Recently I read an amazing review of patient advocacy and health (counter)movements by Steven Epstein from the STS program at UCSD. It is still a draft but bound to be published in the New Handbook of Science and Technology Studies and when it is, anyone who works in this area will gain so much from reading the review. It was stunningly broad yet highly specific. He is able to synthesize an enormous literature on patient advocacy, a field that has seen a blizzard of activity, especially in the last twenty years. Along with providing points of entry and departure into the field, he also examines who the burgeoning interest in the field of STS. What I found interesting is that there is very little work being done on a topic I happen to know a lot about, lyme disease and whose politics I have been following since at least 1999. I am not sure why the lacuna but it is an odd disease dripping and screaming with controversy and seems to stand apart from many illnesses, in part because of its odd dual existence. On the one hand, it is an illness that the medical establishment totally recognize as real (and thus in some respects is unlike the class of syndromes from MCS to chronic fatigue, which another STS researcher, Joe Dumit provocatively describes as illnesses you have to fight to get ). But that is only half the picture because mainstream medicine tends think that lyme is not only easy to diagnose but also to treat, so much so that if a person thinks they have lyme (even after a round of antibiotics or lacking diagnostic markers), the are either seen as suffering from something else (and usually then told they have one of those highly contested syndromes), or more often just crazy. So it exists dually: at once recognized but only narrowly, so that in another form, that of chronicty, lyme cannot exist. It is this dual quality of lyme that defines and shapes its politics and just recently, new developments have fueled the controversy. Namely it follows from the Infectious Diseases Society of America new guidelines for the diagnosis and treatment of lyme, published last month. In a nutshell, they basically re-reduce lyme to a very easily diagnosable and treatable illness, calling for even more strict guidelines for its diagnosis than now exist. They sanction a small range of blood tests and thus totally nullify the role for clinical diagnosis, which even the CDC had acknowledged as vital in times past. Unsurprisingly this has thrown the chronic lyme community in a total tizzy and they have not taken this sitting down. A petition has been launched and protests have been planned. And amid the controversy, politicians have already heard the call to arms. In the state where lyme is a famous entity for it was first discovered there, Connecticut, its Attorney General is calling for an anti-trust investigation into the Infectious Diseases Society of America, in essence for using their clout and prestige to legitimate a gold standard in diagnosis and treatment, when it seems far from obvious that this should be the standard. According to the LDA press release:

The national non-profit Lyme Disease Association (LDA), representing more Lyme disease patients than any organization in the United States, applauds Connecticut State Attorney General Richard Blumenthal for beginning an investigation into the Infectious Diseases Society of America (IDSA) Lyme disease guidelines development process. In an unprecedented move, the Attorney General’s office filed a Civil Investigative Demand (CID) to look into possible anti-trust violations by the IDSA in connection with exclusionary conduct and monopolization in the development of the Lyme guidelines

What I find so interesting is that this latest chapter in the grungy and torrid politics of lyme encapsulates the very nature of the politics of lyme, which really is about the agency of bacteria and in the Latourian sense. If Pasteur had to put a lot of effort into making credible the bacteriological model of disease as Brunto Latour covers in The Pasteurization of France and if there was plenty of future prostelyzing needed to bring credibility to the bacteria to more general publics, as Nancy Tomes illustrates in The Gospel of Germs, well now, I think we are in an era where we think we have such intimacy with the biological ins and outs of bacteria, it is almost impossible for the scientific community to imagine bacteria as such complex organisms that they can be in fact very difficult to diagnose, eradicate and treat. It is just no longer part of the basic conceptual universe of most doctors and medical researchers to think of bacteria in this way. The LDA press release acknowledges this very fact in the following way:

The October 2006 guidelines do not acknowledge that a complex bacterium such as the Lyme disease spirochete could possibly survive in the body and the brain, evading the immune system and short-term courses of antibiotics.

For many lyme researchers and doctors, since lyme is a bacteria and we know how to treat those pesky critters, it is frivolous to even imagine or contemplate otherwise. I would call this a hubris that arises not from the arrogance of doctors and the medical establishment but following the heels of success that medicine has indeed had with conquering the bacteria with antibiotics. Even new forms of poweful and highly resistanant TB are still treatable with a potent cocktail. That is, at a cultural level, I understand the blinders. At a political level, however, because people are suffering and because it is plausible that lyme can exist chronically, it is imperative to unseat this cultural comfort borne from past success to get the ball of research rolling anew. I think bacteria (and parasites for that matter as a recent smattering of articles demonstrate) are a lot more savvy creatures that should be treated as novel, wondorous creatures, once again. I would dare say the medical establishment, by refocusing energies on that which they think they have solved, would find themselves quite surprised. updateHere is an article discussing the issues.

