Search Results: "cas"

16 March 2011

Daniel Kahn Gillmor: CryptLib and the OpenSSL License

I spent part of today looking at packaging Peter Gutmann's CryptLib for debian. My conclusion: it may not be worth my time. One of the main reasons i wanted to package it for debian is because i would like to see more OpenPGP-compliant free software available to debian users and developers, particularly if the code is GPL-compatible. Cryptlib makes it quite clear that it intends to be GPL-compatible:
cryptlib is distributed under a dual license that allows free, open-source use under a GPL-compatible license and closed-source use under a standard commercial license.
However, a significant portion of the cryptlib codebase (particularly within the bn/ and crypt/ directories) appears to derive directly from OpenSSL, and it retains Eric Young's copyright and licensing. This licensing retains the so-called "advertising clause" that is generally acknowledged to be deliberately incompatible with the GPL. (A common counterargument for this incompatibility is that OpenSSL should be considered a "System Library" for GPL'ed tools that link against it; whether or not you believe this for tools linked against OpenSSL, this counterargument clearly does not hold for a project that embeds and ships OpenSSL code directly, as CryptLib does) This does not mean that CryptLib is not free software (it is!), nor does it mean that you cannot link it against GPL'ed code (you can!). However, you probably can't distribute the results of linking CryptLib against any GPL'ed code, because the GPL is incompatible with the OpenSSL license. The un-distributability of derived GPL-covered works makes the CryptLib package much less appealing to me, since i want to be able to write distributable code that links against useful libraries, and many of the libaries i care about happen to be under the GPL. I also note that Peter Gutmann and CryptLib Security Software (apparently some sort of company set up to distribute CryptLib) may be in violation of Eric Young's License, which states:
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    "This product includes cryptographic software written by
 *     Eric Young (eay@cryptsoft.com)"
 *    The word 'cryptographic' can be left out if the rouines from the library
 *    being used are not cryptographic related :-).
A Google search for Eric Young's name on cryptlib.com yields no hits. I do find his name on page 340 of the Cryptlib manual, but that hardly seems like it covers "All advertising materials mentioning features or use of this software". I suppose it's also possible that CryptLib has negotiated an alternate license with Eric Young that I simply don't know about. In summary: i think CryptLib could go into debian, but its incorporation of OpenSSL-licensed code makes it less useful than i was hoping it would be. I have a few other concerns about the package after looking it over in more detail. I suspect these are fixable one way or another, but i haven't sorted them out yet. I'm not sure i'll spend the time to do so based on the licensing issues i sorted out above. But in case anyone feels inspired, the other concerns i see are:
embedded code copies
In addition to embedded (and slightly-modified) copies of bn/ and crypt/ from OpenSSL, CryptLib contains an embedded copy of zlib. Debian has good reasons for wanting to avoid embedded code copies. I've got it CryptLib building against the system copy of zlib, but the bits copied from OpenSSL seem to be more heavily patched, which might complicate relying on the system version.
executable stack
lintian reports shlib-with-executable-stack for the library after it is built. I don't fully understand what this means or how to fix it, but i suspect it derives from the following set of object files that also have an executable stack:
0 dkg@pip:~/src/cryptlib/cryptlib$ for foo in $(find . -iname '*.o'); do
>  if ! readelf -S "$foo"   grep -q .note.GNU-stack ; then
>   echo "$foo"
>  fi
> done
./shared-obj/desenc.o
./shared-obj/rc5enc.o
./shared-obj/md5asm.o
./shared-obj/castenc.o
./shared-obj/bfenc.o
./shared-obj/rmdasm.o
./shared-obj/sha1asm.o
./shared-obj/bn_asm.o
./shared-obj/rc4enc.o
0 dkg@pip:~/src/cryptlib/cryptlib$ 
They probably all need to be fixed, unless there's a good reason for them to be that way (in which case they need to be documented).
non-PIC code
lintian reports shlib-with-non-pic-code on the library after it is built. I don't fully understand what this means, or how to resolve it cleanly, but i imagine this is just a question of sorting out the details.
Anyone interested in using my packaging attempts as a jumping off point can start with:
git clone git://lair.fifthhorseman.net/~dkg/cryptlib
Oh, and please correct me about anything in this post; I'd be especially happy to hear that my analysis of the licensing issues above is wrong :) Tags: cryptlib, gpl, licensing, openssl

