Oddly, I have had four different people ask me about the best way to begin a Django project or setup their system to make it easy to develop with Django. Since I've now given my response via email so many times, I figure I might as well broadcast it and hopefully this will help others as well My assumptions:

• Using Linux (or a Unix machine)
• Single developer with root access (quite possibly a laptop)
• Knowledge of DVCSes (e.g. git / hg / bzr )

What we will do is create a private binary directory and another Python modules. Then take a checkout of the two most important Django projects, and make them work. First: create your user

$ sudo adduser newbie
$ ssh localhost -l newbie
$ whoami
newbie

Then we want to create some local bin and lib directories. First the binary directory $ mkdir ~/bin # On Ubuntu/Debian, this will automatically be in your PATH the next time you login And now a local directory for our various libraries

$ mkdir -p ~/lib/python
$ echo "PYTHONPATH=~/lib/python:" >> ~/.bashrc
$ echo "export PYTHONPATH" >> ~/.bashrc

This will add that directory to our Python path. If you happen to also use another language you can put things into ~/lib/ruby, ~/lib/perl as appropriate

$ mkdir ~/Projects
$ cd ~/Projects

Here is where we will store copies of upstream software. What is the reason for using the repositories rather than packages? This allows us to checkout specific versions to match what our clients might be using. Or test things against newer versions of the upstream project. First, let's setup Django. I tend to use git by default, especially if the upstream is using Subversion. If they are using Mercurial or Bazaar, I use those directly.

$ git svn clone -s http://code.djangoproject.com/svn/django/
Initialized empty Git repository in /home/newbie/Projects/django/.git/
Using higher level of URL: http://code.djangoproject.com/svn/django => http://code.djangoproject.com/svn
r1 = 5cda37203ffa6ea83da2958a95c377984482877f (refs/remotes/trunk)
	A	django-docs/images/flatfiles_admin.png
	A	django-docs/images/users_changelist.png
	A	django-docs/model-api.txt
	A	django-docs/build.py
	A	django-docs/db-api.txt
	A	django-docs/writing-apps-guide-outline.txt
	A	django-docs/templates.txt
r2 = b8249ac45e2154933b9649fd8181d5769e31c9fc (refs/remotes/trunk)
	A	django/utils/feedgenerator.py
	A	django/utils/datastructures.py
[...]
r13399 = f3902c67a3b8788de2145899e435a394c512b455 (refs/remotes/releases)
	M	tests/regressiontests/m2m_through_regress/tests.py
r13400 = cd72207306a5a4eecdf07f65c109f37c8317ed81 (refs/remotes/trunk)
$

Now we have Django, push it into our python path

$ cd ~/lib/python
$ ln -s ~/Projects/django/django/
$ python
Python 2.6.5 (r265:79063, Apr 16 2010, 13:57:41) 
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import django
>>> django.VERSION
(1, 2, 1, 'final', 0)

Now, let's do the same for South. South is a database migration helper for Django. These are the two things you want to have in any Django at a minimum. There are also plenty of other amazing things like haystack, piston, satchmo, etc. You can follow the same recipie for them too.

$ cd ~/Projects
$ hg clone http://bitbucket.org/andrewgodwin/south/
destination directory: south
requesting all changes
adding changesets
adding manifests
adding file changes
added 802 changesets with 1340 changes to 183 files (+1 heads)
updating to branch default
143 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cd ~/lib/python
$ ln -s ~/Projects/south/south
$ python 
Python 2.6.5 (r265:79063, Apr 16 2010, 13:57:41) 
[GCC 4.4.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import south
>>> south.__version__
'0.7.1'

Finally, we want to be able to create Django projects. There is a great helper called django-admin that will do this. Let's put it into our path

$ cd ~/bin
$ ln -s ~/Projects/django/django/bin/django-admin.py
$ hash -r

That last statment will cause your interpreter to re-read PATH and make anything new available for execution. Now, you should go ahead and create your projects. There are a variety of ways to do this. However what I like to do is keep Django applications separate from the Django project. That way, they can easily be re-used if required. So, for a project called 'foo', we might have

$ mkdir -p ~/Work/foo
$ cd ~/Work/foo
$ mkdir foo.example.com
$ mkdir templates
$ mkdir media
$ mkdir <individual apps>

For each individual app, put them into the Python library. And you then have your re-usability from within Django. For a application called 'bar', you would do:

$ cd ~/Work/foo
$ django-admin.py startapp bar
$ cd ~/lib/python
$ ln -s ~/Work/foo/bar

And now, in your Django foo.example.com setting.py's file you can put 'bar' as one the installed applications and things will Just Work Obviously there are many way to slice this particular mango, but I've found that this works pretty well for me. You can spruce it up by revision controlling each directory in your project (I do) and also take advantage of things like virtualenv and Fabric to make deploying just as easy as developing. But I'll leave those topics until a later date

Up to now I had a single blog hosted on ouaza.com, I used to blog in French and in English on many topics, even though free software and Debian was the main topic. Sometimes I avoided blogging on something because it would not really match the expectations of my readers (and of the various planets syndicating my blog). And I have always been annoyed by the fact that English readers were second-class on my blog because everything was configured in French. So I decided to fix this once for all, I have created two new blogs in addition to ouaza.com. The latter is now my private blog (in French) with everything that is not free software related. And free software will be the topic of my 2 new blogs :

• RaphaelHertzog.com is the English one (RSS feed) ;
• RaphaelHertzog.fr is the French one (RSS feed).

I have setup some HTTP redirections on various feed URLs but if you were subscribed to my main feed, you re now redirected to the new English feed and you might want to subscribe to the French one to continue reading my articles in French. In any case, you might want to update the feed URL that you used. I also profited from this reorganization to switch to WordPress 3.0 and the 3 blogs are hosted on the same installation thanks to the new multisite feature and to the domain mapping plugin. The main regression in those changes is that I m back to the (new) default theme of WordPress with the standard header image. I would like to personalize them but I have no graphics skills but if you do and would like to work on this for me, please get in touch. I ll make sure you get your pony in return. More changes concerning those blogs are in the pipe but that will be the topic of other posts. Thanks for following ! No comment

I've had the opportunity to look into the Joojoo tablet recently. It's an interesting device in various ways, ranging from the screen being connected upside down and everything having to be rotated before display, to the ACPI implementation that's so generic it has no support for actually attaching most embedded controller interrupts to ACPI devices and so relies on a hacked kernel that exposes individual interrupts as ACPI events that are parsed in userspace, to the ChangeOrientation binary that's responsible for switching between landscape and portrait modes containing gems like ps aux grep fgplayer grep -v grep and containing references to org.freedesktop.PandaSystem, a somewhat gratuitous namespace grab. Hardware-wise it seems to be little more than battery, generic nvidia reference design board and touchscreen with an accelerometer and LED glued to the chipset's GPIO lines. The entire impression is one of an ambitious project not backed up by the level of technical expertise required to get things done properly. Frankly, I think Michael Arrington came out of this rather better than he could have done - behind the reasonably attractive UI, the entire device is pretty much held together by string and a following wind.

