It s not that common to have a rally in favor of creating a new tax, but today I attended the Melbourne rally in favor of a carbon tax [1], it was the second such event this year. The rally was held in front of the state library, there is a reasonable size park there and it s a great place for a few hundred people, and a few thousand can squeeze in there without any problem. But according to the best estimates 10,000 people attended and the venue was obviously a bad choice as all available space was used and the crowd was so great that it wasn t much fun to be there. This was a great contrast to the previous rally in favor of a carbon tax which had maybe about 8,000 people attend and a much larger area [2]. The state library is a great place to hold a small or medium size rally where people can see it, but if you are going to get 10,000 people you need a bigger venue as the exits were partially blocked by road work I m sure that the local government wouldn t have given a permit if so many people were expected. Usually the city center is very quiet on a Sunday afternoon, but this afternoon everything was packed. An extra 10,000 people really makes a difference although admittedly sunny weather would have helped. Australia wide there were apparently about 100,000 people attending similar rallies, that s 0.5% of the population of the country! The aim of the rally was to advocate a large enough tax on coal, oil, and other energy sources that emit CO2 to provide an economic incentive to minimise use and use alternate energy sources where possible. Currently billions of dollars are being given to polluting industries, instead those industries should be taxed and the money raised given to compensate needy people. Looking North towards where I entered. Two pictures from slightly different angles that are roughly East from where I was standing in the center of the crowd. Pictures looking east through the band when people were starting to leave and looking south towards the exit I chose while on the way out.

• [1] http://www.theage.com.au/environment/climate-change/people-power-rallies-for-tax-20110605-1fmyr.html
• [2] http://etbe.coker.com.au/2011/03/12/climate-action-now-melbourne-12th-march/

jffnms 0.9.1 has the database extracts and updates missing from 0.9.0 This is the most problematic part of the project release; ensuring that the database updates correctly. Version 0.9.1 is functionally the same as 0.9.0, it is just with less bugs!

As I write this, it's the morning of June 5th, 1981. A few people scattered across the US are waking up, going in to work, sitting down at their terminal with a coffee, and reading Usenet. Usenet is only getting a trickle of posts each day -- it's still in that period where it's easy to read every message posted to it. Many things lie in Usenet's future. It's still running A-News, which doesn't even have a real From header yet. Later this year it will switch over to B-News, and volume will begin to increase. In 1987 there will be The great renaming. And of course in 1994, the first spam will be posted to Usenet. But that's all a long way off, here in 1981. Right now, they're talking about 500 mb disk drives that only cost $38000. And rms is inciting flames about nuclear proliferation. And Postel is publishing an RFC for the new Mail Transfer Protocol. Good morning, Usenet. Who knows what will come next in this fledgeling electronic communications medium! a ten year real-time historical exhibit This morning, I'm announcing a new site: Olduse.net It's Usenet, updated in real time as it was thirty years ago. Planned to be available for the next ten years, unless I run out of inodes (again). If you missed it the first time around, this is your chance to follow Usenet's flowering. made possible by

• Henry Spencer at the University of Toronto, Department of Zoology, who archived Usenet. Back when it was really uncool and really expensive. Our view onto Usenet is thus slightly centric to Canada and Zoology, but that's ok.
• David Wiseman, who hauled 141 magtapes in a pickup truck.
• Many who worked to rescue data off the tapes. Including from the deleted stuff at the ends.
• Rich Skrenta, who somehow got a copy of the archive out from under the Google borg. Although one of the tar files is truncated. Just saying.
• The creator of Telehack, who pointed me in the right direction, ending my multi-year quest to find the archive. And if you think this is neat, Telehack will blow you away.
• The developers of Haskell, which enabled me to whip up a B-News to C-News converter, a custom uucp, date parsers for every crazy date format ever used on Usenet, and suitible queue data structures in a rock solid, maintainable way, in 500 lines of code written over 12 hours. When I realized I also needed an A-News to B-News converter, I knew it was worth it to have done things right, because that took only 43 more lines, and worked 100% on the first run! My code repository for olduse.net is here.