I wrote a Perl module a couple of years ago, and got used to it, I just cannot code without that module now. It’s called Logger::Syslog and is a wrapper over Sys::Syslog that lets you deal with syslog in a very simple manner. Use the module and enjoy the easiness of calling info(), warning(), error() or whichever Syslog message level you like, there is a function wrapping it. It also works properly under a mod_perl environment an logs your message with additional information coming from the Perl stack (module, function name, line number, …). I use that module quite everywhere I use Perl : at work but also in my Free Software projects, like Backup Manager. It’s really time to release an “official” version that I can rely on in the future. Next step is submitting the module to the CPAN (it’s pending) and then, debianize it so backup-manager can depend on it. Todo: set up a public SVN repo to handle the sources. Updates

• Logger::Syslog is now available on CPAN.

Last night I called Ubunteros nearby Manila for the Edgy Eft (belated) release party at the Coffee Bean and Tea Leaf at Greenbelt 3. Little did I know that there will be a lot of folks coming from the just-concluded FOSS@work workshop joining in the fun, thanks to Yolynne Medina and Eric Pareja. Diane Gonzales and I got to the venue first, then followed by the FOSS@Work folks. Dominique Cimafranca, Migs Paraz, Ranulf Goss, Jopes Gallardo, and Joel Bryan Juliano were there too, and all in all we were easily the noisiest group in the coffee shop, seemingly occupying the entirety of the place. I originally planned to move the group to have dinner somewhere, but along the way everybody seemed to forgot dinner and we quite engaged in talking to everyone else. It was terrific. The 2 boxes of Edgy ,K,Ed Ubuntu CDs I brought were easily given away to everyone; we even had them exchanged and autographed (naks!) reminiscent of what Ealden and I did last February when Mark came here. As a finale, we had a group photo of everyone with their CDs; Dominique remarks that in his informal’ study, more and more women prefer Ubuntu (and I sure do think he’ll be blogging more about this soon. Needless to say, the above photo doesn’t do great justice to what happened last night; it came from my elric which I didn’t get use much as a camera since I too was happily chatting away. That said, I expect RJ Ian will be posting his photos from his brand-spanking-new Kodak camera to the Ubuntu-PH site once he gets back to Mindanao with Yolynne and company. I also think the FOSS@Work folks also have their own photosite or wiki to post more photos, which we’ll be seeing sooner. Jerome Gotangco and Ealden Esca an, the guys whom we all owe Ubuntu-PH to, were unfortunately unable to attend last night, as Jerome was off to Cebu to participate in the ICT congress there, while Ealden was quite busy at work. Hopefully they (as well as last night’s attendees!) can attend the next Release Party for 7.04 (aka Feisty Fawn,) and hopefully it will be just as fun, and be more meaningful if more Ubuntu-PH folks get involved in its development! Update: Yolynne and RJ just posted pics fresh from their arrival to home. Expect more pics later, nicely tagged too…

As announced yesterday, Google has sponsored some work on the LinuxBIOS project, a Free Software (GPL) BIOS/firmware implementation for various architectures (x86, PowerPC, Alpha, and others). LinuxBIOS currently supports more than 100 different mainboards from various vendors. A list of supported chipsets, CPUs, and Super I/O chips is also available, so you can easily estimate how hard it will be to add support for a new mainboard. Most of the mainboards currently supported are high-end server-type mainboards (e.g. from Tyan) and embedded boards. There are not too many cheap, mainstream motherboards supported, yet, but that is about to change soonish. I've been contributing for a while now to the LinuxBIOS project in various areas (e.g. adding support for a bunch of Super I/O chips, which are required if you want to get LinuxBIOS debug output over the serial port). But one of my personal main goals for the project is to support a reasonably high number of cheap, standard desktop mainboards, and I'll concentrate my efforts in this area in the future. Any help from further developers with experience in the hardware, embedded, or low-level firmware area is very appreciated! If you're interested, checkout the website and say hi on the mailling list. But I digress. The Google funding was used to create an automated, distributed test infrastructure, which will help...

...to significantly improve the project's Quality Assurance process by creating a completely automated and distributed testing environment. Every single commit results in BIOS images being built for all mainboards, and tested on real hardware located all over the world. So whenever you want to download a LinuxBIOS image, you can now know that it works on a reference machine before flashing it to your system. A per-revision overview is available, as are test results for specific revisions, and you can even get detailed reports that include extensive logs for each motherboard. Developers can also use the build and test system without checking their code into the LinuxBIOS repository. The automatic build client has an option to submit BIOS images to the test system manually; you can see an overview of manually triggered builds. Anyone with a spare board supported by LinuxBIOS is welcome to put it into the automated test system, thus helping the LinuxBIOS project increase their quality on your hardware.

This is a great thing, and something which not many projects out there can claim to have. Automated test-suites in the software development "scene" are used seldomly enough (which is bad), but in the low-level hardware/embedded area you're usually stuck... (See also Golem and Heise if you speak German) Update 2006-11-15: Ok, the site is slashdotted right now. Maybe you can try archive.org or the Google cache...