Of course, releasing shoddily put together technology isn't generally illegal and from that point of view Fusion Garage aren't any worse than a number of products I've had the misfortune to actually spend money on. But they're distributing Linux (stock Ubuntu with some additional packages and a modified kernel) without any source or an offer to provide source. I emailed them last week and got the following reply:

Dear Sir,

we are still actively making changes to the joojoo software. We will make
the source release available once we feel we are ready to do so and also
having the resources to get this sorted out and organized for publication.
We seek your kind understanding on our position and appreciate your
patience on this. Thank you.

Best Regards
joojoo Support Team

Strong work, Fusion Garage. Hardware and software may not be your strong points, but you're managing copyright infringement with the best of them.

ikiwiki is not yet able to create a Google sitemap internally, so I'm using google-sitemapgen. To run it automatically when the website is being updated, I've changed the git hook to run it after the ikiwiki hook.

• In the ikiwiki setup file let git_wrapper point to a file which is not the post-update hook, so you're able to run it from your own skript. I'm using /path/to/myikiwiki.git/hooks/post-update.ikiwiki.
• Write a skript which runs as post-update hook and executes the created hook from ikiwiki and google-sitemapgen with a proper configuration. My versions of both files are listed below.

/path/to/myikiwiki.git/hooks/post-update

#!/bin/sh
/path/to/myikiwiki.git/hooks/post-update.ikiwiki
/usr/bin/google-sitemapgen --config=/path/to/mywikiconfig/sitemap_config.xml
exec git-update-server-info

/path/to/mywikiconfig/sitemap_config.xml

<?xml version="1.0" encoding="UTF-8"?>
<site
  base_url="http://bzed.de/"
  store_into="/path/to/bzed.de/sitemap.xml.gz"
  verbose="0"
  suppress_search_engine_notify="0"
  default_encoding="UTF-8"
  >
  <directory
    path="/path/to/bzed.de"
    url="http://bzed.de/"
    default_file="index.html"
  />
  <!-- Exclude URLs that end with a '~'   (IE: emacs backup files)      -->
  <filter  action="drop"  type="wildcard"  pattern="*~"           />
  <!-- Exclude URLs within UNIX-style hidden files or directories       -->
  <filter  action="drop"  type="regexp"    pattern="/\.*"     />
  <!-- Exclude ikiwiki directories -->
  <filter  action="drop"  type="regexp"  pattern="/helponformatting/*"           />
  <filter  action="drop"  type="regexp"  pattern="/ikiwiki/*"                    />
  <filter  action="drop"  type="regexp"  pattern="/markdown/*"                   />
  <filter  action="drop"  type="regexp"  pattern="/openid/*"                     />
  <filter  action="drop"  type="regexp"  pattern="/pagespec/*"                   />
  <filter  action="drop"  type="regexp"  pattern="/preprocessordirective/*"      />
  <filter  action="drop"  type="regexp"  pattern="/sandbox/*"                    />
  <filter  action="drop"  type="regexp"  pattern="/shortcuts/*"                  />
  <filter  action="drop"  type="regexp"  pattern="/smileys/*"                    />
  <filter  action="drop"  type="regexp"  pattern="/subpage/*"                    />
  <filter  action="drop"  type="regexp"  pattern="/templates/*"                  />
  <filter  action="drop"  type="regexp"  pattern="/theme/*"                      />
  <filter  action="drop"  type="regexp"  pattern="/wikiicons/*"                  />
  <filter  action="drop"  type="regexp"  pattern="/wikilink/*"                   />
  <filter  action="drop"  type="regexp"  pattern="/wmd/*"                        />
  <!-- Exclude css files, favicon and javascript -->
  <filter  action="drop"  type="wildcard"    pattern="*.css"                         />
  <filter  action="drop"  type="wildcard"    pattern="*favicon.ico"                  />
  <filter  action="drop"  type="wildcard"    pattern="*.js"                          />
  <!-- Exclude ikiwiki.cgi -->
  <filter  action="drop"  type="wildcard"    pattern="ikiwiki.cgi"                   />
</site>

See the examples and README files in /usr/share/doc/google-sitemapgen/ for an introduction into configuring google-sitemapgen. So far the generated sitemaps works very well, especially for search engines which are not able to use the rss feeds like Google does.