---

PS: You can post to olduse.net, but it won't show up for at least 30 years. :)

During the past week I finally got around to give the Vendor Profiles branch some attention. I suspect the most exciting change is that I got support for non-overridable tags. Along with making --ftp-master-rejects an alias for the ftp-master profile. This means that you will get the same behavior from Lintian and from the ftp-master auto-reject mechanism. The only issue is that the overrides are silently ignored. We also made dropped the default profile symlink in favor of using dpkg-vendor to find the best profile. This causes a slight conflict with solving #626476. I have asked the dpkg maintainers if that part of the libdpkg-perl API is stable enough for us to use. Finally I fixed an issue where profiles would ignore all display settings (--display-info etc.) and just show all tags (except experimental tags). Beyond the vendor profile branch, there are also a number of interesting changes applied in the master branch. Together with some people from #debian-python (ScottK and jwilk as I recall), I prepared some python related goodies. Particularly we fixed a false-positive missing-python-build-dependency with python3 and marked dh_pycentral and dh_python as deprecated. On a related note, we have also removed the tag uses-dh-python-with-no-pycompat. Based on feedback from Eric Lavarde, we redefined the classpath-contains-relative-path tag. It now only emits the bad parts of the Classpath and relative entries are allowed in they exists or point to /usr/share/java/$file.jar and there is a strong libX-java dependency. While the change breaks overrides, according to lintian.d.o we do not have any yet. The next release will feature a check for non-empty dependency_libs fields in la files and a fix to a flaw in logic for architecture dependent overrides. We will be reducing our dependency of dpkg-dev to a Suggests (#626476). Currently the xz-utils is in the pseudo-essential set, but it may not stay that way. So in the future you may need to explicitly install xz-utils for Lintian to support .xz source packages. Last, but not least, if you have felt that the lintianrc file has been rather useless to you, then you are not alone. I have made a prototype patch to improve the situation and hopefully soon you get to specify default options in your lintianrc.

This is for my own reference more than anything else; periodically I find myself needing to boot DOS. Usually because I want to upgrade a BIOS and the upgrade tool only works with Windows or DOS. Yes, I'm aware of flashrom, but the scary messages about toasting laptops means I'm much happier going the DOS route there. So I need a writable medium with a DOS boot image. The easy way to do it is to find a DOS floppy image and write that to a USB stick with dd, but it's basically a one off and means you can't fit a whole lot on the image. I wanted to do a native USB boot. The following did the trick for me. Firstly, this is all on a Debian testing box, in particular with dosfstools (3.0.9-1), mbr (1.1.11-4) and syslinux (2:4.04+dfsg-2). I don't think I'm using anything particularly new from these tools, so I suspect Debian stable will work just fine. In the below my USB stick is on /dev/sdb, I've got a copy of FreeDOS in ~/FreeDOS/ (I extracted the files from a balder10.img floppy image that's easy enough to find, but all you need is kernel.sys and command.com), and I wanted things neatly in their own subdirectories so I could try and keep the key for repeated use and know which bits I wanted to keep and which were transient. I also added a copy of the Debian Installer for convenience; it would need a copy of the netinst ISO dropped into the root to actually be useful, as there's not enough to do a full netboot from the wider Internet using just the HD initrd.

    # Create a single bootable LBA VFAT partition spanning entire stick.
    echo 0,,C,*   sfdisk /dev/sdb
    # Format as VFAT and give it a disk label.
    mkfs.vfat -n 'DOS BOOT' /dev/sdb1
    # Install an MBR
    install-mbr /dev/sdb
    # Mount it and create some directories for our files.
    mount /dev/sdb1 /media/DOS\ BOOT/
    cd /media/DOS\ BOOT/
    mkdir boot
    mkdir boot/syslinux/
    mkdir FreeDOS
    # Copy the chain.c32 syslinux tool over.
    cp /usr/lib/syslinux/chain.c32 boot/syslinux/
    # Copy FreeDOS over and move the important bits to /
    cp ~/FreeDOS/* FreeDOS/
    mv FreeDOS/command.com .
    mv FreeDOS/autoexec.bat .
    mv FreeDOS/fdconfig.sys .
    # Add the Debian Installer
    mkdir boot/d-i/
    cd boot/d-i/
    wget http://cdn.debian.net/debian/dists/squeeze/main/installer-amd64/current/images/hd-media/initrd.gz
    wget http://cdn.debian.net/debian/dists/squeeze/main/installer-amd64/current/images/hd-media/vmlinuz
    # Install syslinux
    syslinux -d boot /dev/sdb1

I made a boot/syslinux.help file containing:

    Available boot options are: FreeDOS d-i

and a boot/syslinux.cfg with:

    prompt 1
    display syslinux.help
    default FreeDOS
    label FreeDOS
        COM32 /boot/syslinux/chain.c32
        APPEND freedos=/FreeDOS/kernel.sys
    label d-i
        KERNEL /boot/d-i/vmlinuz
        INITRD /boot/d-i/initrd.gz

Initial testing was done using kvm which was a lot easier than constantly rebooting my laptop. Hopefully this is of help to someone. The only neat bit that I didn't see elsewhere when I was looking was the use of chain.c32 to load kernel.sys rather than having to use a FreeDOS provided boot sector image.