Unofficial APT repositories are a PITA in the Ubuntu community. Most users use stable release (see previous post about that) since Ubuntu development releases tend to be much more bleeding edge than Debian unstable. But users still want the newest software, so they use unofficial repositories. There are lots of posts about private repositories on Planet.ubuntu-fr.org, and it seems to be the same on other local planets. Recently, somebody posted a sources.list file with a huge list of unofficial repositories. The maintainer of one of these repositories, J han Kiviniemi, was surprised to be in this list without even being contacted first. He chose a good answer: he uploaded a package with cool new default wallpapers. He also wrote a detailed explanation, with which I couldn’t agree more. But this story raises a question: why do all these people work on their unofficial repositories, instead of filing and fixing bugs, improving the official packages, and getting their packages into Ubuntu ? It’s a shame that so much manpower is lost on such stuff. PS: Johan Kiviniemi seems to have a lot of good opinions.

My third and final article on the Web 2.0 conference came out today in LinuxWorld: Web 2.0 Summit: Open Source software borrows back from the open API Web. I tried to insist that they use the French Revolutionary Calendar for the byline but LW flatly refused. Go figure. The article turned out well, except that Chad Dickerson's name somehow ended up as "Brad Dickerson". D'oh. But I think overall it was pretty good series, and I concentrated on the stuff that I thought was fantastico. Which turned out to be the fun way to do it. I'm not sure whether it's best to take a breather right now and not worry about more conferences until March with SxSWi 2007, or if I should be finding other things to do. Really, I kinda have a lot of work to catch up on, some interesting projects to get started, and all kinds of stuff just goin' on. tags: web 2.0 web2con linuxworld open source chad dickerson sxsw

MTL I had beers at La ka this evening with Michael Lenczner of le sans Fil (our local, insanely good community wireless system in Montreal) and Civic Access and just generally an all-around good guy. We met... last year, maybe?... at one of Seb Paquet's Friends of Seb lunches. Man, Seb knows everybody. Anyways, a fun time was had. La ka is always a nice place to spend a few hours, especially with a Griffon Rousse in hand. Or so. We chatted about alternative office systems (my new obsession since Patrick Tanguay's presentation at BarCampMontreal), 802.11n (the new multi-antenna standard for wireless), and HAL, the incredible new system SF has for distributing locally-made art and culture on the local network of their hotspots. A great idea, and I hope it goes far... I want to use it in New York, Durban, KL and Perth. I think if I get around to talking to Boris sometime in the next week I'll have completed my post-barcamp trifecta. tags: michael lenczner la ka seb paquet griffon rousse hal ile sans fil

Smashing success! Sounds like The Kokoromi Collective had a Smashing success at their event the other night. A little bummed that we couldn't make it, but glad it turned out so well. tags: kokoromi gamma montreal

According to Aurelien Jarno, it's possible to run Debian/ARM and both Debian/MIPS platforms inside an emulator that itself is packaged and runs on Debian. Since fairly recently (about a month or two, I guess), the same is true for Debian/m68k. Granted, the emulator you need to install isn't called "qemu", but with ARAnyM (short for 'Atari Running on Any Machine') it is now possible to run Debian/m68k. And it's fairly easy to do, too:

• Download the installer images for Debian/m68k
• Install the aranym package
• Run aranym once. This will create a directory .aranym with a default config file.
• create a file to be used as a disk image: dd if=/dev/zero of=./disk.img bs=1k seek=2M count=1.
• Edit the configuration file. The important bits are the section [IDE0] and [LILO]. It's pretty self-explanatory.
• Run aranym-mmu -N -l.

There, you have a free m68k development machine! Note, however, that there might be issues with the network interface; the NIC in the emulated machine is unlike any real, actual Atari hardware. There is a driver for Linux, but I'm not 100% sure whether it's been integrated in the Debian kernels yet. I'm sure Christian will kick me awake on this, though ;-)

In addition to the ARM platform, it is now possible to emulate a MIPS (big endian) or MIPSEL (little endian) machine running Debian under QEMU. It could be used as a cheap MIPS/MIPSEL development machine to test your packages, provided that you have a not to slow i386, AMD64 or PowerPC computer. Running on an Athlon 64 X2 3800+ the emulated system is around 10% faster than my SGI Indy R4400SC 200MHz and possibly with much more RAM (my emulated system has 512 MB of RAM). Also for the ones who know about the Indy SCSI controller, the transfer rate is around 13 MB/s on the emulated system. I have written a small howto explaining how to install Debian Etch on such an emulated MIPS or MIPSEL machine, using Debian-Installer RC1, which has just been released. Thanks to Daniel Jacobowitz who has recently improved QEMU/MIPS a lot, and to Thiemo Seufer who has started the integration of the MIPS QEMU platform in Debian-Installer and in the Debian kernel. Note 1: I have written this howto very quickly, so there are probably some mistakes. Comments are welcome.
Note 2: I have updated the ARM howto to take in account improvements from Debian-Installer RC1