Terah has been having thyroid troubles for some time now (you can read about it on her blog). Today was the day for it to be removed. This procedure is somewhat delicate. Running through each half of the thyroid are nerves that control the vocal chords. Also embedded in each half are tiny parathyroids, which regulate the body s calcium levels. Losing either of these things in one half of the thyroid is no big deal, but losing either of them entirely can be serious. For this reason, the general plan was for Terah to have half of her thyroid out, unless it was obvious in surgery that it would be a health risk to leave the other half in, or that it was obvious that the removal of the first half had successfully preserved the nerves and parathyroids. Jacob and Oliver spent the night with my parents last night an event that Jacob was incredibly excited about. I came home last night to find him running in circles in the kitchen. I had this conversation with him: Me: Jacob, are you excited about something? Jacob: Yes! Me: What are you excited about? Jacob: I don t know. (He usually says this when he doesn t want to say, but I figured it was his pending overnight stay) .. a minute later .. Jacob: I am excited about something blue. Me: [genuinely confused] Hmmm . I don t know what blue thing you might be excited about. Can you tell me? Jacob: A blue house! Me: Oh, is it grandma and grandpa s blue house? Jacob: YEAH! Now you ve got it! I m so excited! He was still running in circles the whole time. So Jacob and Oliver left, and Terah and I worked on the house. This morning, we arrived at the hospital at 6:15 to check in. At usual, the staff there was incredibly friendly and helpful. And two of them made connections: one of the intake nurses had taught at the college where my dad works, and another nurse knows his cousin. Living where we do, we were not surprised by this. (You sort of wonder how many connections you ll make at a place like this.) The surgery area is right next to the ER, and people waiting for people in surgery normally wait there. Having got my fill of the TV playing infomercials for the morning in the 5 minutes we sat there, I arranged to wait in the cafeteria (which is large and quiet in the middle of the morning) and they just called my cell phone when Terah was done. I was with Terah for as long as possible, then ate breakfast in the cafeteria, walked over to the doctor s office next door for my weekly allergy shots, and then waited with my Kindle in the cafeteria. They called, and a little while later the surgeon explained how the surgery went: far easier than they had expected. He was confident the left side surgery went well, and so took out the whole thing and was confident the right side removal also went well. I went to wait in Terah s room for her to exit recovery, and our pastor and his daughter showed up to wait too. When she arrived, she was very tired but said a few words before going to sleep. Our pastor gave the two of us a minute before coming in, and read a selection from Psalm 139 before leaving. I then mostly waited with my Kindle some more until she woke up. I brought back some lunch from the cafeteria, and eventually Terah woke up. We chatted just a bit (it was mostly me talking). I went to pick up the boys, and brought them to the hospital. They were glad to see her. But then, the dilemma: I had promised Jacob that we would eat in the hospital restaurant , but it was only 4 and they didn t start serving supper until 5. Jacob somehow remembered that we went exploring in the hospital when Oliver was born 11 months ago, and had been talking about doing this already. So off we went: Jacob sometimes helping me push Oliver s stroller, sometimes running on ahead, enjoying himself and spelling out letters on big signs on the walls. We got a whole bunch of smiles and compliments. Oliver was laughing, and Jacob was happy and well-behaved. We went towards the cafeteria at 4:30 and I got Jacob some of their free lemonade. He was complaining about not eating, and I remembered that he noticed a nurse walking out of there with an ice cream cone while we were exploring. Obviously the soft-serve machine was already up, so I got him and me ice cream cones. I m sure he ll be talking about the hospital ice cream for days. Anyhow, it took him about half an hour to eat it, so it was perfect timing for supper. We ate, went back to see Terah, and then headed out. I do believe that these may be the only two boys I know of that actually think of a hospital as a fun place to go. It wouldn t surprise me at all if Jacob asks to go back there. Both boys fell asleep on the way home. Jacob, unfortunately, had a rather significant accident, possibly due to the large amounts of free lemonade he insisted on drinking. And it was hot outside. So I carried Jacob in, and he sort of groggily looked at me. I suggested he take a nap on the rug in the kitchen (his room is upstairs) while I bring Oliver in. He sort of collapsed onto the rug and was back asleep a few seconds later. I got Oliver in, and brought down new shorts and an overnight pullup for Jacob. Put them on, had him use the toilet, and got him in bed. By that time, Oliver was awake and hungry. So I got him fed, and neither one of them quite went to sleep easily but they did. I watered the flowers and garden, did a load of laundry, etc. Jacob had been worried about the surgery, though had trouble verbalizing it. I think he s better about it now, though some of his trouble falling asleep tonight was probably still worry about that. Hopefully he ll be better once Terah is back home, which should hopefully be tomorrow.

I ve been watching the June budget and pondering its effects on me, our co-op, co-ops in general and the wider community.

IT Taxes

I just want to flag this one up as a special interest: the telephone tax is killed off before it starts. Yippee! But now we get to wait and see how the government will support private investment to get universal provision of fast broadband. I ve no problem with tax relief for the video games industry being scrapped - why should any type of software get special treatment?

VAT up 2.5% to 20% from 4 January 2011

This seems bad for everyone. It s a bit less bad for our co-op because we have some international suppliers, whose sales tax rates won t change, but we buy a lot from the UK too and it hurts all our workers.

Personal Taxes

The basic income tax allowance rise of 1,000 is welcome, as is restoring the pension-earnings links. More widely, the freezes in various things, increase in Capital Gains Tax and drop in cider tax all seem broadly good ideas. The housing benefit 400 maximum is a bit mixed - how bad it is may depend how lenders react when borrowers get into difficulty.

Business Taxes

At a time when a VAT increase is called unavoidable , it stinks a bit to cut corporation tax, extend the 10% capital gains tax allowance and raise the employers National Insurance threshold. Of course, our co-op pays none of those, so it also hurts us by giving our competitors an advantage.

Business Incentives

George Osborne said he wants to tackle regional economic differences, but the big change in this budget is bad for all existing businesses outside London, the South-East and East: National Insurance exemptions for new businesses. Once again, existing co-ops take it in the neck from another government obsessed with capitalism and employment instead of businesses and work. Meanwhile, increasing the Enterprise Finance Guarantee props up debt-laden business and a new Growth Capital Fund encourages capitalist businesses, while both appear useless to good co-ops at first glance. I don t mind being ignored, but could we please elect a government which doesn t actively hinder co-ops? Where s the fabled commitment to fairness ? Promises around the Green Investment Bank and Green Deal sound good, but are in the future.

Council Tax

Council Tax will be frozen for a year. I wonder if that applies to parish councils, because our village planned a cut after a one-year project-based increase last year. The Budget Document has pretty much no detail.

So, how was it for you? Have I missed some friendly changes?

Having invested in some introspection into my reading habits, I made up my mind to dial down my consumption of bite-sized nuggets of online information, and finish a few books. That s where my bottleneck has been for the past year or so. Not in selecting books, not in acquiring books, and not in starting books either. I identify promising books, I buy them, I start reading them, and at some point, I put them down and never pick them back up again. Until now. Over the weekend, I finished two books. I started reading both in 2009, and they each required my sustained attention for a period measured in hours in order to finish them. Taking a tip from Dustin, I decided to try alternating between fiction and non-fiction. Jitterbug Perfume by Tom Robbins This was the first book I had read by Tom Robbins, and I am in no hurry to read any more. It certainly wasn t without merit: its themes were clever and artfully interwoven, and the prose elicited a silent chuckle now and again. It was mainly the characters which failed to earn my devotion. They spoke and behaved in ways I found awkward at best, and problematic at worst. Race, gender, sexuality and culture each endured some abuse on the wrong end of a pervasive white male heteronormative American gaze. I really wanted to like Priscilla, who showed early promise as a smart, self-reliant individual, whose haplessness was balanced by a strong will and sense of adventure. Unfortunately, by the later chapters, she was revealed as yet another vacant vessel yearning to be filled by a man. She s even the steward of a symbolic, nearly empty perfume bottle throughout the book. Yes, really. Managing Humans by Michael Lopp Of the books I ve read on management, this one is perhaps the most outrageously reductionist. Many management books are like this, to a degree. They take the impossibly complex problem domain of getting people to work together, break it down into manageable problems with tidy labels, and prescribe methods for solving them (which are hopefully appropriate for at least some of the reader s circumstances). Managing Humans takes this approach to a new level, drawing neat boxes around such gestalts as companies, roles, teams and people, and assigning them Proper Nouns. Many of these bear a similarity to concepts which have been defined, used and tested elsewhere, such as psychological types, but the text makes no effort to link them to his own. Despite being a self-described collection of tales , it s structured like a textbook, ostensibly imparting nuggets of managerial wisdom acquired through lessons learned in the Real World (so pay attention!). However, as far as I can tell, the author s experience is limited to a string of companies of a very specific type: Silicon Valley software startups in the dot com era. Lopp (also known as Rands) does have substantial insight into this problem domain, though, and does an entertaining job of illustrating the patterns which have worked for him. If you can disregard the oracular tone, grit your teeth through the gender stereotyping, and add an implicit preface that this is (sometimes highly) context-sensitive advice, this book can be appreciated for what it actually is: a coherent, witty and thorough exposition of how one particular manager does their job. I got some good ideas out of this book, and would recommend it to someone working in certain circumstances, but as with Robbins, I m not planning to track down further work by the same author.