15 March 2011

David Welton: Coming Soon: Easy Kindle Publishing with LiberWriter.com

The Kindle isn't the most beautiful device out there - it's not "beautiful", the keyboard takes away some elegance, but I'm absolutely smitten with mine. I like to read, a lot, and being able to instantly beam books to my house is just fantastic. Kindles and other devices like them are also changing the world of publishing, going from the known world of physical books that can't be easily copied to another information good like movies or songs with something of an uncertain future. Yet they're also opening up many possibilities: thanks to Amazon's Kindle Direct Publishing program, it just got very easy to publish books to a platform that a lot of people regularly search for good things to read. Once upon a time, "vanity publishing" was something done by those who simply wanted to see their names in print, but couldn't actually find a publisher, and thus carried some stigma. Now, though, why not publish something you've always wanted to? Granted, without an editor, and publisher to promote your work, you probably won't become rich or famous, but many people write for the enjoyment of doing so. And who knows... there are already several cases of people publishing directly to the Kindle and making a decent income at it. Indeed, I have several things I'm thinking of writing about that clicked when I found the Kindle publishing program. Maybe now it's time to dust off some ideas I've had and start working on them a little bit at a time. Then, of course, my geeky side took over and I started wondering how the mechanics of it actually work. Messily, it turns out: the preferred format for Kindle authoring is variant of HTML that's not at all what we're used to in these days of ever more potent CSS. The good side of it is that books mostly come out looking the same on the Kindle, and the end user can control how they want to visualize them. The bad side of the system utilized is that there are a lot of tips and tricks and little things to know about the whole process that can be annoying even for someone who knows HTML pretty well. For someone who just wants to write stuff and not worry about it, and who perhaps is not very familiar with HTML, the whole thing can be a huge mess and very frustrating. Which of course looks like an interesting challenge. I set out to work on LiberWriter.com several weeks ago, and it should be ready within the next week or two. In short, it's a system that lets you concentrate on writing and, as much as possible, tries to get out of your way in order to let you concentrate on your content. It is also targeted very specifically at the Kindle (for the time being at least), so as to really focus on making things work on that platform. For instance, it can automatically generate a table of contents, a noted pain point in writing for the Kindle. I have a number of other ideas up my sleeve too, that I'm excited to work on. I'm also definitely abandoning the "let's release it for free, for fun, and see if I can find a way to make money later" model of many past projects, and treating it like a business. I think the price I have in mind is very competitive, if you look at, for instance, conversion services that take word and spit out Kindle-specific HTML. Anyway, have a look at the site and sign up if you're interested: as soon as it's ready, I'll email and let you know. There'll be a somewhat limited trial version so that you can play around with it and see if you like it before buying the full version.

14 March 2011

Mike Hommey: Avoiding dependencies upon recent libstdc++

Mozilla has been distributing Firefox builds for GNU/Linux systems for a while, and 4.0 should even bring official builds for x86-64 (finally, some would say). The buildbots configuration for these builds uses gcc 4.3.3 to compile the Firefox source code. With the C++ part of gcc, it can sometimes mean side effects when using the C++ STL. Historically, the Mozilla code base hasn t made a great use of the STL, most probably because 10+ years back, portability and/or compiler support wasn t very good. More recently, with the borrowing of code from the Chromium project, this changed. While the borrowed code for out-of-process plugins support didn t have an impact on libstdc++ usage, the recent addition of ANGLE had. This manifests itself in symbols version usage These are the symbol versions required from libstdc++.so.6 on 3.6 (as given by objdump -p): And on 4.0: This means Firefox 4.0 builds from Mozilla need the GLIBCXX_3.4.9 symbol version, which was introduced with gcc 4.2. This means Firefox 4.0 builds don t work on systems with a libstdc++ older than that, while 3.6 builds would. It so happens that the system libstdc++ on the buildbots themselves is that old, which is why we set LD_LIBRARY_PATH to the appropriate location during tests. This shouldn t however be a big problem for users. Newer gcc, new problems As part of making Firefox faster, we re planning to switch to gcc 4.5, to benefit from better (as in working) profile guided optimization, and other compiler improvements. We actually attempted to switch to gcc 4.5 twice during the 4.0 development cycle. But various problems made us go back to gcc 4.3.3, the main contender being the use of even newer libstdc++ symbols: GLIBCXX_3.4.14 was added in gcc 4.5, making the build require a very recent libstdc++ installed on users systems. As this wouldn t work for Mozilla builds, we attempted to build with -static-libstdc++. This options makes the resulting binary effectively contain libstdc++ itself, which means not requiring a system one. This is the usual solution used for builds such as Mozilla s, that require to work properly on very different systems. The downside of -static-libstdc++ is that it makes the libxul.so binary larger (about 1MB larger). It looks like the linker doesn t try to eliminate the code from libstdc++ that isn t actually used. Taras has been fighting to try to get libstdc++ in a shape that would allow the linker to remove that code that is effectively dead weight for Firefox. Why do we need these symbols? The actual number of symbols required with the GLIBCXX_3.4.14 version is actually very low: With the addition of the following on debug builds only: The number of symbols required with the GLIBCXX_3.4.9 version is even lower: It however varies depending on the compiler version. I have seen other builds also require std::ostream& std::ostream::_M_insert(double). All these are actually internal implementation details of the libstdc++. We re never calling these functions directly. I m going to show two small examples triggering some of these requirements (that actually generalize to all of them). The case of templates
#include <iostream>
int main()  
    unsigned int i;
    std::cin >> i;
    return i;
 
This example, when built, requires std::istream& std::istream::_M_extract<double>(double&), but we are effectively calling std::istream& operator>>(unsigned int&). It is defined in /usr/include/c++/4.5/istream as:
template<typename _CharT, typename _Traits>
class basic_istream : virtual public basic_ios<_CharT, _Traits>  
    basic_istream<_CharT, _Traits>& operator>>(unsigned int& __n)  
        return _M_extract(__n);
     
 
And _M_extract is defined in /usr/include/c++/4.5/bits/istream.tcc as:
template<typename _CharT, typename _Traits> template<typename _ValueT>
        basic_istream<_CharT, _Traits>&
        basic_istream<_CharT, _Traits>::_M_extract(_ValueT& __v)  
            (...)
         