Hello, this is the official project report for the Debian GSoC admins and everyone. It s been few days since the official coding phase started. Most of the time I ve been figuring out the details regarding integration of non-x86 images to the Eucalyptus IaaS and working on the ARM image, as you ll learn later. I m also in the process of starting to design the set of tools we ll be delivering as part of the project. The project s goal is to be a useful resource for Debian developers and porters. I ve joined some porters list in order to learn what are the things they are struggling with and how the project can help to address them. I ll be starting a wiki page with such topics. Bonding period:
Bonding period has been more fruitful than I expected. As mentioned in my previous post, Steffen and I got in touch with the Eucalyptus team, since they show their early interest on the project. We are coordinating cooperation between our teams. Besides my mentor and I defined to start working on the ARM image. Coordination went OK. We ll be having meetings every two weeks. Project Status:
Resuming Dominique s work I began working on the ARM image. Aur lien s work was a great resource. Currently I have a working and updated Debian testing ARM image using the versatile kernel that can be used under qemu-arm. I m currently making tests and figuring out the next phase which is cloudify it. Over this weekend I expect to finish on that side and then began on the design and implementation of the tools that will be the project s result.

Until now I haven t faced much issues, but the Eucalyptus part since the docs are targeting x86 and amd_64 archs. However I think I can run qemu-arm on top. I ll talk to them about the idea.

Future plans: week 3: - Finish tests with the ARM image. - Design the base tool-set, thinking integration with dpkg-buildpackage and qemubuilder. week 4-8: - Write the necessary code. mid-term evaluation. Other bits: Latest days have been quite busy for me, since I m still have to attend class, my semester ends in five weeks. This week was quite overwhelming with media , my University published an article (Spanish) about me and the program. I m the third student of the CS school participating in GSoC, in the past we had Gentoo Project and KDE students. Later, a local Cable TV program interview me on the same matter, it went fine. I managed to talk about Debian and what we do (we get free Advertising yay!) :) also about Google s Summer of Code program and invited students to participate both in FLOSS projects and the program. Still don t know if they have put it on air, I think it will be next week.

DECLARATIVE DIVERSIONS ====================== Introduction A diversion is when it is possible to have dpkg not overwrite a file when it reinstalls the package it belongs to, and to have it put the file from the package somewhere else instead. Declarative diversions involves a new control file with a declarative syntax which dpkg will parse and process directly as part of the package unpack and removal phases, eliminating the problems resulting from non-atomic handling of diversions. Topics There are a number of topics involved in implementing this kind of project * What syntax do we use for the new control file? * What dpkg does with the control file * How do we handle diversions to a non-existant directory? * How do we order unpacking a new package which adds a diversion? * How do we order unpacking a new package that removes a diversion? * How do we order removing a package which had a diversion? * How do we handle errors? * What happens to dpkg-divert? - Details - Control File Syntax - It will conform to RFC2822 style with the following format: * Divert-From: * Divert-To: * Blank lines and lines beginning with # will be comments Divert-To will be optional and if it is ommitted then files being diverted will have their filename changed to file.distrib The above style has it s advantages, one of the main ones being that there is no need to escape whitespace within filenames. - Details - Control File Handling - Within control.tar.gz the file should be named diversions This file is then copied to /var/lib/info/$package.diversions This is ensuring we have a copy of the control file just in case it is needed. Any input on this subject would be appreciated. - Details - Handling Diversions to non-existant directories - Diverting files to directories that don t exist can cause a number of problems. If the package does not own the directory it may be left orphaned on removal of the package The package is responsible for ensuring the availability of the target directory in the unpack phase. - Details - Ordering Requirements - =>Unpacking a new package that adds a diversion *1. Unpack folders *2. Add diversions *3. Unpack files ==Notes== Performing diversions this way avoids trouble with creating folders and accidentally overwrtiting the wrong version of files. If we don t use this method the problems that can occur include creating folders before the package itself would create them which may cause permission errors. Another major problem would be extracting a new version of the file and overwriting the old one. This might cause the wrong version of the file to be diverted and the package to break. =>Unpacking a new package that removes a diversion *1. Unpack folders *2. Add diversions *3. Unpack files ==Notes== =>Removing a package which had a diversion *1. Remove files *2. Remove diversions *3. Remove folders ==Notes== This ensures that all files, diversions and folders are removed correctly Details - Error handling Errors in diversions will have to handled with a great deal of care due to the fact that if they are not the package could be broken. This means that a great deal of checks must be done to ensure that all the files can be diverted properly before any actual diverting takes place. If they can t the package installation/update must be stopped and rolled back to avoid the package being installed incorrectly or broken. - Details - dpkg-divert - When we impliment the new diversion method we should keep the current dpkg-divert. This allows maintainers to catch up with the new method without breaking their packages. It also allows maintainers to perform some operations that aren t support by the new method. Example Usage #1 The file to be diverted is /usr/share/foo It needs to be moved to /usr/share/bar The syntax of the control file would be: #Start File Divert-From: /usr/share/foo Divert-To: /usr/share/bar #End File Example Usage #2 In this example the maintainer doesn t want to move the file to any specific folder The syntax of the control file would be: #Start File Divert-From: /usr/share/foo #End File This would divert the file to /usr/share/foo.distrib - Footnotes - RFC2822 Guide: * http://www.faqs.org/rfcs/rfc2822.html First Email Thread on Declarative Diversions (First Message in Thread): * http://lists.debian.org/debian-dpkg/2011/05/msg00102.html Declarative Diversions Wiki: * http://wiki.debian.org/SummerOfCode2011/DeclarativeDiversions My Blog for this Project: * http://blog.sam-dunne.com