(This is partly a repost of material I've posted to bug reports and to debian-release, put together with some more detail for a wider audience.) You could be forgiven for looking at the RC bug activity on grub2 over the last couple of days and thinking that it's all gone to hell in a handbasket with recent uploads. In fact, aside from an interesting case which turned out to be due to botched handling of the GRUB Legacy to GRUB 2 chainloading setup (which prompted me to fix three other RC bugs along the way), all the recent problems people have been having have been duplicates of one of these bugs which have existed essentially forever:

• #554790 - grub-pc/install_devices uses unstable device names
• #583271 - device.map uses unstable device names

When GRUB boots, its boot sector first loads its "core image", which is usually embedded in the gap between the boot sector and the first partition on the same disk as the boot sector. This core image then figures out where to find /boot/grub, and loads grub.cfg from it as well as more GRUB modules. The thing that tends to go wrong here is that the core image must be from the same version of GRUB as any modules it loads. /boot/grub/*.mod are updated only by grub-install, so this normally works OK. However, for various reasons (deliberate or accidental) some people install GRUB to multiple disks. In this case, grub-install might update /boot/grub/*.mod along with the core image on one disk, but your BIOS might actually be booting from a different disk. The effect of this will be that you'll have an old core image and new modules, which will probably blow up in any number of possible ways. Quite often, this problem lies dormant for a while because GRUB happens not to change in a way that causes incompatibility between the core image and modules, but then we get massive spikes of bug reports any time the interface does change. Since these bugs sometimes bite people upgrading from testing to unstable, they get interpreted as regressions from the version in testing even though that isn't strictly true (but it tends not to be very productive to argue this line; after all, people's computers suddenly don't boot!). Any problem that causes the core image to be installed to a disk other than the one actually being booted from, or not to be installed at all, will show up this way sooner or later. On 2010-06-10, there was a substantial upstream change to the handling of list iterators (to reduce core image size and make code clearer and faster) which introduced an incompatibility between old core images and newer modules. This caused a bunch of dormant problems to flare up again, and so there was a flood of reports of booting problems with 1.98+20100614-1 and newer, often described as "the unaligned pointer bug" due to how it happened to manifest this time round. In previous cases, GRUB reported undefined symbols on boot, but it's all essentially the same problem even though there are different symptoms. The confusing bit when handling bug reports is that not only are there different symptoms with the same cause, but there are also multiple causes for the same symptom! This takes a certain amount of untangling, especially when lots of people have thought "ooh, that bug looks a bit like mine" and jumped in with their own comments. Working through this was a worthwhile exercise, as it came up with an entirely new cause for a problem I thought was fairly well-understood (thanks to debugging assistance from Sedat Dilek). If you had set up GRUB 2 to be automatically chainloaded from GRUB Legacy (which happens automatically on upgrade from the latter to the former), never got round to running upgrade-from-grub-legacy once you confirmed it worked, and then later ran grub-install by hand for one reason or another, then the core image you installed by hand would never be updated and would eventually fall over the next time the core/modules interface changed. Fixing future cases of this was easy enough, but fixing existing cases involved figuring out how to detect whether an installed GRUB boot sector came from GRUB Legacy or GRUB 2, which isn't as easy as you might think. Fortunately, it turns out that there are a limited number of jump offsets that have ever been used in the second byte of the boot sector, and none of the GRUB 2 values clash with the only value ever used in GRUB Legacy; so, if you still have /boot/grub/stage2 et al on upgrade, we scan all disks for a GRUB 2 boot sector, and if we find one then we offer to complete the upgrade to GRUB 2. Unless anything new shows up, that just leaves the problems that were already understood. Today, I posted a patch to generate stable device names in device.map by default. If this is accepted, then we can do something or other to fix up device.map on upgrade, switch over to /dev/disk/by-id names in grub-pc/install_devices at the same time, and that should take care of the vast majority of this kind of upgrade bug. I think at that point it should be feasible to get a new version into testing, and we should be down from 18 RC bugs towards the end of last month to around 6. We can then start attacking things like the lack of support for mdadm 1.x metadata. Since my last blog entry on GRUB 2, improvements have included:

• Substantial work on info grub, with, among other things, new sections on /etc/default/grub and on configuring authentication.
• A workaround for GRUB's inability to probe dm-crypt devices, thanks to Marc Haber.
• Several build fixes for architectures I wasn't testing, and a fix for broken nested partition handling on Debian GNU/kFreeBSD. I'm now testing GNU/kFreeBSD locally.
• Rather less cruft in fs.lst, partmap.lst, and video.lst, which should speed up booting a bit by e.g. avoiding unnecessary filesystem probing.
• upgrade-from-grub-legacy actually now installs GRUB 2 to the boot sector (!).
• Ask for confirmation if grub-pc/install_devices is left empty.

The next upstream snapshot will bring several improvements to EFI video support, mainly thanks to Vladimir Serbinenko. I've been working on making grub-install actually work on UEFI systems as one of my goals for the next Ubuntu release, and I hope to get this landed in the not-too-distant future.

again, a short overview regarding my RC bug activities:

• #462810 liballegro4.2: "liballegro4.2: alsa plugin doesn't work with many sound cards"
  apply patch from BTS and upload to DELAYED/2
• #535260 libdbd-oracle-perl: "Does not work anymore with instantclient 11.1"
  upload new upstream release prepared by JuNix (pkg-perl)
• #573078 gtkvncviewer: "Doesn't start without gnome-keyring"
  add missing dependency and upload to DELAYED/2
• #576463 pulseaudio: "pulseaudio: Support tmpfs /var/run"
  investigate and add a comment to the BTS
• #578458 src:libcoro-perl: "libcoro-perl: FTBFS: E: Caught signal 'Terminated': terminating immediately"
  more trial-and-error "debugging" (pkg-perl)
• #581552 vtun: "vtun: want ipv6 support"
  apply patch from BTS and upload to DELAYED/2 (later downgraded to wishlist but I left the NMU with maintainer's permission)
• #583072 libgnupg-perl: "libgnupg-perl: Hangs on test"
  fix unrelated packaging problem and upload the patched package (pkg-perl)
• #583463 src:libmoosex-types-structured-perl: "libmoosex-types-structured-perl: FTBFS: tests failed"
  upload new upstream release prepared by Ansgar (pkg-perl)
• #583985 upse: "upse: FTBFS against audacious 2.3"
  grab patch from Ubuntu and upload to DELAYED/2
• #584377 src:libtest-valgrind-perl: "libtest-valgrind-perl: FTBFS: tests failed"
  add comment to the BTS and tag (pkg-perl)
• #584391 src:libdbix-class-perl: "libdbix-class-perl: FTBFS: tests failed"
  upload new upstream release prepared by Ansgar (pkg-perl)
• #584910 ftp.debian.org: "RM: libgtk2-sexy-perl -- ROM; obsolete, no rdeps"
  RM (pkg-perl)
• #585468 jifty: "jifty: license of */share/web/static/js/json.js is considered non-free"
  replace non-free json.js with a free alternative (pkg-perl)
• #585744 zoneminder: "zoneminder: FBTFS (sid cowbuilder chroot, i386)"
  file new FTBFS bug