And later on in the same file:
extern template istream& istream::_M_extract(unsigned int&);
What this all means is that libstdc++ actually provides an implementation of an instance of the template for the istream (a.k.a. basic_istream<char>) class, with an unsigned int & parameter (and some more implementations). So, when building the example program, gcc decides, instead of instantiating the template, to use the libstdc++ function. This extern definition, however, is guarded by a #if _GLIBCXX_EXTERN_TEMPLATE, so if we build with -D_GLIBCXX_EXTERN_TEMPLATE=0, we actually get gcc to instantiate the template, thus getting rid of the GLIBCXX_3.4.9 dependency. The downside is that this doesn t work so well with bigger code, because other things are hidden behind #if _GLIBCXX_EXTERN_TEMPLATE. There is however another (obvious) way to for the template instantiation: instantiating it. So adding template std::istream& std::istream::_M_extract(unsigned int&); to our code is just enough to get rid of the GLIBCXX_3.4.9 dependency. Other template cases obviously can be worked around the same way. The case of renamed implementations
#include <list>
int main()  
    std::list<int> l;
    l.push_back(42);
    return 0;
 
Here, we get a dependency on std::_List_node_base::_M_hook(std::_List_node_base*) but we are effectively calling std::list<int>::push_back(int &). It is defined in /usr/include/c++/bits/stl_list.h as:
template<typename _Tp, typename _Alloc = std::allocator<_Tp> >
class list : protected _List_base<_Tp, _Alloc>  
    void push_back(const value_type& __x)  
        this->_M_insert(end(), __x);
     
 
_M_insert is defined in the same file:
template<typename ... _Args>
void _M_insert(iterator __position, _Args&&... __args)  
    _List_node<_Tp>* __tmp = _M_create_node(std::forward<_args>(__args)...);
    __tmp->_M_hook(__position._M_node);
 
Finally, _M_hook is defined as follows:
struct _List_node_base  
    void _M_hook(_List_node_base * const __position) throw ();
 
In gcc 4.4, however, push_back has the same definition, and while _M_insert is defined similarly, it calls __tmp->hook instead of __tmp->_M_hook. Interestingly, gcc 4.5 s libstdc++ exports symbols for both std::_List_node_base::_M_hook and std::_List_node_base::hook, and the code for both methods is the same. Considering the above, a work-around for this kind of dependency is to define the newer function in our code, and make it call the old function. In our case here, this would look like:
namespace std  
    struct _List_node_base  
        void hook(_List_node_base * const __position) throw ();
        void _M_hook(_List_node_base * const __position) throw ();
     ;
    void _List_node_base::_M_hook(_List_node_base * const __position) throw ()  
        hook(__position);
     
 
which you need to put in a separate source file, not including <list>. All in all, with a small hack, we are able to build Firefox with gcc 4.5 without requiring libstdc++ 4.5. Now, another reason to switch to gcc 4.5 was to use better optimization flags, but it turns out it makes the binaries 6MB bigger. But that s another story.

Erich Schubert: Google Circles rumor

The media are spreading a rumor about a social networking platform by Google, called Circles.
So far, these things have been debunked.
I do not believe that Google could succeed with a "Facebook clone". The market is already taken, Facebook is too big and had successfully been taking away international markets from local clones. For example in Germany, the other social networks used to be a lot bigger, but Facebook overtook them in just a few months, and the people I know pretty much quit the other networks then.
And I assume Google is aware that unless they have a strong strategy, the network would go the Wave-Buzz route.
At least here in Germany, people are surprisingly concerned by the amount of data Google might have on them, while at the same time they give it to Facebook for free. This is probably due to the media attention received with StreetView. It's not fair, but that's life.
However, "social network" is a broad term. Just think of what people actually use facebook for:
  • Games (often even not with their social circle!)
  • Microblogging
  • Photo sharing
  • Email
  • Automatic address book
Now, if you look closely at this list, Google pretty much has all of these, if we ignore the browser games (and they are all over the internet by now, Facebook and without!), then there is just one key ingredient missing for Google: the address book thing.
I believe this "Google circles" thing will largely by a "smart address book" that helps people managing their social contacts in a social network style. And obviously, this can be integrated in various products such as Mail, Picasa, Buzz, ...
If Google manages to launch a "contact manager" that makes it really easy for people to manage their social circles, this can be quite a killer. Facebook has "lists" but they are awful to use. It likes to "hide" friends to reduce the amount of information it throws at you. But it doesn't really organize it for you, for example by social circles or topics. These days for example Facebook could split the news feed into "Japan" and "everything else" I guess.