The beginning of this Google Summer of Code has been busy and pretty cool. Not a lot of code was produced but I did learn a lot of things.

During this GSoC I will work on the next generation JDK. This means that I will (and I already have) compile the JDK. That s pretty awesome but it requires a lot of power. That s why Tom Marble created me an account on his 8 CPUs machine to help me.
Since I m probably going to sign some packages, I created a new GPG key with a 4096 RSA strength.
My old key was:

pub 1024D/F144A319 2008-10-18

And the new key is:

pub 4096R/EE2BBBC7 2011-05-03

I cross signed my keys using this great tutorial.

I read some documentation about Jigsaw and watched Tom s talk at DebConf 10.
I have spent a little more than a week to understand the current OpenJDK packaging to be able to rebuild it. I have learnt from where do the sources come from. The current packaging is a little hard to understand. There are sources that come from IcedTea, OpenJDK, and more.

After being able to rebuild the OpenJDK 6 package, I have downloaded the source of the OpenJDK 8 and Jigsaw. I used the Mercurial forest to get the sources.

For OpenJDK 8:
hg clone http://hg.openjdk.java.net/jdk8/jdk8 jdk8
cd jdk8 && sh get_sources.sh

For Jigsaw:
hg clone http://hg.openjdk.java.net/jigsaw/jigsaw jigsaw
cd jigsaw && sh get_sources.sh

I have managed to build the sources of OpenJDK 8 and Jigsaw using the same steps:
cd jigsaw
. jigbuild
. jdk/make/jdk_generic_profile.sh
export ALLOW_DOWNLOADS=true
make sanity
make all

Jigsaw specific:
make modules-sanity
make modules

Each build took several minutes. But they were successful. Tom helped me a lot to build OpenJDK 8 and Jigsaw by giving me a solution. For example, after getting the Mercurial forest, there were still missing source files and the build failed. Tom told me that I needed to export a environement variable: ALLOW_DOWNLOADS=true.
After building Jigsaw, I was able to see that the version string is not legal in Debian and that is a real problem.
I have written some simple Hello World examples to compile and run with Jigsaw. To modularize a program, it needs to contain a module-info.java files. This file includes the modules needed to run the program and the main class to run. For a classic hello world, the module-info.java files looks like:

module test.hello @ 1
requires jdk.base @ 7-ea;
class test.hello.Main;


Tom gave me some packages to build: jtharness and jtreg. I succesfully built jtharness using CDBS and its Ant helper but I ll have to repackage it to use javahelper instead of CDBS. I still didn t try to build jtreg because it requires jtharness.

My next plan is to get jtharness and jtreg packaged with javahelper soon and understand what modules does what in Jigsaw. Understaning modules will help me to write some more complex examples. I hope to start working on Jigsaw a little more soon (when I my internship will end [next week]).