For my diploma thesis, I'll be extending a tomcat-based wiki. So I decided to setup a development framework for Tomcat, JSF and all these. What a mess. The installation docs are really really bad etc. Two hours later, a dozen Eclipse restarts, I might finally have the Eclipse.org Web Tools Platform on my computer. I don't know yet, since I didn't even write a single line of code or metadata yet. I think I've picked my preferred mirror about 20 times by now. I wish I could just use apt-get. Debian is so nice for installing software... I wish eclipse were a pure opensource project, and there weren't so many companies trying to sell extensions to it. Oh, and I wish it were a native Linux/Unix project, and wouldn't care about working around Windows userunfriendliness by offering an own installer and own update tool and own everything-that-windows-lacks. [Update: how to install eclipse extensions without going crazy:

mkdir -p ~/.eclipse/eclipse/plugins
mkdir -p ~/.eclipse/eclipse/features
touch ~/.eclipse/eclipse/.eclipseextension

Now start eclipse, go to Help, Software Updates, Manage Configuration and add ~/.eclipse/eclipse as a location to search at. Note that the folder must be called eclipse and have these two folders and marker file in it.]

In the past and for my hacker course, I have taught Paul Ceruzzi’s History of Modern Computing but the book was a little too dry to fly high with first year students but thanks to Joe Reagle’s excellent syllabus on the Impacts of Technology, I read a short but very sweet (and teachable) piece by him entitled An Unforseen Revolution: Computers and Epectations that not only gives a window into the early history of the computer but provides a very nice conceptual entry as to why it is hard for inventors of a new technology, such as the computer, to foresee and fully come to terms with its future uses, full range of capabilities, and utlimately its impact. Basically the context of invention combined with the training of inventors (which in this case, the first American digital computer, the ENIAC was invented by a physicst and an engineer for mathematical computing) stitches and thus initially limits the vision (and thus use) of the technology largely to its original purpose, while precedding technologies provide the conceptual juice drunk to understand the meaning of new technologlogies. So while today we clearly think of computers as a meta-machine, that can be whatever-machine-in-the-world-we-so-desire (so long as someone programs it to be that machine), in its time, with people so accustomed to machines as having one function, the cultural imagination was stuck. As Ceruzzie humorously conveys, a machine having such general capabilities seemed absurd, like a toaster that could sew buttons on a shirt. But the computer was just such a device; it could do many things its designers never anticipated. p. 126 With the passing of time came new innovations (Ceruzzi identifies new developments in programming as key in this regard) and use in new settings (notably businesses), the stitches were loosened and finally unraveled so that the computer came to take on the meaning it has acquired today. One perennial topic of inquiry in the field of STS concerns how particular contexts and other factors shape new meanings, visions, and uses, or just limit them, along with unearthing the labor that goes into making new inventions or scientific theories more generally accepted. This is a great little piece to teach incoming students about some of these concerns in STS, and without a lot of heavy-handed anything. And to make the project of teaching really fun, add this short clip from the Muppets, where Dr. Bunsen Honeydew totally ignores the Very Large Gorilla about to gobble him up because of his blind faith in technology.

We're back in Montreal again after more than two weeks in San Francisco. It was great being in the Bay Area, especially since this time of year in Montreal is kind of crappy. Cold rain knocks all the red-yellow-orange leaves off the trees and into the gutter, where they turn brown and gray. Everything's damp and muddy and icy, but there's no snow yet. Blech. Our friend John Usher stayed at our apartment while we were gone, which was great for us since he watched our cats. We had our regular Friday Night Pizza together last night at 9PM, after a very long day in the plane. Traveling eastward is hard on the sense of time. But pizza night made it a little better. We went up to Le Comptoir on rue Masson this morning for breakfast. It's a nice little place that you can always get into, regardless of the time of day (like, say, if you try going out for brunch at 11:30 on a Saturday...). The menu is a little too much in the Montreal Kitchen Sink style (10+ pages of every kind of food under the sun), but the b n dictines are good, they have mimosas, and they serve caf au lait in big bowls. So what's not to like? John rented a new apartment in Old Montreal while we were away. He's been a vagabond since early this summer when he left McGill and went back to his hometown of Beer in Devon. His new place is great -- 2000 ft top-floor loft around the corner from Basilisque Notre Dame. I plan to abuse his hospitality and throw big parties in his home, if I can get away with it. One nice thing is that he found the place on Montreal Craigslist. I think that's a pretty good sign that CL in MTL is becoming worth using, although they still don't have an interface in French. I don't know how you get away with an non-localized international Web site in 2006. tags: montreal john usher le comptoir old montreal craigslist i18n