Turns out that the football is insufficiently engaging to distract me from picking up the laptop, but sufficiently noisy that I don't get time to think about more complex problems (leave those for weekday evenings), so weekends seem to offer a brief window to relax and do some QA/RC uploads.

As we're not yet in freeze, I'm not doing 0-day NMU's (although I am offering 7 day NMU's), but QA uploads can all be 0-day. Overall, it's proving to be quite useful and a lot easier than sponsoring NEW packages.

So far, RC uploads:

• 572464: ceferino


• 572470: gregorio

RC offers:

• 582422 : bacula


• 579378 :dibbler

QA uploads:

• gnome-pilot


• gnome-pilot-conduits


• rezound


• filerunner


• cdcover

Didn't think I'd get time to stuff like that with Squeeze.

I have announced the Debian Community Poll in my former blog post. I have closed the poll today and I will start publishing its results now.
What is the codename of the current stable release?This is the only compulsory question with the intention to block spammers. The correct codename is Lenny but I have accepted almost any answer that is somehow related to Debian. Version numbers, names from Sarge to Experimental, even well known codenames and version numbers from Ubuntu have been counted as correct. 22 partipants answered wrongly and their submissions got removed from the result set. A whopping number of 3258 submissions have been accepted and get analyzed now. Thanks to all participants!
How long have you been using Debian?

• 33.6% answered 6 - 10 years
• 32.7% answered 2 - 5 years
• 16.6% answered more than 10 years
• 15.5% answered 0 - 2 years
• 1.7% did not answer

On what kind of hardware are you using Debian?
Multiple answers are allowed for this question and that is why the values do not sum up to 100%.

• 80.5% are using Debian on the desktop
• 62.4% on the server
• 56.9% on the notebook
• 21.7% on the netbook
• 11.6% on embedded device(s)
• 3.2% on other device(s)

The following other devices have been mentioned: smartphone, virtual machine, nettop, NAS, HTPC, workstation, pendrive, live cd, cluster, thin client, router, rocket flight computer, ibm mainframe, and automatic bar tender.

Do you contribute to Debian?

• 50.0% choose answer #5: I don't contribute on a regular base.
• 31.2% choose answer #4: I'm regularly helping other Debian users.
• 8.0% choose other (see below) or simply did not answer
• 4.9% choose answer #3: I'm regularly contributing to Debian packages without uploading them by myself.
• 4.5% choose answer #1: I'm a Debian developer.
• 1.4% choose answer #2: I'm a Debian maintainer.

The following other answers have been provided:

• upstream developer or contributor
• translator
• bug reporter
• advocator
• former DD or DM
• prospective DD or DM
• mirror maintainer
• package/installer tester
• documentation writer
• donator or debconf sponsor
• debconf organizer or helper

How do you think about the Debian Free Software Guidelines (DFSG)?

• 46.0% choose answer #2: I like the DFSG but it is not the most important reason for using Debian.
• 36.6% choose answer #1: The DFSG is very important to me. I could live with many changes in Debian but I would be very upset if Debian would allow non-free software into its main component in the future.
• 10.1% choose answer #3: I don't know.
• 4.9% choose answer #4: I don't care.
• 2.4% did not answer.

Are you using Debian derived distributions, too?
Multiple answers are allowed for this question and that is why the values do not sum up to 100%. There were a lot of different answers but the most frequent are:

• 47.1%: Ubuntu (Kubuntu, Lubuntu, Xubuntu)
• 40.8%: no answer; this was the only way to say that someone does not use a derived distribution
• 11.0%: other (see below)
• 7.0%: damn small linux
• 4.8%: Sidux
• 4.3%: grml (juxlala)
• 2.2%: Knoppix
• 1.6%: ELive
• 1.4%: Maemo

The other answer includes the following distributions: 64studio, ALT Linux, arch linux, ArtistX, BackTrack, BRLix, Canaima GNU/Linux, catix, cdlinux.pl, CloneZilla, CrunchBang, Custom, ddwrt, debian arm userspace for zipit z2, DebXO (?), DreamLinux, Easy Peasy, eb4, eeebuntu, EMC2 Ubuntu (linuxcnc.org), Emdebian, Estrella Roja, Fedora, Finnix, Gentoo, gNewSense, Hackable:1, Kanotix, Kuliax, LFS and CLFS, LinEx, Linux Mint, live CDs, live-helper, Mepis antix, Musix, My own LiveCD, Mythbuntu, OpenInkpot, openwrt, paipix gnu, Parsix, Peppermint, personal debian derived, proxmox, Puppy, PureOS, qtopia, SHR, simplyMEPIS, Skolelinux, slackware, SymphonyOS, Toutou, Trisquel, tty GNU/Linux, UHU Linux, Univention Corporate Server, vinux, Voyage, Vyatta, whiite, Xandros, Xarnoppix. Not all of them are derived from Debian.

- to be continued -

"stat" is "date +format" for files:

$ stat -c %s ~/me.jpg  # size
520073
$ stat -c %U ~/me.jpg  # owner
cbe

No more parsing of "ls" output or similar hacks. It also shows detailed information about files.

$ stat ~/me.jpg
  File:  /home/cbe/me.jpg 
  Size: 520073          Blocks: 1024       IO Block: 4096   regul re Datei
Device: fe03h/65027d    Inode: 12427268    Links: 1
Access: (0600/-rw-------)  Uid: ( 2062/     cbe)   Gid: ( 2062/     cbe)
Access: 2010-06-06 12:58:07.000000000 +0200
Modify: 2010-04-09 22:38:46.000000000 +0200
Change: 2010-04-26 14:18:00.000000000 +0200

It supports similar features for stat'ing filesystems.

Recently, I started to write some web tool to track the status of ongoing transitions in unstable. I thought I could use some code from the Buildd status project (to see how it fetches the status for each package). Unfortunately, this caused some nightmares for some WB admin (because they used to rely on the generated BDB files and not the PGSql database, where the former is a snapshot of the latter stored in a funny format). Those BDB files were considered deprecated and status pages were looking for some love. Besides, the BDB files were kept in sync by regenerating them regularly (every 15 minutes, AFAIK). So, the information stored there was up-to-date only for a couple of seconds and then outdated, waiting for the next run to be updated. Last weekend, I rewrote the status pages from scratch to make them use the PGSql database. I kept the same user interface (and pages arguments) to make it a drop-in replacement for the old one. Today, thanks to the WB admins, the new status pages replaced the old ones! There are no new visible features for now (except the backend and some links) but I have a list of new features that I intend to implement. These new features will be implemented in my local copy first and then integrated if WB admins want them. And, as some of you already noticed, the new status pages are aware of non-free packages (because it happens that the data is present in the PGSql database thank WB admins for that!).

After more than 9 months from the previous release, the Bash Completion Team is proud to announce the release of bash-completion 1.2! In this release, we dropped support for bash < 3.2. We're sorry, but we cannot stop development just to support versions that old. By now, everyone should have a version fulfilling our requirement. As usual, lots of completions have been added: we're now at 168 files in our contrib/ directory (1.1 had 145, and 1.0 had 44 -- but most completions in 1.0 were bundled in the main file). Now bash_completion only contains helper functions, and basic filename-based completions. Everything has moved to contrib/! This release also saw the contribution of many external people, despite the fact that our bugtracker on Alioth doesn't seem to work too well (problem with attachments, anyone?). Anyhow, you're invited to register and start filing bugs as you find them :). Apart from the usual team members (Ville Skytt , Freddy Vulto, the newcome Leonard Crestez and me), we've had contributions from (in no particular order): Ted Stern, Jeremie Lasalle Ratelle, Rapha l Droz, Adrian Friedli, Ildar Mulyukov, Neville Gao, Austin English, Igor Murzov, Mario Schwalbe and Mark van Rossum. Thank you people for helping us! For completion developers: we added new helper functions. Most notably, it's now possible to get the current and the previous "word" just by calling:

_get_comp_words_by_ref cur prev

instead of (up to 1.1):

cur=$(_get_cword) prev=$ COMP_WORDS[COMP_CWORD-1]

Also, we have a new helper to deal with completion with colons, __ltrim_colon_completions(). See the comment in bash_completion for its documentation. You'll find more helpers directly in bash_completion. We're still far from having a distributable API documentation, so please forgive us. Enjoy the new bash-completion! -- David

My project. This post assumes that the reader has read my last post. This was a week full of segfaults, failed assertions, changes in the user data and other crazy stuff. I started working on the allocation of memory on the freed lines. In the first glance, it seemed to be much harder than the small changes I ve done to free memory in lines, because of the a never-seen-before-by-me datatypes being dealed with in alloc_for_copy(), from rts/sm/Evac.c: gen_workspace. But in a short time the code of alloc_for_copy() has shown itself to be simple, and it was easy to do an initial implementation. I went in the same path I was going on before, trying the simplest solution that works. For instance, the line representation used is not ideal, because groups of lines are not considered, but it was the simplest at that time, and I plan to improve it latter. The gen_workspace data type contains a pointer to an area of a block that is not being used (todo_free) and a pointer to the end of that area (todo_lim). When a space for an object is requested, it s allocated in this area, and todo_free is adjusted. If the area is full, a new block is requested. My intended change was to return the first free line of the generation when the object is smaller or equal to the size of a line, and use the current approach otherwise. This is the simplest way I could think, but has the problem that the only one object is allocated per line. This was a known issue.

    if(size <= BITS_IN(W_) && gen->first_line != NULL)  
        to = gen->first_line;
        gen->first_line = (StgPtr) *gen->first_line;
        return to;
     
    ws = &gct->gens[gen->no];

After that I got the first round of segfaults. One problem I could spot so far was in the code in rts/sm/Sweep.c, related to the liberation of the lines. The block is allocated by need, and there s a pointer to the first free byte, free. This free space is used by alloc_for_copy(). So, we should only think of lines in the region already allocated in the block, that is, where the address is smaller than free.

                    if(bd->u.bitmap[i] == 0 && bd->u.bitmap[i - 1] == 0 &&
                       start + BITS_IN(W_) <= bd->free)

But the segfaults, memory corruptions, etc, kept going on. I tried some restrictions, like allocating in lines only objects with the exact size of a line, or very small objects (size == 2), or allocating just one object for generation, or only one object at all. I also tried checking for the type of the allocated object, to see a correlation with the problems I was having. Nothing helped by now. So I thought I should work on other things, so that maybe my mind gets clearer and I can spot the problem. I followed the suggestion of using todo_free and todo_lim to make it possible to allocate more than one object in a line. I liked this change, since I had the impression that it fits better with the rest of the code than the initial implementation, and it will be easier to addapt it when I improve the representation of the free lines. As I said, I wanted something to work while I think in how I ll solve the segfault problems. The bad side of this choice is that I ll not be able to test it, since it s just a reimplementation of the same idea in the allocation code, and is not expected to work. The good size is that it may work, and solve the problems I was having by accident.

    if (ws->todo_free > ws->todo_lim)  
        if (size <= BITS_IN(W_) && gen->first_line != NULL)  
            ws->todo_free = gen->first_line;
            gen->first_line = (StgPtr) *gen->first_line;
            to = ws->todo_free;
            ws->todo_lim = ws->todo_free + BITS_IN(W_);
          else  
            to = todo_block_full(size, ws);
         
     

I got the same results as with the older implementation, and no ideas about how to solve it (yet). So I thought about another thing to work on, which I m talking about all through this post: improve the free line representation. This has the advantage of being testable, since it s unrelated to the allocation code, and may give me an idea about how I can fix the segfaults. The bad side is that it probably won t fix my problems directly. I m working on it right now.

---

Following a suggestion, I ve started using gdb to see what was happening in the GC instead of including printfs everywhere, and it s been useful. I ve noticed that sometimes printf is more effective, but sometimes gdb is much better.

Just going on how they treat matters regarding the internet, it seems that the current Australian government is trying to beat the previous government's poor record. Where the previous government seemed to think the internet a scary and unimportant thing that they didn't really understand and therefore ignored it, the current government seems to be trying to do something, but like a lot of other things they do, do something badly.

Internet Filtering
One of their bright ideas is to censor the internet, by putting some rather large filters right in the middle of all the ISPs. Supposedly this is going to protect the children, though other than some mad ranting by Senator Conroy he hasn't said which children or how.