This is my monthly summary of my Debian related activities. If you re among the people who made a donation to support my work, then you can learn how I spent your money. Otherwise it s just an interesting status update on my various projects. I have been Doing some work towards Debian Rolling At the start of the month, the discussions about Debian rolling were still very active on debian-devel. Declaring that testing would be rolling did not make it (as I hoped), the argument that some RC bugs last for far too long in that distribution carried the discussion and thus the most consensual proposition ended up being the one of Josselin Mouette were rolling would be testing plus a few selected cherry-picked packages from unstable. I believe it s a workable solution if we only care about a subset of architectures. Otherwise the same reasons that keep the fixed packages out of testing would probably also apply for rolling. Given this, I did setup britney (the software that controls testing) on my laptop to investigate how we can create rolling. It turns out britney is a very specialized software with very few configuration knobs. At the same time Joachim Breitner made a proposition that immediately grabbed my attention. He suggests to use SAT solvers to find out the set of packages that should migrate from unstable to testing. I thought that rolling would be a good testbed for this new implementation of britney (which he calls SAT-britney) so I jumped right in this project. I was not at all familiar with this science field, so I looked up quite some documentation: I learned that all SAT solvers expect the problem to be presented in CNF form, and that DIMACS was the file format of choice to represent those boolean constraints. Several SAT solvers are available in Debian and picosat appears to be one of the best. Then I started some early coding/prototyping to play with the concept. You can find the result in this git repository, you can grab a copy with git clone git://git.debian.org/~hertzog/sat-britney.git. There s not much yet, except some Python code to generate a SAT problem that can be fed to a SAT solver. But I really look forward to this project. Representing Debian during Solutions Linux During the second week, I spent 3 days in Paris to help manage the Debian booth at Solutions Linux. We have responded to lots of queries but most visitors already knew Debian, and many of them use it at work and/or at home. We tried to recruit those people as new members for Debian France, the local association. We also sold all our remaining goodies. The Ubuntu people were interviewed by France 3 (an important TV channel) and we took this opportunity (with the consent of the Ubuntu guys) to show our Debian t-shirts in the background: you can watch the video here (in French), you can see me with Carl Chenet at 1:21. We have also been interviewed by Intelli n TV: here and here (both in French). I m not very good at this exercise. Improving dpkg triggers The third week was a vacation week, in theory I should have stayed away from my computer but I really wanted to take this opportunity to improve the state of dpkg triggers in Debian. I already covered my work in another article: Trying to make dpkg triggers more useful and less painful. The result is not merged yet, I just asked a question to all package maintainers who are using triggers to be able to decide whether I ll merge it as is, or if I can make the new behavior the default one. Supporting users after Alioth s migration When I came back from my vacation, many services provided by Alioth.debian.org were non-functional after a migration to a new setup that involves two machines instead of one. Given that I used to be an Alioth admin, I know that in those periods you tend to be get bogged down on many user support requests. So I re-joined #alioth on IRC and tried to help a bit. I did investigate some of the reported problems and prepared fixes (updated scripts, configuration files, etc.) for some of the issues. I also created a list of remaining issues that should have lasted only a few days but that s still active because there are still regressions left. The most important things still missing are:

• proper support for delegation of rights. We used ACL setup by the admins in the past. With the new FusionForge, each project admin should be able to delegate rights to external roles . There s a Debian Developer role already but trying to grant him right fails
• access to the Ultimate Debian Database. Many tools rely on this database to work.
• anonymous FTP access to download project files.
• clear guidelines on how we re supposed to deal with websites that are updated by VCS hooks.
• clear guidelines on how we re supposed to deal with personal git repositories

Improving the 3.0 (quilt) source format I have made some proposals to change the way the new source format would work. The goals are to be less painful for packagers who are using a VCS, and to avoid unexpected changes slipping through a new patch generated by dpkg-source. It seems that the proposals are relatively consensual so I ll implement them at some point. Missing in action on my blog I did a lots of stuff for Debian between travel and vacation, and in the remaining time, I did not manage to write many articles for my blog. In fact, besides the article on my triggers work mentioned above I only published one interview: People behind Debian: Steve Langasek, release wizard. I ll try to do better this month! Thanks Many thanks to the people who gave me 151.61 in May. See you next month for a new summary of my activities.

One comment Liked this article? Click here. My blog is Flattr-enabled.

IIT Bombay, like most likely most Indian educational instituates, has some rules and regulations about the interaction between boys and girls that, at least to the uninitiated eye of a foreigner who was brought up in a liberal society, seem arbitrary and archaic. At IIT Bombay, for example, there may be no visits in hostels by students of the other gender (yes, there are separate boys and girls hostels) between 10pm and 7am, and during the day any such visit has to be registered at the reception security guard. And when there was need for more room for girls and they reassigned one wing of a boys hostel to the adjacent girls hostel, they closed the connection by bricking it and split the lawn by a fence. With barbed wire on top. I took this as a theme for a satirical inspection of these policies which comes to the conclusion that IIT Bombay is a very progressive institute that puts these rules in place as affirmative action towards same-gender relationships. After some discussion with the editors the text got actually published in the institutes bi-monthly newspaper Raintree , unfortunately only now, two weeks after I left India. You can read the text on the bottom of page 8 in the 6MB PDF file. I cannot predict how it will be received, but at least Utkarsh Raut, who illustrated the text, clearly got the message right. Thanks for the nice and very fitting drawing!