Russell Coker: Effective Computers for Schools

Sam Varghese has written an article that is very skeptical of the educational value of the OLPC project [1].Are Laptops Any Good for Schools?Sam cites an article in the New York Times by Winnie Hu about schools removing laptop programs due to a lack of success [2]. Winnie s article gives an example of a school shutting a program because of getting new teachers who lacked computer skills and some examples of schools which had issues with the repair cost. The solution to that would be computers that are more robust and easier to use by all accounts the OLPC systems are solidly constructed and easy to use!It is claimed that using laptops doesn t increase test scores. Using only test scores to compare educational methods is a way to lose, probably any school which does nothing other than try to increase test scores is worth avoiding. One example from Winnie s article is a report by Mr. Warschauer of students at a middle school in Yarmouth, Me., who used their laptops to create a Spanish book for poor children in Guatemala and debate Supreme Court cases found online . What value can you place on having students develop books for poor children in other countries and debate Supreme Court cases? If this sort of program became popular then it would lead to the countries which do it becoming better places to live in future decades!Mr. Warschauer also claims that If the goal is to get kids up to basic standard levels, then maybe laptops are not the tool. But if the goal is to create the George Lucas and Steve Jobs of the future, then laptops are extremely useful . I would go further than that, I think that providing the educational environment that involves international charity work and analysis of important court cases would lead to students having the skills to become good engineers, designers, and artists who work for people like George Lucas and Steve Jobs. No matter what you might do the vast majority of children will not grow up to be like George Lucas and Steve Jobs, there is a very limited number of positions for such people. But those people employ a huge number of creative people who do interesting and enjoyable work for good pay.I don t think that Winnie s article supports criticism of the OLPC project. I don t think that Winnie s article even contains sufficient evidence to match the headline.Playing GamesSam also cites an article about the misuse of school computers for playing games [3]. Of course there are ways of limiting access to games based on time etc. For a Linux system you could have a root cron job that runs chmod on /usr/games at various times, and preventing users from easily running programs that they install isn t difficult.Not that games are all bad, the flash-based games on www.physicsgames.net do teach kids some things about physics although I admit that much of that could be learned by playing with balls, skate-boards, etc.The Problem with the OLPC ProjectI think that the policy change to make OLPC systems only available to disadvantaged children was a mistake. The give one get one program was a great idea, maybe not the most effective way of getting funding but good for getting developers. While the new Sugar on a Stick project to put the OLPC GUI on a bootable USB device [4] it doesn t compare well to having dedicated hardware IMHO.Minimal Use of ComputersI have previously written about the weight of school bags and how laptops can alleviate the risk of health problems related to carrying heavy text books [5]. Since that time ebook readers and tablets have become incredibly cheap. Ebook readers are really light and the recent tablets are also very light (particularly the smaller ones). It seems to me that every school should at least be moving towards every student having an ebook reader and to use ebooks for all books that are part of the curriculum.At the moment there are a bunch of tablets on sale for about $150, that includes tablets that can access the Internet via Wifi or via 3G and a cheap 3G plan costs less than $150 per annum. If tablets were used for some of the computer tasks related to schools then a lot of the difficulty of repairing hardware would be removed. Tablets don t offer as many options for messing up the software configuration and if the hardware breaks it s easy to transfer the data onto a new tablet from the cloud with a maximum cost of $150 to replace the hardware.Also a cloud-based computing model could permit students to access all the same data from school and home while using desktop computers at both locations.Current SuccessNatalie Craig wrote an interesting article for The Age about The Lab a drop-in computer center for kids on the Autism Spectrum run by Dale Linegar and Stefan Schutt [6]. The fact that kids who have communication difficulties can find it easier to communicate electronically should be fairly obvious to everyone in the free software community, but the creation of an organisation to support such kids is noteworthy I think that such centers should be funded by the government and run in every city.Salman Khan gave an interesting TED talk about his project the Khan Academy [7] which is an online video-based teaching system that evolved from some Youtube videos he produced to tutor his cousins. Salman pointed out that his cousins said that they would rather watch his videos than have him teach them in person, it seems that they liked being able to pause and rewind the talk as well as avoiding the pressure of human interaction. The Khan Academy has videos in Adobe flash format, but conveniently they have download links so those of us who don t have the Flash plugin can still view the content [8].One of the interesting things about the Khan Academy is that in school use the videos are being assigned to kids as homework and the class time is used for teaching children to do worked examples what has traditionally been homework.So it seems that there are real examples of special-needs kids and average kids benefiting from different types of electronic learning.ConclusionI think that almost everything about the education system is broken. I also think that in many ways the education system has reached a local maximum, so there is no small way of improving things, and adding computers without making any of the significant changes needed to fix the big problems probably can t do a lot of good. In spite of this computers can provide some real benefits and I expect that those benefits can be better than the benefits of other potential ways of spending the money (IE it s worth the opportunity cost). I also have no doubt that almost anything can give a negative result if done badly enough, so I don t interpret examples of computer use failing in a school as anything other than evidence of a failing school.While the Khan Academy has some results that seem very positive I think that s only the first step of what needs to be done. It also seems to be based around users who have good Internet access which often isn t the case in places where the OLPC is being deployed. This implies that we need to get systems like the Khan Academy designed to operate in a disconnected manner, maybe with a remote server that s not connected to the Internet. This should be possible if funding is available.Sam suggested that there needs to be a scientific study of the effectiveness of the OLPC. I think that every project which involves significant amounts of public funding should be researched to ensure that it s an effective use of resources. 400,000 laptops is going to cost something more than $40,000,000 so it seems reasonable to devote a few person-years of research to determine how effective they are and which of the possible ways of using an OLPC will give the best results.I am confident that a good study of the effectiveness of the OLPC would demonstrate that it provides real educational benefits when correctly incorporated into an educational program. I also expect that such a study would show some significant differences in the effectiveness of various ways of using them. But we shouldn t be relying on confidence, we need some test results.

13 March 2011

Mark Brown: Changing core code

One of the biggest differences between working on most other OSs and working upstream on drivers for the Linux kernel is that elsewhere the core is usually a fixed thing that has been released and can t really be changed, even if source is available (which may not even be the case). If whatever subsystem you re working in can t cope with the thing you re trying to express then one of the things it s really useful to be good at is working out ways to implement the behaviour that s required behind the back of the subsystem. It s very common to see such code in drivers submitted by hardware vendors, particularly those that are new to Linux, as this is such a big mindset shift. With kernel development the approach is much more to make sure that the core can cope with whatever needs expressing. It s not always done in the core for example, sometimes the issue is due to unusually limited hardware and very likely to never come up again but it s very unusual to see code merged that doesn t at least fit in with the design of the subsystem. This post is inspired by a brief exchange with Thomas Gleixner on linux-kernel who articulated the advantages of doing things this way very well:
 - It's usually simpler and faster as the core code has all the
   necessary information. So that's even an argument which managers
   might understand.
 - Such workarounds, when not caught, tend to spread themself
   magically because driver writers checkout the existing code of
   similar devices and copy/paste/modify^Wuglify them over and over.
 - In the worst case such workarounds make the core maintainence
   harder and in some cases impossible, because they silently imply
   semantics on the core w/o the core maintainer knowing about them.
The last point is the most important one to me as a subsystem maintainer I really don t want to be merging code that is going to create issues with ongoing development of the subsystem. This is all another facet of the policy on stable APIs: APIs are only worth working around if they re fixed, and the assumptions that end up embedded in a workaroud are as much part of the API as the explicit interfaces. It s things like this that make Linux such a pleasure to work on.