Web 2.0 Summit Wrap-up LinuxWorld.com published my article on Day 1 of the Web 2.0 Conference, which I have to say I think is pretty OK good. I had originally written a gossipy article about who was where and who announced what and what it meant for Linux users and the Open Source community. Don Marti, who edited the article, didn't like it. He told me to identify the key technologies mentioned at the conference that people could actually use and should know about, and write more about them. So I did, and I think the article is much better for it. Days 2 and 3 of the conference coverage come out next week. I really liked writing about the Web 2.0 Summit; it gave me a chance to talk to people in-depth about their work. I didn't draw as much out of the conference itself as I would have liked, but by working press on it, I had to find stuff that interested me and communicate that interest. Which made it fun. tags: linuxworld.com web2con don marti web 2.0

Que Rico I'm pretty psyched that planning for next spring's Wikitravel Get-together 2007 is going so well. The Get-together (despite my finest effort, this seems to be the final name for the event) will be a convocation of Wikitravellers from all over the world on one spot to meet, talk about issues, but most of all, travel. Our chosen destination for this year's event is Puerto Rico (the product of a months-long selection process, with two rounds of voting). Our coverage of PR in English Wikitravel is sub-optimal, and we hope that by bringing a bunch of wiki people to the island for a week to hang out and explore, we can greatly improve the travel guide for this big area. Participants will be doing research before the event (April 14-22 2007) to determine those parts of the island that need better first-hand coverage. Then, we'll convene in San Juan (Puerto Rico) for a weekend before spreading out to cover the rest of the island. We'll meet back up in SJ the next weekend for some discussions and meetings before flying off to our respective homes. It should be a really fun trip -- I've never been to the Caribbean at all, and I think PR sounds like a really amazing place to visit. And I think this style of meetup for Wikitravellers could be super-fun for future events; it will be cool to see how this one goes. tags: wikitravel get-together puerto rico san juan

Poppies One endearing custom in Canada for Remembrance Day is wearing small, red poppies on one's lapel, evoking the classic Canadian poem ''In Flanders Fields''. It's a beautiful tradition, but hard to watch a bit on this day in 2006, when Canadian soldiers are being killed not in Ypres, but in Kandahar by, among others, heroin drug-lords, for whom poppies have other meanings. tags: poppies in flanders fields remembrance day canada afghanistan

I just left a bunch of debian IRC channels, and only stayed in the DebConf ones and some technical ones I'm really interested in. While I can sadly admit this is related to be being frustrated by the way Debian has evolved recently, it's only partly because of that.

IRC is quite a timesink (ironically thats the name of my media server at home...) and I need to focus a lot more on stuff that brings money, cause I neglected that too much since I (again) became a freelancer more than two years ago.

Last weekend I've tested d-i on powerpc and I have 6 bugs or so to file, but I could only find the time to file one bug so far. Luckily the others are less serious :) (And even more luckily for me I have done my taxes now, which was the reason I only did the tests but didn't report them immediatly.)

I also have three blog posts half prepared, but no time and/or energy to finish them. One is about my new development toy, an imac, which I use for testing d-i and debian-edu powerpc. This is nothing really special, but the nice thing, besides bringing debian-edu to more archs than i386 (please contact me if you are interested in amd64...) about it is my old friend FAI, which helps me^w^wtakes care that I have to do nothing to get the machine back into the state I want it after I erased the installation to test stuff.

The 2nd one I will actually post later today and about the third one, I don't know.

I hope this plan works out and I will also find some time in future to work on the things in Debian I enjoy and/or find important. But at the moment unfortunatly doing stuff I don't enjoy is more important, as it pays the bills... Luckily this is only partly true, two out of three of my money projects are actually (mostly) fun. Only one is a pain, but it's the biggest and the most urgent one.

/me waves, see you later :-)

With all the talk about binary drivers, and Ubuntu's recent decision to ship them by default, I was going to try and rant or philosophize about the various issues it raises, and how I think ripping Ubuntu a new one for this move is justified, but instead I'm going to talk about kitties and happy things.

On the XSF front, the coolest news has come from people other than me. In addition to providing compiz updates and improvements, Thierry Reding has been busy cleaning up the Debian mesa packaging in the XSF repo. Mesa's Debian maintainer hasn't been very active over the past few months, so Thierry has stepped in to help out there.

Julien Cristau, who helped in the early work moving from XFree86 to Xorg, has returned to the XSF to take over maintainance of xterm, which I've almost completely neglected. Both these packages needed more dedicated maintainance than I could provide, and it's great to see them both being beaten in to shape.

Drew Parsons has been as industrious as ever, packaging updates for drivers so we can ship Etch with driver support that is very close to what will be released upstream as 7.2. In addition, he's packaged the modesetting branch of the i810 driver. This is an experimental development branch that will become the mainline in the nearish future, and it basically allows the driver to set modelines that aren't specified by the BIOS, just like other drivers.

Christian Perrier continues to rock the translations.

I've been doing unglamorous work bringing the Xorg docs in to the late 90's, thus making sure that we ship with docs so that users can tell what's on their systems.