Well jffnms 0.9.0 was a, well, its a good example of what can go wrong without adequate testing. Having it written in PHP makes it difficult to test, because you can have entire globs of code that are completely wrong but are not activated (because the if statement proves false for example) and you won t get an error. It also had some database migration problems. This is the most difficult and annoying part of releasing versions of JFFNMS. There are so many things to check, like:

• What has changed between this version of the database?
• Does the development database have all the new fields?
• Will importing an old database and using the diffs give me the same result as importing the new database
• Does the structure field match the object which matches the database table

I ve been looking at sqlalchemy which is part of turbogears. It s a pretty impressive setup and lets you get on with writing your application and not mucking around with the low-level stuff. It s a bit of a steep learning curve learning python AND sqlalchemy AND turbogears but I ve got some rudimentary code running ok and its certainly worth it (python erroring on un-assigned varables but not forcing you to define them is a great compromise). The best thing is that you can develop on a sqlite database but deploy using mysql or postgresql with a minor change. Python and turbogears both emphasise automatic testing. Ideally the testing should cover all the code you write. The authors even suggest you write the test first then implement the feature. After chasing down several bugs, some of which I introduced fixing other bugs, automatic testing would make my life a lot easier and perhaps I wouldn t dread the release cycle so often.

Related articles

• I m beginning to hate PHP? (abdulapopoola.wordpress.com)
• pTest: PHP Unit Tester in 9 Lines Of Code (blogs.sitepoint.com)
• PHP to the Rescue! (blogs.sitepoint.com)

When I installed my new laptop, I decided to switch from sleepd to GNOME Power Manager (GPM). The rationale behind this decision was to get screen dimming for free while keeping other features because GPM uses UPower which uses pm-suspend and pm-powersave behind the scene. This means that it is easy to execute scripts on suspend or when the AC is unplugged by putting them in /etc/pm. I don t use a full GNOME desktop. My desktop is running FVWM which is just a window manager. However, I already use some parts of the GNOME environment:

• GDM as a display manager because it is the only one that is able to handle ConsoleKit correctly. This means that GDM is able to register your session to ConsoleKit and make it active. Without that, you won t be considered as the user sitting in front of the screen and DBus won t allow you to interact with most of your hardware unless you add yourself to a lot of groups. ConsoleKit enables the at_console property used by most policies.
• Network Manager to handle both wired and wireless connections. Connecting to some random AP using only command line tools is rather cumbersome (assume that the AP is using WPA). Connecting to a broadband network with a 3G dongle is even more cumbersome.
• GNOME bluetooth applet because interacting with BlueZ bluetooth stack is now done with DBus only and the command line tools have been removed. Therefore, you need to write your own tools or use this small applet that do most of the work for you.

What s working It happens that most of the features just do not work. However, suspend when closing the lid works fine. The icon in the systray works fine too (but there is a small bug). The screen dimming feature on idle also works (but there are annoying bugs with it). The visual feedback when pressing brightness keys works too.

What s not working It seems that I am not the only one to have problem with GPM: there are currently 115 bugs opened in the Debian BTS. If you want to get some debug output from gnome-power-manager, run it with --verbose flag. --debug flag does nothing (and supersedes --verbose).

Nothing happens when pressing the power button I have configured GPM to ask me what to do when I press the power button. But when I press the button, nothing happens. Looking at the source, here is the snippet of code that is executed:

1 2 3 4 5 6 7

if (policy == GPM_ACTION_POLICY_INTERACTIVE) GpmSession *session; egg_debug ("logout, reason: %s", reason); session = gpm_session_new (); gpm_session_logout (session); g_object_unref (session);

In fact, this is not GPM that will ask you the question, but GNOME session manager because GPM triggers logout. If you don t run a full GNOME session, nothing will happen. My workaround is just to set the action to Suspend .

Does not sleep when idle GPM is configured to go to sleep after 2 hours on AC or 30 minutes on battery. This does not work for me because idle detection is delegated to external programs. There are four variables used by GPM to determine if we are idle:

• session_idle which is the idle hint from ConsoleKit,
• idle_inhibited which is set when another program asks to disable idle detection (a video player which does not want the screen to be dimmed),
• suspend_inhibited which means a program do not want we going to sleep (a music player for example)
• x_idle which tells if X is idle or not (someone is moving the mouse or typing on the keyboard).

To allow GPM to suspend when we are idle, x_idle and session_idle must be true while suspend_inhibited and idle_inhibited must be false. For screen dimming purpose, you just need to have x_idle set to true and idle_inhibited set to false. Currently, only GNOME Screensaver seems to tell ConsoleKit if the session is idle or not. XScreenSaver does not contain anything about this. I am using xautolock with xlock and I am pretty sure they won t tell GPM if I am idle. You can use dbus-send to circumvent this problem:

1 2 3 4 5 6 7 8 9 10 11

$ dbus-send --system --dest=org.freedesktop.ConsoleKit \ > --type=method_call --print-reply --reply-timeout=2000 \ > /org/freedesktop/ConsoleKit/Manager \ > org.freedesktop.ConsoleKit.Manager.GetCurrentSession method return sender=:1.6 -> dest=:1.106 reply_serial=2 object path "/org/freedesktop/ConsoleKit/Session1" $ dbus-send --system --dest=org.freedesktop.ConsoleKit \ > --type=method_call --print-reply --reply-timeout=2000 \ > /org/freedesktop/ConsoleKit/Session1 \ > org.freedesktop.ConsoleKit.Session.SetIdleHint boolean:true method return sender=:1.6 -> dest=:1.108 reply_serial=2

While I understand what is the rationale behind those choices (no code duplicate and allowing external programs to hinder power management), it lacks some fallback in case you don t use GNOME Screensaver (which is the key component here). I first though this was bug #594706 but this is not the case. I have opened (and closed) bug #628755. UPDATED: Jump to the conclusion for an updated solution for this problem.

Brightness is not restored to the previous value after idle When GPM undims the screen, it does not restore the previous value. It seems to be bug #617310 which is marked as fixed in upstream. I did not investigate it.

Wrong number of batteries reported I only have one battery but after one suspend/resume cycle, GPM thinks I have two. Maybe this is a bug of UPower. Maybe this is bug #606434. I did not investigate it. Maybe there is an happy interaction with bug #456280.

Inability to set configure actions when the UPS runs out of battery This is bug #390602. In addition to laptop batteries, UPower also supports UPS. In this case, GPM displays a special icon to tell if the UPS is fully charged. However, there is no possibility to execute special actions when the UPS is unplugged, like hibernate after 10 minutes or something like this. This seems to be a problem with the interface because looking with gconftool-2, we can spot variables like low_ups or critical_ups which allow to set actions when the UPS is almost out of battery. Moreover, the UPS icon only displays after one suspend/resume cycle but I am too lazy to report and debug this issue. Since, the icon disappear if I restart GPM, I am confident that the bug is in GPM.

Conclusion The conclusion is that GPM is not really that buggy but it really needs to be run in a full-blown GNOME desktop. The main problem is not really GPM. New technologies like UPower and ConsoleKit get pushed by freedesktop.org initiative, they get implemented by GNOME (and, I suppose, KDE) because they have tons of people following the appropriate mailing lists and any alternative just gets crushed by all those unpublicized changes. UPDATED: I got several helpful comments about this problem. There are two possible solutions:

1. Use xfce4-power-manager. It handles brightness control in a better way and don t need an external program to tell when the current session is idle. It still needs a session manager to ask what to do when using the power button. The drawback to this solution is that you start to pull another desktop environment into your environment. You had some parts of GNOME and now you have some parts of XFCE. This solution was proposed by Sylvain Collilieux.
2. Use gnome-session, gnome-screensaver and keep gnome-power-manager. As pointed by Julien Valroff, gnome-screensaver needs gnome-session to detect idleness. However, gnome-session starts a whole GNOME desktop. Again, there are two solutions. The first one is to replace gnome-session by something lighter implementing the bare minimum to make gnome-screensaver happy. Another suggestion is to configure gnome-session to start your favorite environment.

I start mine from ~/.xsession and here is what I have added at the top of it:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

# If not done, restart ourself with gnome-session if [ -z "$SESSION_MANAGER" ]; then [ -d ~/.config/autostart ] mkdir ~/.config/autostart rm -f ~/.config/autostart/* cat <<EOF > ~/.config/autostart/xsession.desktop [Desktop Entry] Name=Xsession Comment=Start .xsession Exec=$(readlink -f $0) Type=Application X-GNOME-Autostart-enabled=true EOF exec gnome-session --autostart=$HOME/.config/autostart fi # Otherwise, keep starting stuff # [...] exec fvwm-crystal

Since we have people posting to various lists for the correct format for an /etc/apt/sources.list file, here's one including the non-free repositories (which are not part of Debian proper but provided for the convenience of Debian users). Hope this helps somebody sometime.