David Bremner: Debugging Duplicity Duplication

It seems kind of unfair, given the name, but duplicity really doesn't like to be run in parallel. This means that some naive admin (not me of course, but uh, this guy I know ;) ) who writes a crontab
 @daily  duplicity incr $ARGS $SRC $DEST
 @weekly duplicity full $ARGS $SRC $DEST 
is in for a nasty surprise when both fire at the same time. In particular one of them will terminate with the not very helpful.
 AttributeError: BackupChain instance has no attribute 'archive_dir'
After some preliminary reading of mailing list archives, I decided to delete ~/.cache/duplicity on the client and try again. This was not a good move.
  1. It didn't fix the problem
  2. Resyncing from the server required decrypting some information, which required access to the gpg private key.
Now for me, one of the main motivations for using duplicity was that I could encrypt to a key without having the private key accessible. Luckily the following crazy hack works.
  1. A host where the gpg private key is accessible, delete the ~/.cache/duplicity, and perform some arbitrary duplicity operation. I did duplicity clean $DEST
  2. Now rsync the ./duplicity/cache directory to the backup client.
Now at first you will be depressed, because the problem isn't fixed yet. What you need to do is go onto the backup server (in my case Amazon s3) and delete one of the backups (in my case, the incremental one). Of course, if you are the kind of reader who skips to the end, probably just doing this will fix the problem and you can avoid the hijinks. And, uh, some kind of locking would probably be a good plan... For now I just stagger the cron jobs.

11 March 2011

Dirk Eddelbuettel: RcppArmadillo 0.2.16

Conrad Sanderson continues an active release schedule for his wonderful Armadillo templated C++ library for linear algebra; release 1.1.8 just came out yesterday. So I made a new release 0.2.16 of RcppArmadillo, our Rcpp-based integration into R. No changes on our side. This new version should now be on most CRAN mirrors. The short NEWS file extract follows below containing just Conrad's entry for 1.1.8.
0.2.16  2011-03-10
    o   Upgraded to Armadillo Version 1.1.8   "Kangaroo Steak"
         * Added floor() and ceil()
         * Added "not a number": math::nan()
         * Added infinity: math::inf()
         * Added standalone is_finite()
         * Faster min(), max(), mean()
         * Bugfix for a corner case with NaNs in min() and max()
And courtesy of CRANberries, here are the diffs to.2.15.
 ChangeLog                                                    6 
 DESCRIPTION                                                 10 
 inst/NEWS                                                   11 
 inst/doc/RcppArmadillo-unitTests.pdf                     binary
 inst/doc/unitTests-results/RcppArmadillo-unitTests.html      6 
 inst/doc/unitTests-results/RcppArmadillo-unitTests.txt      38 -
 inst/include/armadillo                                       2 
 inst/include/armadillo_bits/Cube_meat.hpp                   10 
 inst/include/armadillo_bits/Mat_meat.hpp                    30 -
 inst/include/armadillo_bits/arma_ostream_meat.hpp          119 ++---
 inst/include/armadillo_bits/arma_ostream_proto.hpp           8 
 inst/include/armadillo_bits/arma_version.hpp                 6 
 inst/include/armadillo_bits/arrayops_meat.hpp               39 +
 inst/include/armadillo_bits/arrayops_proto.hpp               5 
 inst/include/armadillo_bits/auxlib_meat.hpp                 10 
 inst/include/armadillo_bits/constants.hpp                  322 +++++++++++---
 inst/include/armadillo_bits/diskio_meat.hpp                 46 +-
 inst/include/armadillo_bits/eglue_core_meat.hpp            345 +++-------------
 inst/include/armadillo_bits/eop_aux.hpp                     16 
 inst/include/armadillo_bits/eop_core_meat.hpp              105 +---
 inst/include/armadillo_bits/eop_core_proto.hpp               6 
 inst/include/armadillo_bits/fn_elem.hpp                     58 ++
 inst/include/armadillo_bits/fn_misc.hpp                     53 ++
 inst/include/armadillo_bits/fn_norm.hpp                     14 
 inst/include/armadillo_bits/format_wrap.hpp                 12 
 inst/include/armadillo_bits/op_max_meat.hpp                 43 -
 inst/include/armadillo_bits/op_mean_meat.hpp                38 -
 inst/include/armadillo_bits/op_min_meat.hpp                 46 +-
 inst/include/armadillo_bits/op_var_meat.hpp                 27 -
 inst/include/armadillo_bits/restrictors.hpp                  9 
 inst/include/armadillo_bits/traits.hpp                      20 
 31 files changed, 782 insertions(+), 678 deletions(-)
More information is on the RcppArmadillo page. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page.