The clearest information is that it will block Refused Content or RC rated information. The problem with this is there is no clear definition what this is. With no clear boundary you can get what is "scope creep". Bit by bit, each group with their own agenda will try to get whatever they don't like banned. Some will fail, but others will get their little set of demons onto the list.

From "children overboard" to the strange siezure of the wikileaks founder's passport when he returned to Australia, you can never trust the government fully. As the filter list will be a closed list, who is to say if it is right a particular webpage or website should be banned? Books or films that are banned are known, you can find out what they are and why. A proper discussion and review can then be undertaken. By contrast, you won't even know something is banned unless you try to visit it.

I've personally seen the "great firewall of china". What is filtered is often arbitary, though anything that is embarassing to the government is filtered. It slows a lot of sites down and makes others look strange. Do you really what to live in a country where the government decides what ideas should be seen? Or even a country that places like China can point to and say they are doing the same thing, so its all ok?

Data Retention
The next bright idea by the government is to make ISPs keep 10 years of internet browsing history of all their users. This would be like tapping everyone's phone, just in case you did something wrong in the next 10 years.

There hasn't been much detail about this proposal but let's assume for a moment that it keeps URLs. Now of course most people's internet addresses move around, so you will also need to keep some sort of log of which account used what address for the same time.

The URLs will tell the government which websites you have visited, but URLs also tell them which pages you visited. You can also often assume which pages you read and which you didn't because of the time between this viewed page and the next.

Search engine queries are also encoded into a url. Google searches usually have something at the end of the url which is what you were searching for. There is also a chain of visited pages, so someone looking at a log could see your search, you go to a site, perhaps you then visit a banking or paypal site (have you bought something now?)

Even if you think you have nothing to worry about what the government might do with this information, including future governments, this information has to sit somewhere. Data sitting around for 10 years has 10 years time of being stolen or copied. Perhaps some activists obtain this log and publish a list of names of people who visited a particular website.

There is current laws for lawful interception. This is where the police or another security agency goes to the court and says a particular person has done certain bad things and asks if they can intercept their internet traffic. It's the same rules if they want to tap your phone. Except for "fishing trips" where police just randomly look at information from anyone hoping to trip up on something, what is this system going to be used for?

What can you do?
If you're not happy about either, or both, of these new proposals, it is time to do something about it. Visit the website Open Internet Website for what you can do. One of the things is to

Related articles by Zemanta

• Censorship Down Under (spectrum.ieee.org)
• China Says Will Keep Blocking Online Content (abcnews.go.com)
• Australian Censorship Minister Claims People Under Attack From "Spams Through The Portal" (inquisitr.com)
• Australian Gov't Seeks To Record Citizens' Web Histories (yro.slashdot.org)

As you have probably already seen, I started again to publish the statistics of the release critical bug reports. I stopped to do so, when I restarted to send out the Debian Project News, where they are also a regular part. However I've been told, that quite some readers script the last part of the DPN with the regular things, like DSAs, New and Noteworthy packages, etc., as they already know them. So here they are again, published every Friday noon (CEST) by a tiny script. Update: Moritz Muehlenhoff just informed me, that I should also ingore RC bugs having the tag security for my statistics, as they come in all over the time and can always be fixed with a security update or in a point release. Currently 34 bugs have this tag, bringing the total number of bugs to be delat with down to 187.

It s widely regarded that passwords should be changed regularly. The Australian government declared last week the National Cyber Security Awareness Week [1] and has published a list of tips for online security which includes Get a stronger password and change it at least twice a year . Can a Password be Semi-Public? Generally I think of a password as being either secret or broken. If a password is known to someone other than the sysadmin and the user who is authorised to use the account in question then you have potentially already lost all your secret data. If a password is disclosed to an unauthorised person on one occasion then merely changing the password is not going to do any good unless the root cause is addressed, otherwise another anothorised person will probably get the password at some future time. Hitachi has published a good document covering many issues related to password management [2]. I think it does a reasonable job of making sysadmins aware of some of the issues but there are some things I disagree with. I think it should be used as a list of issues to consider rather than a list of answers. The Hitachi document lists a number of ways that passwords may be compromised and suggests changing them every 60 to 90 days to limit the use of stolen passwords. This seems to imply that a password is something that s value slowly degrades over time as it s increasingly exposed. I think that the right thing to do is to change a password if you suspect that it has been compromised. There s not much benefit in having a password if it s going to be known by unauthorised people for 89 days before being changed! Fundamentally a password is something that can have it s value rapidly drop to zero without warning. It doesn t wear out. Why are terms such as Three Months used for Maximum Password Ages? The Hitachi document gives some calculations on the probability of a brute-force attack succeeding against a random password with 90 days of attacking at a rate of 100 attempts per second [2]. I think that if a service is run by someone who wouldn t notice the load of 100 attempts per second then you have bigger security problems than the possibility of passwords being subject to brute-force attacks. Also it s not uncommon to have policies to lock accounts after as few as three failed login attempts. Rumor has it that in the early days of computing when the hashed password data was world readable someone calculated that more than 3 months of CPU time on a big computer would be needed to obtain a password by brute-force. But since then the power of individual CPUs has increased dramatically, computers have become cheap enough that anyone can easily gain legal access to dozens of systems and illegal access to a million systems, and it has become a design feature in every OS that hashed passwords are not readable by general users. So the limiting factor is to what degree the server restricts the frequency of password guesses. I don t think that specifying the minimum password length and maximum password age based on the fraction of the key space that could be subject to a brute-force attack makes sense. I don t think that any attempt to make an industry-wide standard for the frequency of password changes (as the government is trying to do) makes sense. Can there be a Delay between a Password being Compromised and being Used by an Attacker? Hypothetically speaking, if a password was likely to be compromised (EG by having the paper it was written on lost or stored insecurely) for some time before an attacker exploited it, then if the password was changed during that time period it could solve the problem. For example when a company moves office there is the possibility of notepaper with passwords to be lost. So if the sysadmin caused every user password to expire at the time of the move then a hostile party would be unable to gain access. Another possibility is the theft of backup tapes that contain the list of unencrypted passwords. If users change their passwords every three months then the theft of some four month old backup tapes will be less of a problem. Another possibility concerns the resale of old computers, phones, and other devices that may contain passwords. A reasonably intelligent user won t sell their old hardware as soon as the replacement device arrives, they will want to use the new device for some time to ensure that it works correctly. If passwords expire during this trial period with the new device then passwords stored in the old device won t have any value. The down-side to this idea is that people probably sell their old gear fairly quickly and making passwords expire every two weeks would not be accepted well by the users. It seems to me that having bulk password changes (all passwords for one user or for one company) based on circumstances that lead to potential insecurity would do more good than changing passwords at a fixed schedule. How are Passwords typically Compromised? Dinei Flor ncio and Cormac Herley of Microsoft Research and Baris Coskun of Brooklyn Polytechnic University wrote a paper titled Do Strong Web Passwords Accomplish Anything? [3] which discusses this issue. The first thing that they note is that nowadays passwords are most commonly compromised by phishing and keylogging. In those cases passwords are typically used shortly after they are stolen and the strength of a password never does any good. That paper suggests that banks should use stronger user-names rather than stronger passwords to combat the threat of bulk brute-force attacks. Can a Password Last Forever? If a password is entered in a secure manner, authenticated by a secure server, and all network links are encrypted or physically protected then there should never be a need to change it. Of course nothing is perfectly secure, so for some things with minimal short-term value or which can be used without anyone noticing there is a benefit in changing the password. But in the case of Internet banking if a hostile party gets your login details then you will probably know about it in a few days when the bank calls you about the unusual transactions from foreign countries long before a 90 day password change schedule would have done any good. Maybe one of the issues determining whether a password should be changed regularly is whether an attacker could use long-term read-only access to gain some benefit. Being able to read all the email someone received for a year could be a significant benefit if that person was a public figure, and there s usually no way for an ISP customer to know that someone else is downloading all their mail via POP or IMAP. Should a Password be the only Authentication Method? It is generally agreed that an authenitcation method should ideally involve something you have plus something you know. That means a password and a physical device such as a smart card, token with a changing sequential password, or a key such as a Yubikey [4]. If the physical device can t be cloned (through some combination of technical difficulty and physical access control) then it significantly improves security. When a physical device is used the purpose of the password is merely to stop someone who steals the physical device from being immediately exploit everything the password only has to be strong enough to keep the accounts secure until a new token can be issued. The combination of something you have and something you know is very strong. Having a physical token stored on the desk next to the PC that is used for logging in provides a significant benefit, then an attacker needs to break in to the house and can t sniff the password by compromising the PC remotely. Conclusion In all aspects of security you need to consider what threats you face. If an attacker is likely to launch an immediate noisy attack (such as transferring the maximum funds out of an Internet banking account) then changing the password regularly won t do any good. If a subtle long-term attack is expected then changing the password can do a lot of good but a physical token is the ideal if the account is valuable enough. But to put things in to perspective, it s technically possible to use a mobile phone camera at close range (or a SLR with a big lens at long range) to take a photo of keys that allow reproducing them. But this hasn t stopped people from carrying their house keys in an obvious manner that permits photography or leaving them on their desk at work. Also I ve never heard of anyone routinely changing the door locks in case a hostile party might have got a key although I m sure that such practices are common in highly secure locations. Few people even take their house keys off the key-ring when they have their car serviced! Related Posts Defense in Depth and Sudo when using sudo can increase security and when it can t.
Logging Shell Commands how to log what the sysadmin does and what benefits that provides you, it doesn t help if the sysadmin is hostile.
Logging in as Root should you login directly as root?