Finally, Thierry has put a ton of work in building infrastructure to move the XSF svn repo over to git. I've been evaluating this, and hopefully we can make the move soon so that we hit etch+1 development running. Using git will provide an easier means of pulling from and pushing to upstream. Hopefully, downstream derivatives will also use git as well to facilitate this. I'm really excited about all of this because it feels like we're active across the board.

And now for the kitties. Nicole and I have adopted a cat. We get to take her home from the shelter next Wednesday, so if some random characters start to appear from me on irc, it's probably her fault. Rest assured that when I never run for DPL, she will be a far better running mate than Zeke. As a favor I would like to ask you, all my loyal readers: if I start to talk about my cat constantly, like one would one's own child, please punch me in the kidney. Thank you.

Getting to the gym consistently is one of the biggest hurdles that I have stuck to jumping over while I'm trying to lose a bit more than a few. I seem to have no consistent schedule, except that I do end up doing it every day that I can. One downside of this is that I tend to work out late at night, almost always an hour or less before I go to bed. I've heard that this is not the best for the sleep, but I suspect it is actually better than nothing, so I continue to get to the gym at 11pm or 12pm. Unfortunately, I found myself with some extra roadblocks this week: the exercise room was half broken. The breakers on one half of the room tend to trip when the air conditioner and two machines that are on that circuit are all in use. This means that no one can use those machines until someone from the coop management goes and resets the switch. The treadmill machine, my weapon of choice for shedding a few pounds, is inconveniently on this circuit, and can't be plugged in anywhere else. This happened 3 times this week, Wed-Fri. I'm calling the office for the second time tomorrow.

It is significantly harder to exercise when I don't have the treadmill handy — the stepping machine works on semi-powered days, but it tires me out much too quickly and I cannot get enough exercise in. I'm not the kind of person to reliably run in place or do jumping jacks. My solution was to move the exercise bike to the powered side of the room. The biggest problem with semi-powered days is motivation. Usually I have the motivation to get to the exercise room and start the machine, and once I've started I can stop. Opening the door to a bunch of non-working machines is a huge motivation hit though. It's so much easier to take a roadblock like this and skip a day — in fact I did this week once. Luckily I discovered that the bike is on wheels on one side so it is easy to move to the other side of the room. However, I'd like to solicit suggestions for alternate exercises for semi-power days. The things that work in the room are a weight machine with a bunch of attachments, the stepping machine, and the exercise bike. I can't really go outside and exercise, because of the late hour and neighborhood that I live in, so it needs to be an inside task. The last requirement is that it focuses on losing weight, not gaining muscle. I'm fairly sure that I'll be gaining some muscle along this process, but the goal is to drop the weight.

I have taken Saturdays to be my day off, so that I can get a little rest and not be so stressed about things, but I'm not taking it this week as I need to "make up" for the skipped day.

This week (Nov 3 - Nov 9):
Minimum: 338.0 (-0.5) (Nov 7)
Maximum: 340.0 (-1.0) (Nov 4)
Average: 339.25 (-0.35) (139.25 to goal)
Exercise Calories: 2314 on 5 days
Average Calories per session: 462.8

One issue that is rarely considered is how to deal with office break-ins for the purpose of espionage. I believe that this issue has been solved reasonably well for military systems, but many of the military solutions do not apply well to civilian systems - particularly the use of scary dudes with guns. Also most office environments don't have the budget for any serious security, so we want to improve things a bit without extra cost. Finally the police aren't interested in crimes where an office is burgled for small amounts of cash and items of minor value, it gets lost in the noise of junky burglaries, so prevention is the only option.

Having heard more information about such break-ins than I can report, I'll note a few things that can be done to improve the situation - some of which I've implemented in production.

The most obvious threat model is theft of hard drives. The solution to this is to encrypt all data on the drives. The first level of this is to simply encrypt the partitions used for data, support for this is available in Fedora Core 6 and has been in Debian for some time. The more difficult feature is encrypting the root filesystem, encrypting root means that important system files such as /etc/shadow are encrypted. Also if the root filesystem is encrypted then an attacker can't trivially subvert the system by replacing binaries. An unencrypted root filesystem on a machine that is left turned off overnight (or for which an unexpected reboot won't be treated seriously) allows an attacker to remove the drive, replace important system files and then re-install it. If the machine is booted from removable media (EG USB key) which contains the kernel and the key for decrypting the root filesystem then such attacks are not possible. Debian/unstable supports an encrypted root filesystem, but last time I tried the installer there did not appear to be any good support for booting from USB (but given the flexibility of the installer I think it's within the range of the available configuration options). I have run Fedora systems with an encrypted root filesystem for a few years, but I had to do some gross hacks that were not of a quality that would be accepted. With the recent addition of support for encrypted filesystems in Fedora it seems likely that some such patches could be accepted - I would be happy to share my work with anyone who wants to do the extra work to make it acceptable for Fedora.