Marc 'Zugschlus' Haber: What are interface labels for

Dear Lazyweb, for a long time I have been using iproute2 s label feature to assign arbitrary labels to IP addresses configured on Interfaces:
40: int152@dotqa: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 00:25:b3:01:e5:6c brd ff:ff:ff:ff:ff:ff
inet 10.1.152.254/24 brd 10.1.152.255 scope global int152:98fe8
Recently, this has shown to at least confuse both isc-dhcp-relay (#617258) and dhcp-helper (#617264). As I have never seen interfaces labels used outside my firewalls (which happen to use ifupdown-scripts-zg2 (Debian PTS)) and ifupdown s rather twisted handling of multiple IP addresses per interface (using Alias Interfaces), I d like to know whether my usage is a legitimate one and whether there are other uses for interface labels. At the moment, I m tempted to remove label support from ifupdown-scripts-zg2 in the next release, or to make it optional. Please comment if you have an opinion.

Guido G nther: git-buildpackage tip #4: creating remote repositories

In order to ease creation of remote repositories to publish your Debian packaging work git-buildpackage ships gbp-create-remote-repo: If you run
gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/%(pkg)s.git'
from inside a git repository it will create a remote repository on git.debian.org in the given directory, push your debian, upstream and pristine-tar branches into it and set up branch tracking so you can easily use gbp-pull or git pull to update your local repository from there. '%(pkg)s' will be replaced by the source packages name. If you want to be more explicit you can use:
gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/foo.git'
so no substitution will take place. In case you only want to push to that repository but not pull from there you can use the --no-track option so gbp-create-repo won't set up any branch tracking. If you specify the remote-url-pattern via gbp.conf calling:
gbp-create-remote-repo
is enough to create a repo on your favorite git server. The default is to create new repositories in the collab-maint repository on alioth.debian.org. This feature is available in your $PATH since 0.5.16 (it was shipped in examples/ before) and was inspired by the Debian OCaml Maintainers dom-new-git-repo work. This blog is flattr enabled.

10 March 2011

Michal &#268;iha&#345;: Contributing to phpMyAdmin and GSoC 2011

It looks like questions about contributing to phpMyAdmin are more and more frequent with upcoming GSoC. The fact that is still time for organizations to apply and it's not yet decided whether we will be accepted or not does not change anything. But before asking, please try to look up existing resources. We have lot of information available on wiki, with entry point being contribution page on website. You should find there all basic information how project works. Should you specifically ask for GSoC, we have an applicant guide, which tells you what to do if you want to apply. After last year experiences, we will be even stricter on previous contributions, because it turned out to be good filter for people who would have problems with contributing during GSoC as well. In case you don't know where to start, there is list of junior jobs which should not be that complicated and then there is of course GSoC ideas list with things primarily targeted on GSoC.

Filed under: English Phpmyadmin 0 comments Flattr this!

Rapha&#235;l Hertzog: My Debian package maintainer pledge

When coming back from DebConf9, I wrote this pledge:
As a package maintainer, I will do my best to help the Debian project release a stable version of our operating system. In particular, I will work together with the release team and I will keep all packages associated to my name free of release critical bugs. To this effect, if I m not registered as being busy or in vacation, I will start working on my release critical bugs as soon as possible (in less than 1 week in common cases). If I can t deal with them in a timely fashion, I will state it clearly in the associated bug reports, tag them help and invite other contributors either to provide a patch or to do a non-maintainer upload. If I do not manage to handle release critical bugs in the above described way, or if I almost never deal with any of my RC bugs by myself, I will:
  • not refuse help and even propose co-maintenance to good contributors
  • recognize my failure and actively try to find a new maintainer and/or co-maintainers
  • not complain if the quality assurance team decides to orphan the package
I recognize that my work is not limited to unstable. I will also work with the stable release team and the security team to provide updated packages for the stable and/or testing distribution when some issues deserve it. I am aware of the limits of my skills and my available time and I will avoid packaging software that I would not be able to maintain properly.
It tries to sum up the minimal expectations that Debian should have towards the package maintainers. I tried first to get this pledge integrated into the NM/DM process but the discussion concluded that it would be best to document this in the developers-reference. There s already a chapter called Debian Developer s Duties where this can nicely fit. I submitted this as a wishlist request for the developers-reference soon after and it s still open. Now I went to the next step and prepared a patch that restructures the chapter about developer duties. See #548867 for details.
Follow me on Identi.ca, Twitter and Facebook. Or subscribe to this blog by RSS or by email.

4 comments Liked this article? Click here. My blog is Flattr-enabled.

