d/mail-sieve.log
#
#  Null-senders
#
Return-Path: /<>/        save .Automated.bounces/
#
#  Spam filter
#
filter /usr/bin/crm -u /home/steve/.crm /usr/share/crm114/mailreaver.crm
#
#  Spam?
#
X-CRM114-Status: /SPAM/   save .CRM.Spam/
X-CRM114-Status: /Unsure/ save .CRM.Unsure/
#
#  People / Lists
#
From: /foo@example.com/  save .people.foo/
From: /bar@example.com/  save .people.bar/
..
..
#
#  Domains
#
To: /steve.org.uk$/               save .steve.org.uk/
To: /debian-administration.org$/  save .debian-administration.org.personal/
#
#  All done.
#
save .inbox.unfiled/

On the one hand this is simple, readable, and complete enough for myself. On the other hand if I were going to make it releasable I think I'd probably want to add both conditionals and the ability to match upon multiple header values. Getting there would probably involve something like this on the ~/.mail-filter side :

if ( ( From: /foo@example.com )  
     ( From: /bar@example.com ) )
 
   save .people.example.com/
   exit
 
# ps. remind me how much I hate parsers and lexers?

That starts to look very much like Exim's filter language, at which point I think "why should I bother". Pragmatically the simplest solution would be to add a "Filter" primitive to Email::Filter - and pretend I understood the nasty "Exit" settings. ObQuote: Andre, we don't use profanity or double negatives here at True Directions. - "But I'm a Cheerleader".

a short description of my experiences on entering the U.S. disclaimer: austrian passport, VWP, EWR airport, yesterday evening.

immigration I spent roughly two minutes at the immigration counter. the dialog with the polite, tired, & probably bored guy was like:

he: what are you doing in the US?
me: going to a computer conference at columbia university.
he: how long are you staying?
me: until the 14^th of august.
/he looks at passport
he: you are here for the first time?
me: yup.
he: (instructions for fingerprint scanning & photo)
he: do you work at home? what are you doing there?
/me explains
/he probably doesn't really listen
/he stamps passport

customs I had ticked "I bring food" on the customs declaration form, & entered "cheese, 0.5 kg, $9" in the "goods to declare" box. the guy handling the queue sent all people without any "yes" ticks straight to the exit, & me to the counter. dialog with the friendly lady:

she: what food are you bringing?
me: two small pieces of cheese.
she: anything else? meat? fruits?
me: no.
she: ok, put your bags here. (belt for the luggage scanner)

that was all, no more questions, no inspections, or whatever. & noone actually looked at the customs declaration form except for the one "yes".

The web offers a compelling platform for developing modern applications. How can free software benefit more from web technology, and at the same time promote more software freedom on the web? What would the world be like if FLOSS web applications were as plentiful and successful as traditional FLOSS applications are today? Web architecture The web, as a collection of interlinked hypertext documents available on the Internet, has been well established for over a decade. However, the web as an application architecture is only just hitting its stride. With modern tools and frameworks, it s relatively straightforward to build rich applications with browser-oriented frontends and HTTP-accessible backends. This architecture has its limitations, of course: browser compatibility nightmares, limited offline capabilities, network latency, performance challenges, server-side scalability, complicated multimedia story, and so on. Most of these are slowly but surely being addressed or ameliorated as web technology improves. However, for a large class of applications, these limitations are easily outweighed by the advantages: cross-platform support, instantaneous upgrades, global availability, etc. The web enables developers to reach the largest audience of users with the most compelling functionality, and simplifies users lives by giving them immediate access to their digital lives from anywhere. Some web advocates would go so far as to say that if an application can be built for the web, it should be built for the web because it will be more successful. It s no surprise that new web applications are being developed at a staggering rate, and I expect this trend to continue. So what? This trend represents a significant threat, and a corresponding opportunity, to free software. Relatively few web applications are free software, and relatively few free software applications are built for the web. Therefore, the momentum which is leading developers and users to the web is also leading them (further) away from free software. Traditionally, pragmatists have adopted free software applications because they offered immediate gratification: it s much faster and easier to install a free software application than to buy a proprietary one. The SaaS model of web applications offers the same (and better) immediacy, so free software has lost some of its appeal among pragmatists, who instead turn to proprietary web applications. Why install and run a heavyweight client application when you can just click a link? Many web applications perhaps even a majority are built using free software, but are not themselves free. A new generation of developers share an appreciation for free software tools and frameworks, but see little value in sharing their own software. To these developers, free software is something you use, not something you make. Free software cannot afford to ignore the web. Instead, we should embrace the web more completely, more powerfully, and more effectively than proprietary systems do. What would that look like? In my view, a FLOSS client platform which fully embraced the web would:

• treat web applications as first-class citizens. The web would not be just another application, represented by a browser, but more like a native application runtime. Web applications could feel much more native while still preserving the advantages of a web-style user experience. There would be no web browser: that s a tool for legacy systems to run web applications within a compatibility environment.
• provide a seamless experience for developers to build web applications. It would be as fast and easy to develop a trivial client/server web application as it is to write Hello, world! in PyGTK using Quickly. For bonus points, it would be easy to develop and run web applications locally, and then deploy directly to a PaaS or IaaS cloud.
• empower the user to manage their applications and data regardless of where they are hosted. Traditional operating systems act as a connecting fabric for local applications, providing a shared namespace, file store and IPC mechanisms, but web applications are lacking this. The web s security model requires that applications are thoroughly sandboxed from each other, but a mediating operating system could connect them in meaningful ways, just as web browsers store cookies and passwords for various websites while protecting them from each other.

Imagine a world where free web applications are as plentiful and malleable as free native applications are today. Developers would be able to branch, test and submit patches to them. What about Chrome OS? Chrome OS is a step in the right direction, but doesn t yet realize this vision. It s a traditional operating system which is stripped down and focused on running one application (a web browser) very, very well. In some ways, it elevates web applications to first-class status, though its paradigm is still fundamentally that of a web browser. It is not designed for development, but for consuming the web. Developers who want to create and deploy web applications must use a more traditional operating system to do so. It does not put the end user in control. On the contrary, the user is almost entirely dependent on SaaS applications for all of their needs. Although it is constructed using free software, it does not seem to deliver the principles or benefits of software freedom to the web itself. How? Just as free software was bootstrapped on proprietary UNIX, the present-day web is fertile ground for the development of free web applications. The web is based on open standards. There are already excellent web development tools, web application frameworks and server software which are FLOSS. Leading-edge web browsers like Firefox and Chrome/Chromium, where much web innovation is happening today, are already open source. This is a huge head start toward a free web. I think what s missing is a client platform which catalyzes the development and use of FLOSS web applications.

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd