Having had a number of hard drives fail over the years I use RAID whenever possible to reduce the probability of data loss caused by hardware failure. It’s unfortunate that some machines make it impractically difficult to install a second hard drive (my laptop and some small form factor desktop machines I have given to relatives). But when it’s possible I have two hard drives running software RAID-1. I use two partitions, one for /boot and one as a LVM physical volume (PV). When using RAID I make both /boot and the PV be software RAID-1 devices (the vast majority of machines that I install don’t have budget available for hardware RAID). /boot is a small partition, approximately 100M. For a machine with only one disk I make the second partition take all the available space as there is no benefit in doing otherwise (LVM allows me to create an arbitrary number of block devices out of the space at run-time). When using software RAID I often make the PV take less than the full capacity of the disks. When the disks are 40G or more I usually use less than half the capacity. For most machines that I install or run the full capacity of the disks is not required. One deficiency of Linux software RAID is that on a power failure the entire RAID device must be checked to ensure that all disks have matching data. Reading the entire contents of a pair of disks can take a large amount of time if the disks are large, and as the size of disks is increasing at a greater rate than the speed of disks this problem is getting worse. See my ZCAV benchmark results page for graphs of the contiguous IO performance of some disks I’ve owned [1]. It seems that with a 10G disk you may expect to be able to read it all in less than 1000 seconds, for a 46G disk it’ll be something greater than 1,500 seconds, and for 300G disks you are looking at something well in excess of 5,000 seconds. Almost all disks (and all IDE and SATA disks for which I’ve seen benchmark results) have the lower block numbers mapped to the outside tracks which are longer and give a higher contiguous IO speed. So by using the first half of the disk the RAID synchronisation time is reduced to less than half what it might be (in the absence of motherboard bottlenecks). When there is no need for more than about 10G of storage space there’s no benefit in making a large RAID device and wasting recovery time. While the system can operate while the RAID is synchronising the performance will be significantly lower than normal. If the usage pattern of the machine changes such that it needs more space it’s easy to create new partitions, make a new software RAID, and then add it to the LVM volume group (I’ve done this before). So the down-side to this is minimal. When creating LVM logical volumes (LVs) I create volumes for the root filesystem and swap space when doing the install. This should result in the swap space being near enough to the start of the disk to get reasonable performance (but I haven’t verified this). I make the root filesystem reasonably large (EG 6G) as disk space is plentiful and cheap nowadays and the root filesystem is the only one that you can’t easily extend when running LVM (trying to do so deadlocks the disk IO). After the base install is done I create other LVs.

• [1] http://www.coker.com.au/bonnie++/zcav/results.html

Share This

My mothers computer had died. Well, the Linux on it was still working, so she was able to open her document files, read her email and use chat. Pretty much everything works under Linux, with the exception of using the Fax functionality of the AVM Fritz!Box via CAPI-over-TCP. (Ironically, the Fritz!Box itself runs Linux, so it's just because AVM doesn't bother to supply a Linux client too).Anyway. Logging in remotely, I quickly found out that the hard drive had serious issues, with lots of bad sectors on the main Windows partition (fortunately, we kept system data and user data separate!). So I'm not blaming Microsoft for dying (but Samsung; since this is the second time within three years the drive has died, I guess I won't be buying a Samsung HD anytime soon).Last weekend, I bought a new hard disk and went to my parents to fix it. I copied over the partitions (some 64k data could not be read any more), and tried to get Windows up again, too. (Linux was trivial; copy, boot record, done)So I ended up doing a "rescue" Windows installation, using the XP service pack 2 CD. I figure this is still the latest setup for XP available? It went through the usual driver-loading, did the first part of the installation, rebooted into the new system, did this "estimated time 39 Minutes" setup screen. After like 10-15 Minutes, it had a bluescreen, dumped memory and rebooted. And cycled through that again and again.It took me like 6 hours total to get the Windows system fixed (mostly waiting for the Microsoft setup to run through again). I figure that there aren't many users out there that actually could have fixed that Windows. The reason is simple: Microsoft crappy setup. Probably to protect it's serial number thingy or just to display fancier graphics, setup refuses to work in safe mode. And the bluescreen even suggested to try the safe mode, just to display the message "setup.exe doesn't work in safe mode, click OK to reboot".If I could have used that "safe mode", fixing would have been a lot easier. The bluescreen mentioned a device driver ati2something.sys; apparently part of the ATI video driver. So I tried the rescue console of the XP CD to just kill that driver, but setup kept on actually reinstalling the file.The way I fixed it in the end is simple: Linux to the rescue. I booted the (working like a charm) Linux installation, accessed the main Windows partition using ntfs-3g, found all references to the ATI driver in the Windows\Inf driectory and removed them.After I had removed these references, Microsofts setup.exe completed, and I had a working-again Windows in VGA mode. Then I could install the ATI drivers again. Microsoft really needs to work on that setup, it needs to allow disabling certain drivers and similar rescue things.Maybe Microsoft should start shipping a Knoppix CD with Windows, for repair.

How often have you said to yourself "this programming language's if statement is too flexible, I need to make it more rigid, and with a syntax nobody else understands"? If you've ever said that to yourself, then take a look at this Rails plugin. From the brief description of the plugin:

Allows developers to execute or not execute given code block depending on a set of conditions, written in intuitive manner. Especially useful within view templates, where it can eliminate the need for multiple if ... else ... statements.

That screams "overkill" to me, but for the sake of my morbid curiousity (and on the very, very off chance that it's something not entirely ridiculous) I took a look at the detailed documentation. At least there is detailed documentation for this plugin. I didn't get any further than the first example, though. Take a look at this monster:

How often do you find yourself writing something like that in your views:

	  <% if current_user != :false && (current_user.administrator?   current_user == @profile.user) %>
	    <%= button_to('Big Red Button', destroy_everything_path) %>
	  <% else %>
	    <%= button_to('Hands off!!!', access_denied_path) %>
	   <% end %>
	

It works, but, you know, it's not what you would call beautiful, is it? What about something like that:

	  <% access.to_administrator.or_user_of(@profile) do %>
	    <%= button_to('Big Red Button', destroy_everything_path) %>
	  <% end.else do %>
	    <%= button_to('Hands off!!!', access_denied_path) %>
	  <% end %>
	

At least conditions are looking much better, aren't they?

Hopefully, most people out there answered a resounding "no" to that last question. A plugin which causes you to write just as many lines and very nearly as many characters, whilst using a completely different minilanguage to what every Ruby programmer already knows, does not sound "much better" to me. Ruby people tend to love little minilanguages to get things done, but this... I just don't have the words to properly describe it. I'm going to start a list of "poison plugins" -- ones that, if I see any of them in or around the code of a Rails project I'm looking at working on, immediately doubles the hourly rate and the time estimates. Stupidity is toxic, and working with hazardous substances is always more expensive. Other current candidates include the old-world auth generator I gutted while I was at Vquence, and annotate_models -- the former because it's shocking code, and the latter because anyone who uses it has some seriously scary ideas about what constitutes acceptable documentation and development practices.

In just over a month (1 month and 1 day, to be precise), it's FOSDEM again. The Debian Developers Room schedule is almost complete, and some interesting things are being published around it. Such as the pre-FOSDEM beer event. In previous years, this always happened at the "Le Roi d'Espagne", a bar at Grand Place in Brussels. This was a nice place for many years, because it's easily found, and they have this backroom where quite a lot of people would fit in. Unfortunately, "quite a lot" does not equal "a huge number", with the amount of people going to the pre-FOSDEM beer event more and more approaching the latter than the former as the years go by. Last year, it finally became too crowded, and it was decided that the pre-FOSDEM beer event would change bars this year. Which has now happened. This year, the pre-FOSDEM beer event will be at the Delirium Caf , which is not at the Grand Place anymore, but just 100m away from it; the FOSDEM website has more information. A nice feature of the Delirium Caf , besides the fact that they are much larger, is the huge amount of different beers they have. Over 2000 of them, which you can query online!. And that's not even considering the soft drinks or waters or whatever, which they also have on their menu. Another novelty this year is the streaming; the main tracks that will be held in Janson will be streamed out of the event, and the Debian video team is also planning to do some streaming. Meaning, even if you can't make it to FOSDEM, you'll still be able to follow some of it. You won't be able to follow everything, especially not the hallway track which at FOSDEM is a very important one; but at least you'll be able to sample some bits, which is nice. Other than that, not much will change. There'll be a key signing party, organized by yours truly. There'll be Lightning talks, there'll be the Main track, and there'll be a number of Developer rooms, including the Debian one—which, occasionally, is also organized by yours truly. This conference has always been my favourite (even though I haven't been to many conferences besides FOSDEM); I've never missed even one edition ever since the very first one back in 2001 (when it was still called OSDEM). And since a few years, I've also been offering crashing space at our office, for international geeks who don't mind roughing it a bit (it's an office, there no shower, there's only floor space). This year, perhaps I haven't been spamming enough for that, but for now I only have two people who're interested in sleeping over (and they're not even sure); if you're going to FOSDEM and still need a place to sleep, you're (probably ;-) welcome. Send me an email. On the Debian front, things are going well, for the most part. The list of speakers for the Devroom is nearing completion, leaving me with little more to do than to start assigning times. We've been assigned a booth as well, but there I still need to figure out how to organize it, and what to do with it. There will of course be the regular UK T-shirts, and probably some other merchandizing, but I also want something involving some computer device. We've had this d-i "babelbox" installation running a few times now, which was nice; but I do think we need some variation, too. The only problem with that approach is that I don't really know what that variation could be. Suggestions are welcome! And so time goes on, and FOSDEM draws nearer. At some point it'll eventually happen, and then it will be over before one can say "blueberry pie". Sometimes I wonder whether all these months of preparation are actually worth it. But when FOSDEM is actually here, I'm sure I'll find that it is, indeed, worth it...

As you might know from reading my blog, at my workplace, we have largely standardized on Linux on the desktop and laptop.

We use systemimager to maintain a standard desktop image and a separate standard laptop image. These images differ because there are different assumptions. The desktop machines mount /home over NFS, authenticate to LDAP, etc. This doesn't work on laptops. Moreover, desktops don't use network-manager or wifi, but laptops do.

Our desktop image uses Debian's hardware autodetection -- plus a little hacking in /etc/init.d/gdm -- to automatically adjust to a wide range of hardware. So far this has worked well.

Laptops are much more picky. Our standard laptop model had been the HP nc4400 -- a small and light 12" model that people here loved. HP discontinued that model. Their replacement was the 2510p. We ordered one in here for evaluation. Try as we might, we couldn't get it to suspend and resume properly in Linux.

So I went out scouring the field of Linux laptops. Companies such as Emperor Linux buy retail laptops from people like Lenovo, test them for Linux, and sell them -- at a premium. These were too expensive to justify at the quantities we need them.

Then I stumbled across Linux Certified. I'd never heard of them before. I called them up and asked a few questions. They don't buy retail laptops, but instead have OEMs in Taiwan build laptops to their spec. They happen to use the same OEM that Fujitsu does, I believe. (No big company builds laptops in the USA these days). I asked them about wifi chipsets, video chipsets, whether they use stock kernels. I got clueful answers to all of these.

So we ordered one of their LC2100s models. They didn't offer Debian preinstalled, but did offer Ubuntu, so I selected that. The laptop arrived a couple of days (!!) later, configured with the particular CPU, etc. that I selected.

I was surprised at the thrill I felt at taking a brand new laptop out of its box, turning it on, and watching Grub appear before my eyes. Ubuntu proceeded to boot. I then of course installed our regular Debian image on the thing to check it out.

It needed a kernel and xserver-xorg-video-intel from lenny, as well as the ipw3945 driver for wifi, but otherwise worked with the exact same software as our HP nc4400 image. (In fact, it wasn't hard to support both laptops with that image, since both use a lot of Intel hardware.) The one trick was making hibernate call /etc/init.d/ipw3945d stop so that the ipw3945 module could be unloaded before suspend. (Why this particular chipset needs a daemon is beyond me, but oh well.)

The hardware is great. As far as I know, the ipw3945 was the only component that wasn't directly and automatically supported by DFSG-free software in lenny main. The screen is sharp and high-contrast (it's glossy, which I personally don't like, but I bet our users will). The device itself feels sturdy. It's small and dense. I haven't opened it up, but it looks like all you need is a screwdriver to do so.

The only downside is that they don't sell docking stations for it. Their standard answer on that is to buy a USB docking station. That's a partial answer, but can't handle power or video like a standard docking station will.

Also, the LC2100s is much cheaper than the HP laptop, even when configured when nicer specs in every way. That is no doubt partially due to the lack of the Windows tax.

I'm sending off an order for 4 more today, I believe.

Joey, just don't delay your releases waiting for incoming translations. Gettext is anyway smart enough to not use translations when they're non-existing (aha) of fuzzy. So, an incomplete translation for a program will just end up in a partially translated program. That's actually the case for *many* localized software, including the big ones. I suggest that you apply such a schedule:

• Plan a release
• Send call for translations (hint: podebconf-report-po is your friend even for non debconf translations...see its man page) and give translators a deadline. The deadline has to be reasonable and leave some room for translation proofreading. Most often, when few strings are impacted (say not more than 20 but, again, that's hard to judge)
• When the deadline is reached, upload release with what you have
• A few days weeks later, eventually release a new version with late translations

But, as you suspected, releasing without synchronised translations is the better choice....as long as you care abou tsending call for updates when needed. BTW, if you need some help to coordinate incoming translations for apt-key, maybe ask on debian-i18n and someone will eventually pop up (hopefully, not /me).

I just read an interesting approach to finding a life partner [1]. A summary is “There is a sad truth to the world today. I am part of a dying breed of people known as “shell users.” … Because there are fewer and fewer of us, I must help keep our lineage alive. I am looking for someone to help me do this. I need a woman (obviously) who is willing to raise a child with me in the method of Unix.“. While there is a moderate amount of humour in the post (I recommend that you read it in full) it is a genuine attempt to find a partner. One thing that has occurred to me is that part of the cause of the attitude toward women that is sometimes demonstrated in my community is the fact that there are so many guys who are single and have been single for a long time. If this problem was alleviated then I believe that some of the other social issues would be significantly improved. The advert in question is a bit more courageous than most guys would be prepared to consider (it’s up there with the guy who paid for a giant sign to be installed beside a highway). But there are many other options. ESR has some advice to offer [2], but the name of the URL (sextips) seems an accurate representation of the focus of the pages. One problem with ESR’s advice is that it seems to assume an ability to be extroverted (or at least fake it) which is greater than many geeks possess. Another problem is that he assumes that geeks are inherently more intelligent than average people - there is more than adequate evidence to disprove this theory. It seems more reasonable to only assume that geeks are better than average at doing geeky things. It seems to me that the one thing that geeks really are better at is writing email! Therefore it seems logical that geeks who want good success in meeting women should try and involve the use of email in some way. Singles web sites seem an obvious way to take advantage of this. Unfortunately there is a strange cultural aversion to using such web sites which even afflicts geeks. For some reason it’s thought to be a good idea to try and meet a life partner in a place where there is inadequate light, too much background noise to talk properly, and where everyone has taken mind-altering chemicals (I am referring to drinking alcohol at a bar of night-club). Once strange cultural ideas are discarded it seems obvious that if you want to meet a potential life-partner then you should do so in a place where there is good light, an opportunity to talk, and where everyone is in a normal state of mind. Starting out with email and then talking over the phone and exchanging JPEG pictures seems to be a sensible option in this regard. Most times that you chat to someone you meet over the net it won’t go any further than email or maybe phone-calls. But that’s still entertaining and useful practice at communicating with women. One thing that the Craig’s List advertiser really got right is that he knows what he wants. An advantage of the singles sites on the net is that they often force people to make decisions. When a singles site demands that you enter a desired number of children that you want to have (with 0 being an acceptable answer) then you will be forced to consider the issue and make a decision. While being prepared to negotiate about such things may be desirable, I can’t imagine anyone finding it appealing when someone doesn’t know what they want or doesn’t have the confidence to say it. Finally don’t rule out the possibility of meeting someone through your local LUG. There are a quite a few married couples who met through the Linux community. But don’t go making “pick-up” attempts on women in the community - the result will not be positive. Via Michael Still.

• [1] http://www.craigslist.org/about/best/nyc/485967082.html


• [2] http://catb.org/~esr/writings/sextips/

Share This

The portal http://www,softwarefree,org/ aggregates many blog feeds related to free software without regard to license. The About Page for my blog links to my Blog License page which states that “The contents of my blogs (unless otherwise noted) are licensed under a non-commercial share-alike license. This means (among other things) that you may not put my content on a web page that contains Google AdWords or any other similar advertising“. Fortunately I had just read a great post on ProBlogger.net about dealing with such problems [2]. This time I decided to report the site to Google Adsense. I’ve been sending out a few DMCA take-down messages recently and it doesn’t seem to do much good (some sites keep doing it). So I’ll try getting their Google account cancelled. I encourage everone who blogs on Planet Debian and the other planets that they use as sources of such unauthorised copying to do the same.

• [1] http://doc.coker.com.au/legal/blog-license/


• [2] http://www.problogger.net/archives/2008/01/20/fighting-scrapers-with-your-left-jab/

Share This

Tricky question, isn't it? Indeed, according to the ISO 639-3 standard which finally became an official ISO standard in 2007, there are 7696 different languages, including extinct, ancient, historic, and constructed languages. Of course, this may become a very debated discussion about what constitues a "language". Let's give the guidelines used by SIL International, who was designated by ISO as the official maintenance agency for ISo-639: There is no one definition of "language" that is agreed upon by all and appropriate for all purposes. As a result, there can be disagreement, even among speakers or linguistic experts, as to whether two varieties represent dialects of a single language or two distinct languages. For this part of ISO 639, judgments regarding when two varieties are considered to be the same or different languages are based on a number of factors, including linguistic similarity, intelligibility, a common literature, the views of speakers concerning the relationship between language and identity, and other factors. The following basic criteria are followed:

• Two related varieties are normally considered varieties of the same language if speakers of each variety have inherent understanding of the other variety (that is, can understand based on knowledge of their own variety without needing to learn the other variety) at a functional level.
• Where spoken intelligibility between varieties is marginal, the existence of a common literature or of a common ethnolinguistic identity with a central variety that both understand can be strong indicators that they should nevertheless be considered varieties of the same language.
• Where there is enough intelligibility between varieties to enable communication, the existence of well-established distinct ethnolinguistic identities can be a strong indicator that they should nevertheless be considered to be different languages.

So, we (iso-codes package maintainers) now have to update that part of our package and buy a big bunch of aspirin to people who will work on translating this. Moreover, contrary to all other such standards (3166 for country names, old 639-2 for languages, 15924 for language script names), there is no bloody official *French* version, so even the French translator has to work. Gues who this was until now? :-) To end this blog entry, let's ask a funny question to the readers (no, comments not allowed on my blog, I'm lazy, so answers by mail or in your blogs): what is the country in the world which as the highest number of languages listed in ISO 639-3?

* .. because its too cold, and fortunately my laptop heats so much. Sometime bad things are good for life

Long time ago I used FnFX to handle events from ACPI keys on my Toshiba notebook. However when reinstalling notebook because of disk crash, I thought there must be a cleaner way to handle these and I found patch for acpid which added handling of these special events. However I really didn't like patching acpid on every update and there didn't seem to be chance to merge it upstream, so I started to look for better solution. After another amount of googling, I found that HAL already has some support for Toshiba hotkeys. Unfortunately it is now disabled in Debian because most key did not emit anything using HAL. Okay, let's fix the HAL, maybe it will get later enabled. Converting FnFX keymap to C code was quite easy and I made a patch for HAL to add support for all keys. Hopefully it get merged soon and I can then file bug on Debian package to reenable Toshiba support in HAL. Meanwhile I'd like to find some generic way of configuring what happens on these events. For now I hacked simple Python script which listens to DBUS events and invokes appropriate commands for keys, but I hope that some such tool already exists and I just missed it. If you know something, please let me know at michal@cihar.com.

In an old post I dealt with the nice mod_chroot module to secure your multisite server. I also adopted recently vlogger in order to manage better apache logs for virtual hosts, when you have dozens or hundreds of them. Unfortunately the suggested way to use it (a simple piped command) does not work nicely with mod_chroot, because the piped command has to run in the chroot jail.

Of course, it is not a good idea installing the whole perl intepreter and all required modules in a minimized jail, so I adopted an oldish classic trick (the old things are always the best) to solve the issue: using a named pipe. You basically need to do something like the following:

mkfifo -m 600 /var/run/apache2/logger && chown www-logs /var/run/apache2/logger

cat /var/run/apache2/logger /usr/sbin/vlogger -u www-logs -g nogroup -s access.log /var/log/vlogger >/dev/null 2>&1 &

/etc/init.d/apache2 start

Of course your log directives will be something like:

LogFormat "%v %h %l %u %t \"%r\" %>s %b \"% Referer i\" \"% User-Agent i\"" vcombined
CustomLog "/var/run/apache2/logger" vcombined

You absolutely need to run the reader before the writer, else the init script would hang for ever. It is easy adding a simple init script to run vlogger before apache and it has also the big advantage of not requiring re-fork a perl intepreter at every damn log action. Piping rocks.

The story seems to have started with Damog supporting sexism and xenophobia in Debian, followed by Bernhard’s comment about that not being tolerable under Debian’s flag. Aigarius replied kinda shocked that stopping verbal abuses and violence would be censorship. AJ clearly explained the reasons why that shouldn’t be tolerated in Debian, but Aigarius seems to keep thinking that poor jerks are being discriminated when they’re not allowed to insult us. Wouter seems to be tired of the whole topic. Am I missing any chapter? Now my turn: We are on the right way. Since the Debian-Women project started, we have being able to achieve a friendly and non-sexist environment inside Debian, which is something that I’d really like to keep. It doesn’t really mind that a couple of people try to go back to a hostile environment. Trolls just do exist, I guess, but they are not representative of the general feeling of the people inside Debian. Damog, I won’t get the fuck out of here, like it or not. It seems to me that it’s just a couple of you who are happy to be in such an aggressive environment as the one you’re promoting. For what I know, most of Debian people are happy to live in peace. You don’t have social life? You don’t like it? That’s your problem, dude, but don’t ask us to leave ours. I respect you, you know I have always done. I’m just very disappointed with your comment. Really. Making fun of other people’s problems and traumas is simply bullying. I hope you think about it. For the rest of Debian, keep up the good job. Right now my feeling is that the level of sexism, racism, ageism, homophobia, hostility and unfriendliness in general inside Debian development’s world is below the average in the Free Software world. It’s nice to be there, and I’m really proud of belonging here, which is something I cannot say about every group in Free Software. I’d like to keep it that way. Sorry for the aggressiveness in this weblog entry.