• [1] http://www.staysmartonline.gov.au/news/news_articles/feature/national_cyber_security_awareness_week
• [2] http://psynch.com/docs/password-management-best-practices.html
• [3] http://www.usenix.org/event/hotsec07/tech/full_papers/florencio/florencio.pdf
• [4] http://etbe.coker.com.au/2010/03/15/yubikey/

I have been recently approached by several friends, from different countries. Mexico and the violence seems to be a frequent news topic all over the world. I live in Mexico City, as ~25% of the country's population does. This is not an easy city, of course, and I won't deny it has tons of problems of its own. However, Mexico City (and even more so the approximately of it that is politically located in Distrito Federal, the formal country capital) is very lucky in this regard. Still, in most of the country, the violence is mostly in the news, mostly a worrying perception that is every day more insistent. My parents live in Cuernavaca, Morelos, ~80Km south from us. Morelos has been known for decades for being the druglords' getaway and safe haven, so it remained a mostly peaceful state for most of this time. This has changed, and at some points during this year, militarization feels quite creepy... Fortunately, just for a couple of weeks, and then back to what seems like normal. The real problems in Morelos is the undeniable corruption of its successive governments, the lack of regard for the population, the inexistent urban planning... However, I know from several friends living in the North of the country (and all along the very long border - The most drug-related violent states nowadays are Chihuahua, Durango, Sinaloa, Tamaulipas and Nuevo Le n, with only two states in the South Michoac n and Guerrero) that violence is really felt by local population on the streets. Some friends say they have grown used to hearing shootings (Durango), others say that it is now usual that the cartels openly strangle the city's vial system with the express purpose of showing off their strength (Monterrey, Nuevo Le n, one of Mexico's most important cities and taken in the past as a token of industrialization and first-world-like life conditions... Just don't look towards the poor areas). About Chihuahua, I'd rather not even talk, as by all accounts (official even) it rivals Iraq in the lack of control the government has of its territory. Still, with all that as background... I am afraid of what I read today in the news. I know a single declaration is not enough to worry about (as said in El Quijote, una golondrina sola no hace verano , a single swallow does not mean it's summer), but those things always start small... Until they explode. La Jornada reports that The retired general Luis Garfias Maga a recommends suspending constitutional guarantees in the country to be able to properly fight violence. The last century we had a sad and long history of cases where the military took over civilian power and suspended the constitutional rights in basically every nation in Latin America Except for Mexico. Not one of those cases was overall successful. Not one of them went by without raging abuses, without terrible consequences. I don't see imminent we will go over to a military rule nor anything close to it, but the environment is getting each time closer to how it was like before said rights suspension. We should learn that it is just not the way, it leads nowhere. I am convinced, and will keep insisting on it at every ocassion, that the only possible way to fight violence is by reducing the social distance, and that should be achieved most importantly by reducing poverty, but also by making it harder to become incredibly rich. Mexico's percentage of poor people has grown over the last decades, but at the same time, the amount of wealth concentrated in very few hands has grown much faster. A society with terribly rich and terribly poor people leads to hatred, leads to desperation, leads to violence. A flatter society, even if the overall standard was to be somewhat lower, tends to a better equilibrium. And yes, I know the original problem with drugs is that Mexico is a great transit area for drugs to reach the USA (and I could also rant about drug legalization I won't, it's late and I must go to work), but the main fuel for young people to leave everything behind and take the risk of starting a life of open ilegality is the lack of future they face all life long. That leads many to risk their lives attempting to cross the border to the USA (Mexico "exports" 500,000 people every year), but also lures them to jobs where they will have easy money... In exchange for their lifes, ultimately. Anyway... Just to repeat and round off: The answer to this problem is not repression, is not policial or military strength. Our only way out is through social justice.