9 March 2011

Rog rio Brito: (Some) Solutions with Chromium

In my previous post, I was pointing out some of my frustrations with Chromium/Chrome. A very kind reader, Timo Juhani Lindfors, gave me answers to many of the problems that I pointed out and got me straight on some issues:
  • I can disable full zoom in Iceweasel (i.e., I only want to zoom the text, not the images). According to Chromium's project BTS, it seems that this will be a WONTFIX bug, despite many people asking for it (and it having a lot of duplicates).
Timo told me that there is an extension called "Font Size Increase" (ID: ombpcpigmndepfckcifdblemkabaoihk) that adds a button on the side of the URL bar that you can click to increase the size of the text, without affecting the size of the images. Highly recommended. Not that I need this one as much as "Font Size Increase", but there is also a "Font Size Decrease" (ID: mpajngnpcmjjeoflljdjpnehcfaldcia) that, as the name implies, decreases the size of the text. It is nice to have this one when you clicked on the button to increase the size of the font one or two times too many.
  • In Iceweasel, I have a way (without resorting to many extensions or hackish solutions) to use the equivalent of Firefox's "View > Page Style > No Style" (i.e., to ignore any CSS sheet that the document author may have specified on the page).
Timo also told me that there is a very cool extension called "Chrome Page Style" (ID: ddpkgkegfklikkmfmneldonhldahhacb) that allows you to alternate between stylesheets provided by the page (see Joey Hess's ikiwiki's CSS Market for an example of that). It also has the possibility of disabling all the CSS'es that a page may have, which, in many cases around the web actually improves the readability of the pages, for many "fancy" things detract from readability, especially if you have poor eyesight. Although I had said that I didn't want to resort to extensions, this was a simple solution enough that made me consider revisit my requirements. I do, though, wonder why some frequently used extensions are not built into the programs from stock.
  • In Iceweasel, I can press Ctrl+Q and make the damn browser quit, instead of me having to use the mouse/trackpad/pointing device. This is probably a lack of my understanding on how to associate key bindings to Chromium, but the problem still stands.
Of course, Timo also set me straight and told me about Ctrl+Shift+Q for that purpose, which I had missed completely.
  • Similarly, when there is only one tab open, pressing Ctrl+W in Chromium does not close the tab (say, presenting me a blank tab or the list of most visited sites), nor it closes the application.
As a poor writing of my part, Ctrl+W does close the tabs. But when there is only one tab present, it doesn't close the window. I'm OK with that, since I now know the way to close the window. Thanks again Timo. Oh, and one point that may not be known by many is that using about:flags in Chrome does something analogue to Firefox's about:config (even with the warning). And tweaking with it you can try to see if you can enable hardware acceleration of some parts of your pages, as present in newer releases of Chromium. So, there I am: way more satisfied than with earlier with Chromium, but still having Firefox/Iceweasel as my primary browser. Good to have two usable browsers now.

Sean Finney: compiz updates!

For those who are interested in the world of compiz, new development snapshots have been trickling their way into experimental for the past week and are now available for widespread testing. They're being sent to experimental instead of straight to unstable for a few reasons: So, anyway, the packages are all uploaded now--give them a try!

8 March 2011

Sam Hartman: V6 Really is that Hard

Sometimes I begin to think that we ve solved most of the challenges to IPv6 deployment. Then something happens. This time it was a DAP-1522 access-point. Not a NAT, not a router, just a layer 2 device. A while after deploying the device, I noticed that sometimes mail failed to work. After attempting to debug the problem was that the device wasn t getting an IPv6 address. The router appeared to be sending out advertizments. Other machines on the same subnet were working fine. This laptop had associated with the new access point. The default configuration helpfully includes IGMP snooping. The IGMP snooping detected that no one subscribed to any IPv4 multicast group corresponding to the router advertizements and thus didn t forward them to the wireless link. We have a long way to go if layer 2 devices sold today are incompatible with v6 in their default configurations.

Rob Bradford: Autofoo: AC_ARG_ENABLE

Spent some of my morning fixing a build issue that came down to the use of AC_ARG_ENABLE. I thought it was worth recording some notes for its use: Something enabled by default:
AC_ARG_ENABLE([badgers],
              [AC_HELP_STRING([--enable-badgers=@<:@yes/no@:>@],
                              [Enable badgers @<:@default=yes@:>@])],
              [],
              [enable_badgers=yes])
Something disabled by default:
AC_ARG_ENABLE([badgers],
              [AC_HELP_STRING([--enable-badgers=@<:@yes/no@:>@],
                              [Enable badgers @<:@default=no@:>@])],
              [],
              [enable_badgers=no])
Observe that in this case the only thing that changes is the default value in the third parameter to AC_ARG_ENABLE (and also the documentation :-) ) Something enabled by default but with a disable syntax:
AC_ARG_ENABLE([badgers],
              [AC_HELP_STRING([--disable-badgers],
                              [Disable badgers],
              [],
              [enable_badgers=yes])
Notice that this case is just the same as the first except with the help changed. Of course you actually need to use the value from the flag. I think this is more readable if presented outside the AC_ARG_ENABLE parameters this is possible because AC_ARG_ENABLE always sets a variable called enable_<thing>. Awesome, huh? For conditional pkg-config:
AS_IF([test "x$enable_badgers" = "xyes"],
      [PKG_CHECK_MODULES(BADGERS, [badgers-1.0])],
      [])
For conditional building:
AM_CONDITIONAL(ENABLE_BADGERS, test "x$badgers" = xyes)

7 March 2011

Ritesh Raj Sarraf: Microsoft, Nokia and Qt

Nokia has announced that it is selling off its Qt business. This needed to happen given the change in the company's strategy. Microsoft is a software vendor providing Mobile OS, with Nokia being one of its consumers. For Nokia, to have a tier 1 alliance with Microsoft, it would have been important for the company to show positive gesture. With this move, Microsoft and Nokia will strengthen their partnership. This move will focus on tighter integration in between the 2 company's portfolios. Nokia mentioned in the announcement that it'd further continue Qt core development. I don't see what value that has to bring to the company. It either has to do with the company making some money with whatever IP it acquired in Trolltech, or else, it'd be just a phased wise approach in selling off the Qt business. Also it could be Nokia's Plan B, in case the Micro-Noki team fails to build the ecosystem that it is aspiring for. As for Qt, we'll have to see. Given that it is GPL, we don't have too much to worry (hopefully).