Recently I bought a new desktop PC and rotated my existing machines around, leaving me with one spare. Last night I donated that PC to a local friend, (co-incidentally the same woman who had been out cat-sitter when I went to stay at Megan's parents for Christmas). I said "Its got Debian on it, that funny operating system that you used when you were looking after our kitten, remember?". She said "Linux ssems to be getting popular these days I might as well try it out". But seriously she used it. It had GNOME, it had firefox, she seemed happy. It isn't rocket science these days to point a technicalish user at a Debian Desktop and expect them to know what to do with it. The only minor complication was the lack of flash/java since it was etch/amd64 - but thats probably a plus with the amount of flash adverts! In other news I made a new release of asql last night. This now copes with both Apache's common and combined logformats by default. (Yet another tool of mine which is now being used at work, which motivated the change.) I've also started pushing commits to xen-tools last night, so there'll be a new release soon. Mostly I'm bored with that code though, it doesn't need significant updates to work any longer. All the interesting things have been done, so it's probably only a matter of time until I drift off. (To the extent that I've unsubscribed myself from xen-users & xen-devel mailing lists) Virtualisation is increasingly a commodity these days. If xen dies people probably won't care, there are enough other projects out there doing similar things. Being tied to one particular platform will probably come to be regarded as a mistake. (Talking of which I should try out this lguest thing; I just find it hard to be motivated...)

It is not uncommon to run a Linux system with a kernel that was compiled for another distribution. One reason for doing this is the difficulty in compiling and testing a kernel to make sure it will do what you require. It’s not THAT difficult for someone who knows what they are doing, but if someone else has already done the work then it seems like a waste to re-invent the wheel. Sometimes it’s an issue of a driver that one distribution supports but not another, copying the entire kernel package from another distribution may be easier than compiling a new kernel with the extra driver. Sometimes it’s a kernel bug, if distribution A has fixed the bug and distribution B hasn’t, then it’s often easier to install a kernel package from distribution A when running distribution B. Another reason for running different distributions with the same kernel is Xen. If you have a Dom0 which hosts instances for different distributions as DomU’s then running the same kernel on all of them can make it easier to manage. Unfortunately it’s not uncommon for different distributions to have different kernel feature sets. One example I’m currently dealing with is the fact that the Debian/Etch kernel is compiled with CONFIG_AUDITSYSCALL disabled while RHEL and CentOS require it. So if you run a RHEL or CentOS system with a Debian kernel (EG running a Debian Xen server with a RHEL or CentOS DomU) then you see messages such as the following in your logs. crond[7824]: pam_loginuid(crond:session): set_loginuid failed opening loginuid The loginuid feature allows login and equivalent programs (which includes xdm and other graphical login programs, cron and every other program that runs a program on behalf of another user) to set the loginuid. This loginuid will be stored by the kernel, inherited across fork() and exec, and not be changed by running setuid or setgid programs. Therefore if you see some strange entries in your audit log indicating an attempted attack you can determine the original login UID of the person responsible. In terms of security features it’s not a really high priority. But it is really annoying when programs that work on RHEL don’t work properly with a Debian kernel and put many unwanted messages in the log files. For people who have less background knowledge about these things it may be more than annoying, and may even force them to change their deployment plans to make the message go away (not everyone knows which messages can be ignored or where to ask about such things). The fact that Etch has no user-space support for the auditing features in question (auditing system calls or setting the loginuid) was never a good reason for not enabling this feature (IMHO). Using the auditing system calls was simply a matter of copying the auditctl program from a RHEL, Fedora, or CentOS system (for those who didn’t feel inclined to compile the source). The loginuid required changes to PAM to enable it, but is actually a small part of the auditing layer. As a general rule minimising the differences between distribution kernels is going to benefit most people. Some people complain about kernel bloat, but there are worse candidates for that accusation and given that it seems impossible to buy a machine with less than 512M of RAM and a 900MHz CPU (the specs of the ASUS EeePC) adding a few extra kernel features seems unlikely to hurt anyone. It is of course always possible to compile your own kernel for the smallest machines. Finally I am in the process of back-porting SE Linux code and related security features to Etch, and having this already enabled in the kernel would make my work easier. I won’t do a 7 year support cycle for it unless someone pays, but supporting Etch past the release of Lenny with the latest SE Linux features (and the current features working properly) is my aim.

Share This

Some days ago I was notified by DEHS that Enca homepage is unreachable. Okay, this happens sometimes. But as the error lasted longer and longer, I decided to ask author about it. Unfortunately the reply was that this nice software is not maintained anymore and computer which hosted it's homepage is gone. As it would be bad to loose this software completely, I offered place to host downloads for it. No, I'm not going to develop it, I already have enough projects for which I don't have enough time. So my server has just become a download place for Enca.

For the last four years, I have left my life and home to return to my mother’s far more precarious and fragile life in Puerto Rico. I do so to visit. But I also do so to give her caretaker, Milagro, a much needed break. I returned on December 18th and found my mother nearly in the same state as she was in October. Far worse than a year ago, but she still struck me as my mother, if nothing else because she knew I was her daughter. Over the course of a week, all of that changed. After a series of howling fits, by the end of my first week there, she no longer knew she was my mother. While I knew this would eventually happen, I was still caught off guard. You see, prior to my arrival, and since my last visit in late October, she asked me on the phone, and my sister and Milagro in PR, *nearly everyday,* when I was coming back. So even though she asked when her daughter, who she knew lived and worked in the city of New York, was coming back over and over again for 8 weeks, this seemingly hard-wired thought quickly vaporized thanks to what is a disease of the brain, but what strikes experientially as a cruel disease of the soul and personality. So while 2007 was overall a pretty good year, it is also the year when in certain respects my mother died, at least for me in so far she has morphed into someone remarkably different from the person I once knew. Now she only remembers small scraps of her life. She knows she is from Russia, she knows that she lives in the Casa de Vera (which she thinks is her bed), she knows she loves the dog, she knows that she had parents (and she would like to return to them but does not know where they are), she knows she has a good friend who is a painter (I think she had a massive crush on him if she still remembers him and not me but otherwise, everything is so twisted, so jumbled or so gone, it is beyond stunning. She certainly knew I was around and helping for she got upset when she knew I was leaving, often bursting in tears, asking me to take her to New York. But she just knew me as Gabriella from Nueva York who brought her novio bueno to PR and not as anyone else. It is certainly not easy to see this, to experience it day in and out but it is what it is and there is no running from it. Logistically it is also beyond hard to take care of my mom. To get her to eat, to calm down after one of her morning fits (she always, always, always had a raging fit in the morning, the afternoon and evenings being far more calm periods), to convince her to wear her dentures (which is the only remedy to stop her from spitting all over the place), to dress her, to deal with her in the middle of the night, often twice, are all extraordinarily challenging. Very quickly, your waking hours fill up with seemingly endless tasks and this I guess is, in some respects, a hidden blessing; there is just a lot less time to ruminate over how all of this, frankly, sucks. It is only later, late at night, early in the morning, or on the plane ride home where the darkness of her life would set deeply into my own. It may be obvious why this state and experience is tough but there are two parts that I find particularly rough. If my mother’s state is one of near total chaos and entropy, there is one thing that is utterly clear. She knows she is suffering and she wants out. On particularly bad days, she would mutter or sometimes yell loudly that she wants to die and would ask for the medicine that would accomplish this. She would even sometimes call me mala for not giving her this medicine. It is certainly not the case that everyone with Alzheimers goes through what my mother does. Apparently, some experience the illness quietly and peacefully. This is so not the case for my mother, who lived a particularly hard yet vibrant life. Donning a difficult personality, she lived lived as fully as she could and it is clear that as life leaves her, she would rather not be around to experience what is a cruel exorcism of self. Thankfully, she is not constantly or not even mostly in a suicidal state. I think she at times forgets how lousy she feels and rather enjoys the rather limited life she has. And at this point, I just hope that she continues to have calm or even happy moments. The second surprise concerns my own memories. My mother has had this rare form of Alzheimers, Posterior Cortical Atrophy, for at least 6, possible 7 years now, though we only received the official diagnosis 2003, which is the year when when I first started to write the occasional post about my experiences with her. In 2003 and 2004, she was pretty functionally in tact and it has only been the last 2.5 years when the persistent decline has set in, whittling her capacities and memories to what seems to be a bare minimum. But because her presence and reality is nothing short of totally enveloping and drowning, I am starting to lose my own memory of my mother prior to her illness. If Alzheimers robs people of their memories, I have come to realize, that if you are not careful, it is a thief that can also rob your own memories. I think it is for this reason that I have become so attached to my mother’s stuff her furniture, her paintings some of which I have taken back with me. They are material vehicles that transport me back to the past when my mother was in a different state and place. Now it is clear that if the challenge is to deal with the emotional toll this illness causes, it as much summoning the will and performing the labor to retain and recall my older memories of her.