Once the data is encrypted on disk the next thing you want to do is to make the machines as secure as possible. This means keeping up to date with security patches even on internal networks. I think that a viable attack method is to install a small VIA based system in the switch cabinet (no-one looks for new equipment appearing without explanation) that sniffs an internal (and therefore trusted) network and proxies it to a public network. This isn't just an issue of securing applications, it also means avoiding insecure protocols such as NFS and AoE for data that is important for your secrecy or system integrity.

An option for using NFS is to encrypt it with IPSEC or similar technology. AoE can be encrypted with cryptsetup in the same way as you encrypt hard drive partitions, it doesn't use IP so IPSEC won't work but it is a regular block device so anything that encrypts block devices will work. I have been wondering about how well replay attacks might work on an encrypted AoE or iSCSI device.

Security technologies such as SE Linux are good to have as well. An attacker who knows that a server has encrypted hard drives might try cracking it instead. A thief who has stolen a laptop and knows that it has an encrypted drive can keep it running until future vulnerabilities are discovered in any daemons that accept data from the network (of course if you have enough technology you could sniff the necessary data from the system bus and from RAM while it's running - but most attackers won't have such resources). I have considered running a program on my laptop that would shut it down if for a period of 48 hours I didn't login or un-blank the screen, that would mean that if it was stolen then the thief would have 48 hours to try and crack it.

Prevent access to some hardware that you don't need. If you allow the system to load all USB drivers then maybe a bug in such a driver could be exploited to crack it. Remember that in a default configuration USB drivers will be loaded when a device is inserted (which is under control of an attacker) and the device will use data from the attacker's hardware (data of low integrity being accessed by code that has ultimate privilege). Turning off all USB access is an option that I have implemented in the past. I have not figured out a convenient way of disabling all USB modules other than the few that I need, I have considered writing a shell script to delete the unwanted modules that I can run after upgrading my kernel package.

Once these things have been done the next issue is securing hardware. Devices to monitor keyboard presses have been used to steal passwords. The only solution I can imagine for this is to use laptops on people's desks and then store them in a safe overnight, unfortunately laptops are still quite a bit more expensive than desktop machines and consequently they are mostly used as status symbols in offices. Please let me know if you have a better idea for solving the key-logging problem.

For servers there is also a problem with keyboard sniffing. Maybe storing the server's keyboard in a safe would be a good idea.

Security monitoring systems are a good idea, unfortunately they can be extremely expensive. There has already been at least one recorded case of a webcam being used to catch a burglar. I believe that this has a lot of potential. Get a webcam server setup with some USB hubs and cameras and you can monitor a small office from all angles. When the office is empty you can have it GPG encrypt pictures and send them off-site for review in the case of burglary. You could also brick the server into a wall (or make it extremely physically secure in other ways) so that the full photo record would be available in the case of damaged phone lines, and to give more pictures than the upload bandwidth of an ADSL link would allow (512Kb/s doesn't allow uploading many pictures - no-where near the capacity of a few high-resolution web-cams).

This is just a few random thoughts, some things I've done, some things I plan to do, and some that just sound like fun. I expect comments telling me that I have missed some things. I may end up writing a series of articles on this topic.

PS I've uploaded day 32 of the beard (which was taken yesterday). Last night at a LUV meeting I was asked to stand in front of the audience to show them my beard. I had imagined that they might have seen it enough through my blog, but apparently not.

Editing LaTeX, the Vim way Uwe presented latexmk as its way of previewing LaTeX output while editing in Vim. While I don't know latexmk myself, I'm using quite a lot LaTeX recently (my Ph.D. thesis is getting huuuge) and I'm co-maintaining vim-latexsuite in Debian. With vim-latexsuite what he wants can be achieved quite easily too. I keep on editing in Vim and can exploit the following shortcuts (where <Leader> is usually mapped to backslash):

1. <Leader>ll compile the current LaTeX source, the generated format depends on the value of g:Tex_DefaultTargetFormat (I use dvi, for a reason explained below);
2. <Leader>lv fire up a viewer for the compiled format, in my case this runs xdvi;
3. <Leader>ls move the DVI viewer to the point the cursor is currently at in Vim, highlighting (in xdvi) with a rectangle the current paragraph (believe me, this is amazing);
4. CTRL+Mouse Click (this in xdvi) do the opposite of (3), i.e. move Vim to the point in the LaTeX source file corresponding to where we clicked in xdvi.