Matt Zimmerman: Listening to users

In the software community, people hold strong opinions on the subject of listening to users. Some feel that users are an essential source of information for making successful products, as evidenced in the customer development methodology, and seek to involve users deeply in product development. Others believe that users don t know what they want, invoking the quote attributed to Henry Ford, If I d asked customers what they wanted, they would have said a faster horse . Some say that user needs are unknowable except through the lens of a marketplace, where people choose in aggregate which products suit them best, and customers vote with their wallets (anything else is anecdata ). Regular readers will not be surprised that I believe they are all right, but only in certain contexts. The right strategy for involving users in product decisions will depend on factors related to the product itself, the market, and the product development method being used. One of the most important is the life cycle stage of the product: is it a new and rapidly evolving concept, or a mature commodity, or somewhere in between? Simon Wardley explains this well over on his blog, so I won t rehash his points here, but will add a few of my own. If what we re looking for is inspiration for a new product, it s here that Henry Ford was right: users generally won t hand you a complete product vision on a silver platter. They ll frame their input in terms of what they know, and the choices already available to them. However, this doesn t mean that users don t have a role to play in this instance: watching users can be a great source of inspiration. It s the combination of domain knowledge and passionate imagination which triggers the creative spark. Henry Ford applied his engineer s interests to a problem which was evident all around him. If our goal is to test whether a new product is a good fit for its users, there is no substitute for user feedback. We can guess at whether there is a fit, and our intuition may be good, but users are the ultimate judges, and we don t know if we re right or wrong until users evaluate it. So ask them! By engaging in dialogue with individual users, we can learn unexpected things which will help to refine the idea. If we don t find what they think until our new product is released, we risk making something that no one wants. Why wait until it s too late? It can be challenging to extract useful feedback for a product which doesn t yet exist, but this effort is well worth it to avoid wasting much more effort in software engineering. When our objective is to incrementally improve an existing product, individual anecdotes can mislead us. A given change may be an improvement for one user, but a disaster for another. What we want to know is whether the new version is better for the population as a whole, and in this case, we do well to rely on data. There are pitfalls here as well, of course. We need to choose our questions carefully, and realize that users will often resist any change: not because they re stodgy by nature, but because they have to invest effort in adapting to the change. I think of incremental improvement as a joint investment made between product developers and their users, to improve the whole system of people and technology for the better. By choosing the right tool for the job, we can make better decisions, improve faster, and ultimately solve the right problem for our users.

Daniel Kahn Gillmor: PHP, MySQL, and SSL?

Is there a way to access a MySQL database over the network from PHP and be confident that As far as i can tell, when using the stock MySQL bindings, setting MYSQL_CLIENT_SSL is purely advisory (i.e. it won't fail if the server doesn't advertise SSL support). This means it won't defend against an active network attacker performing the equivalent of sslstrip. Even if MYSQL_CLIENT_SSL was stronger than an advisory flag, i can't seem to come up with a way to tell PHP's basic MySQL bindings the equivalent of the --ssl-ca flag to the mysql client binary. Without being able to configure this, a "man-in-the-middle" should be able to intercept the connection by offering their own certificate on their endpoint, and otherwise relaying the traffic. A client that does not verify the server's identity would be none the wiser. One option to avoid a MITM attack would be for the server to require client-side certs via the REQUIRE option for a GRANT statement, but the basic MySQL bindings for php don't seem to support that either. PHP's mysqli bindings (MySQL Improved, i think) feature a command called ssl_set() which appears to allow client-side certificate support. But its documentation isn't clear on how it handles an invalid/expired/revoked server certificate (let alone a server that announces that it doesn't support SSL), and it also mentions:
This function does nothing unless OpenSSL support is enabled.
Given that debian MySQL packages don't use OpenSSL because of licensing incompatibilities with the GPL, i'm left wondering if packages built against yaSSL support this feature. And i'm more than a little bit leery that i have no way of telling whether my configuration request succeeded, or whether this function just happily did nothing because the interpreter got re-built with the wrong flags. Shouldn't the function fail explicitly if it cannot meet the user's request? Meanwhile, the PDO bindings for MySQL apparently don't support SSL connections at all. What's going on here? Does no one use MySQL over the network via PHP? Given the number of LAMP-driven data centers, this seems pretty unlikely. Do PHP+MySQL users just not care about privacy or integrity of their data? Or (please let this be the case) have i just somehow missed the obvious documentation? Tags: mysql, php, question, security, ssl, tls

6 March 2011

Yves-Alexis Perez: Update on Xfce 4.8

Since the last post, few things did happen. Basically, it's still not the right time for Debian users to upgrade to Xfce 4.8. We eventually managed to upload the whole desktop part (except the xfce metapackage) to experimental and we did upload some of the goodies too. Licensing issues have been solved so the concerned packages have been uploaded, and we're right now waiting on the three packages sitting in NEW. So you'll need to be a little more patient and kindly wait for our ftp-masters to process the (quite huge) NEW backlog. After that we'll need a bit more time in experimental to test upgrade cases, then we'll do an upload to unstable of the whole desktop part and the whole goodies. Upgrading to xfce4-panel 4.8 means *all* plugins need to be rebuilt too, so that means a huge upgrade and a quite large transition to handle for the release team, so we'll have to schedule the unstable upload with them in order not to break all their plans (yes, we try to be good Debian citizens) So please be patient, but you'll see Xfce 4.8 in unstable in a not too distant future. I'll put an update here when we'll need brave volunteers willing to break their systems by doing upgrade tests. [UPDATE]: garcon, thunar-vfs and tumbler were just accepted into experimental, thanks to our ftp-masters. Now we'll synchronize with release team and upload to unstable when possible.

Next.

Previous.