Those who keep track, will know that I started writing support for NBD in debian-installer last weekend. But that's not what this post is about. I've been setting up a laptop for my brother. He talked about "something about as fast as our parents' computer", which is a 600Mhz PIII. After looking a while on ebay, I found a Dell Latitude L400, a 12" 700Mhz PIII-based laptop, for a fairly low price, which seems to fit that description, so I placed a bid. Only to figure out later that I should've read the description a slight bit more, because this was an incomplete machine: no RAM, no power adapter, no battery, no hard disk, which was being sold "for parts". Darn. Got me some fitting RAM and a power adapter on replacedirect (which is a shop I can really recommend, BTW -- new batteries for almost all conceivable laptop models, including those that have been out of production for years), put the RAM in, connected the power adapter, and crossed my fingers. Luckily the machine appears to work; it's not that they took it apart because it had broken down, or some such. I also still have a 2" hard disk to put in the machine, but apparently Dell has this conversion thing that I need to put between the disk and the rest of the machine, and that's missing; I guess I'll have to be a bit creative there. So, for the time being, I configured the machine to enable PXE booting, and set something up on the network to boot from. Since the installer support to install to the network is not (yet ;-) finished, I needed to do some stuff manually, however. After making sure I could boot the machine (long live debootstrap), I set out to install additional packages. After downloading and installing a number of packages, however, the machine suddenly died. Unfortunately rebooting didn't fix anything; the machine would die somewhat halfway through the boot. Since it was quite, eh, "early" in the morning by then, I left it at that and went to bed. Today, I easily figured out what the problem was: network-manager expects to take the network down, and then to run some scripts... which obviously breaks just about everything. I guess that if I want to make partman-nbd work, I'll have to do some work there, too...

mutt-patched: sidebar keybindings mutt-patched it's really cool, thanks Myon for advertising it. Actually I've tried it only in the hope that it could solve bug #459739 (don't bother trying: it doesn't), but I'm now liking it, especially the sidebar patch. Unfortunately it lacks default keybindings for moving the sidebar cursor (why the heck: since the sidebar is enabled by default, am I supposed only to look at it?). Here are mine, in case someone wants a "plug and play" configuration for her .muttrc:

zack@aquarium:~$ cat .muttrc  tail -n 6
# mutt sidebar settings
bind index,pager \CP sidebar-prev
bind index,pager \CN sidebar-next
bind index,pager \CO sidebar-open
macro index,pager B '<enter-command>toggle sidebar_visible<enter>'
color sidebar_new yellow default

They are basically a subset of those proposed on the homepage, but I did not like changing the default semantics of b. See also bug #459725.

Here's what I found in the recent APT upload as changes to PO files:

 #: apt-pkg/cdrom.cc:678
 #, c-format
 msgid ""
-"Found %u package indexes, %u source indexes, %u translation indexes and %u "
-"signatures\n"
+"Found %zu package indexes, %zu source indexes, %zu translation indexes and %"
+"zu signatures\n"

The consequence of such changes is fuzzying translated strings, thus forcing translators to re-update their files and the translation coordinator to commit them. In short, valuable time wasted. One could object that translators shouldn't try to keep up 100% all time long. However, those who do not do so just end up with huge updates to do...which is sometimes demotivating. So many of us prefers keeping up with small updates. However, when one sees such updates that appear to be cosmetic, it's very hard to refrain hating developers (I even ranted about this in dpkg commit logs, which bringed some argument with Guillem Jover.... I certainly shouldn't have ranted in commit logs but that probably gives a good idea how upset I was). Please think about this next time you change a translatable string, particularly when you *know* that someone is taking care to coordinate *your* software translation work with translators. Side comment: bzr choke up on my local APT copy and I can't even cope with updates for APT. That will not really help me to love those DVCS. Update: many explained me that such changes are not useless which I'm ready to accept given my level of knowledge in programming. So, apologies to programmers who made these changes. I just hope this will however better give the translator's POV wrt such matters. We all know that translators *and* maintainers work really hard to give the best results and both always need to have a better knowledge of other's constraints....and limits! I've also been very wisely teached about possible ways to jiggle with VCS to work on defuzzification by reverting changes, unfuzzy, re-apply changes. Sure. At the expense of a lot of invested time to check how to do this properly with all these neat modern DVCS, I could. Yay, I so much love fiddling with VCS....and spending hours doing this is something that makes my days.