I don't really understand why Uwe want to see working previews in PDF format, to me PDF is just the final output. DVI is much better (especially for (3) and (4) above, but also because it takes less time to be generated). Oh, and of course vim-latexsuite is able to do a lot more, like deciding whether LaTeX needs to be run again to fix dangling references, use the quickfix window to jump to compilation error, and so on ... End of the SPAM PS these are my latex-specific vim settings from my ~/.vim/after/ftplugin/tex.vim

setlocal tw=80
setlocal ts=8
setlocal sts=1
setlocal sw=1
setlocal iskeyword+=\\
setlocal makeprg=make
setlocal keywordprg=:help
"setlocal formatoptions+=a
setlocal spell
vmap ,b "zdi\textbf <C-R>z <ESC>
vmap ,e "zdi\emph <C-R>z <ESC>
vmap ,t "zdi\texttt <C-R>z <ESC>
  " Latex-Suite
let g:Tex_CompileRule_dvi = 'latex -interaction=nonstopmode -src-specials $*'
if v:servername != ""
 let g:Tex_ViewRule_dvi = 'xdvi -editor "vim --servername ' . v:servername . ' --remote +\%l \%f"'
endif

Having spent the better part of two days provisioning my new MacBook Pro’s OS X, Debian, and Windows XP instances, I am keenly aware of how much the Debian distribution’s package management system and its volume of packages have spoiled me. In that two days, the amount of time required to provision Debian was negligible, even though it is configured to completely match my Lifebook’s Debian Sid instance. In fact, the sum total of time to set up Debian, including every application I use, was about 45 minutes of my involvement. Those who know Debian (and Ubuntu, Linspire, Xandros, Mepis, or any other Debian derivative) are coolly nodding their heads, while others are probably thinking I am a lying, biased Linux zealot. It’s no lie; here are the steps I had to take:

• Run the Debian Installer business card image and perform a stock Sid installation, choosing Desktop and Standard System options in the task selection step. If you weren’t wanting to run Sid, the netinstall image would be fine as well.
• Generate a package list on the current Debian installation via # dpkg --get-selections > dpkg-selections.txt
• Copy the package list file to the new installation; I have copied it to my home directory in this example.
• Set the package selections for the new installation via # dpkg --set-selections ~/dpkg-selections.txt
• Run aptitude or synaptic and choose the install action, then go do something else. Thousands, literally thousands of software packages are being installed for you. Everything from your email client to your office suite to your software development tools are being pulled down from package mirrors. In my case, this was over 850MB of compressed package files.
• After the package download, answer any configuration questions aptitude (or synaptic) poses.
• Copy your /home directory contents to the new installation.

Compare that to what it takes with either Mac OS X or Windows XP to get all of your applications installed and configured. Even if you don’t know a thing about Linux or even the more technical side of those operating systems, you can tell from the brevity of that set of steps that the Debian setup is remarkably simple. Now, some will already be keying in their comment posts with exclamations of “Hey! There’s DarwinPorts/Fink/Cygwin!” Yeah, each of those is a nice start; however, they pale in comparison. Fink at least has the robust apt/dpkg foundation, but even it has a relatively meager package selection. I am sure I’ll be writing more on life with Fink and DarwinPorts in the near future. I still don’t have half the stuff installed on XP that I plan to use. I get tired just thinking about the installs. 8^)

Following Joey’s lead, here’s some DWN-style comments on some of the stuff I’ve been involved in or heard of over the past week… A future for m68k has been planned on the release list, after being officially dropped as a release architecture in September. The conclusion of the discussion seems to be that we’ll move the existing m68k binaries from etch into a new “testing-m68k” suite that will be primarily managed by m68k porters Wouter Verhelst and Michael Schmitz, and aim to track the real testing as closely as can be managed. In addition the m68k will aim to make installable snapshots from this, with the aim of getting something as close as possible to the etch release on other architectures. A new trademark policy for Debian is finally in development, inspired by the Mozilla folks rightly pointing out that, contrary to what we recommend for Firefox, our own logos aren’t DFSG-free. Branden Robinson has started a wiki page to develop the policy. The current proposal is to retain two trademark policies – an open use policy for the swirl logo, that can be used by anyone to refer to Debian, with the logo released under an MIT-style copyright license, and left as an unregistered trademark; and an official use license for the bottle-and-swirl logo, with the logo being a registered trademark, but still licensed under a DFSG-free copyright license. The hope is that we can come up with at least one example, and hopefully more, of how to have an effective trademark without getting in the way of people who want to build on your work down the line. Keynote address at OpenFest. Though obviously too modest to blog about this himself, Branden Robinson is currently off in Bulgaria, headlining the fourth annual OpenFest, speaking on the topics of Debian Democracy and the Debian Package Management System. New Policy Team. After a few days of controversy following the withdrawal of the policy team delegation, a new policy team has formed consisting of Manoj Srivastava, Russ Allbery, Junichi Uekawa, Andreas Barth and Margarita Manterola. Point release of sarge, 3.1r4. A minor update to Debian stable was released on the 28th October, incorporating a number of previously released security updates. Updated sarge CD images have not been prepared at this time and may not be created until 3.1r5 is released, which is expected in another two months, or simultaneously with the etch release. Debian miniconf at linux.conf.au 2007. While it may technically not be supposed to be announced yet, there’s now a website for the the Debian miniconf at linux.conf.au 2007, to be held in Sydney on January 15th and 16th (with the rest of the conference continuing until the 20th). This year derived distributions are being explicitly encouraged to participate, so competition is likely to be high, and it’s probably a good idea to get your talk ideas sorted out pretty quickly if you want them to be considered!