#

deb http://ftp.uk.debian.org/debian/ squeeze main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ squeeze main contrib non-free

deb http://ftp.uk.debian.org/debian/ squeeze-updates main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ squeeze-updates main contrib non-free

deb http://security.debian.org/ squeeze/updates main contrib non-free
deb-src http://security.debian.org/ squeeze/updates main contrib non-free

and, of course, it wrapped in the browser. There's a single space between squeeze and main and between main and contrib and between contrib and non-free for example. There are six lines in total - three pairs.

As you all probably know by know, DNSSEC has been enabled on the root ('.') since July 2010. And on most TLDs like .com shortly thereafter (in the specific case of .com, since March 2011). The Debian guide to turning on DNSSEC is useful but some things you need to know (after using it for a week or so).

BIND loves IPv6.

If you have 'listen-on-v6', set to yes and you roam to a non-IPv6 network. Your name resolutions can take 30+ seconds.Since I roam from a some networks they do have IP6 and some that do not, I have had to turn this setting off to achieve reasonable performance

Each new network requires manual intervention

Just like Andrew Cowie, I'm trying to get new features in NetworkManager. by blogging.My use case is simple if a bit geeky use the local resolver on my system irregardless of what I get dynamically (via DHCP) or automagically (via SLAAC).I can do this manually for each network I connect to, but it quickly looses its appeal.

Very little software takes advantage of DNSSEC (yet).

Apart from the happy DNSSEC campers, very little takes advantage of DNSSEC yet.Kind of like the early days of IP6. It would be nicer if websites stored the fingerprint of the SSL website in DNS and it could be cross-checked against what was sent.The effort to do so is underway at the IETF by the name of DANE.In fact publishing SSH key fingerprints via DNS is already possible RFC4255 but I am unaware of deployed support.

Things are progressing, and I suspect now is a great moment to get involved if you have spare time, in making it significantly harder for 3rd-parties to censor the Internet for everyone.

Two weeks ago, I was lucky to celebrate my 33th birthday with my closest friends in l'Alqueria. When asked to wish something before blowing the candles on Victor's delicious apple cake, I thought I have basically everything I'd want, but it'd be cool if some real changes happened in this world. Not long after, big demonstrations asking for Real Democracy Now happened throughout the Spanish state, and today, that Sunday seems to be an eternity away. Huge assemblies, thousands of strangers working together, more demonstrations, an election campaign eclipsed by #15m, hundreds of well thought, plausible claims published, the movement crossing the Spanish borders and leaking into France and Greece, the feeling that this is the good one, the basis for a fresh start that can make our lives better, our society a fair one and the possibility to stand in front of the fuckers who have made our lives a lot harder, to tell them it's not going to work like that anymore. All of this in 15 days. Unfortunately, revolution came when I'm in a crucial month to finish my studies and swamped with other little things, so I've been unable to be in the Valencian camp site for more than 3 days. Hopefully when I'm done on the 22nd people will still be taking the square, because Mako and Mika will be visiting then. Yay!

You'd think it'd be easy to reboot a PC, wouldn't you? But then you'd also think that it'd be straightforward to convince people that at least making some effort to be nice to each other would be a mutually beneficial proposal, and look how well that's worked for us.

Linux has a bunch of different ways to reset an x86. Some of them are 32-bit only and so I'm just going to ignore them because honestly just what are you doing with your life. Also, they're horrible. So, that leaves us with five of them.

• kbd - reboot via the keyboard controller. The original IBM PC had the CPU reset line tied to the keyboard controller. Writing the appropriate magic value pulses the line and the machine resets. This is all very straightforward, except for the fact that modern machines don't have keyboard controllers (they're actually part of the embedded controller) and even more modern machines don't even pretend to have a keyboard controller. Now, embedded controllers run software. And, as we all know, software is dreadful. But, worse, the software on the embedded controller has been written by BIOS authors. So clearly any pretence that this ever works is some kind of elaborate fiction. Some machines are very picky about hardware being in the exact state that Windows would program. Some machines work 9 times out of 10 and then lock up due to some odd timing issue. And others simply don't work at all. Hurrah!
  
• triple - attempt to generate a triple fault. This is done by loading an empty interrupt descriptor table and then calling int(3). The interrupt fails (there's no IDT), the fault handler fails (there's no IDT) and the CPU enters a condition which should, in theory, then trigger a reset. Except there doesn't seem to be a requirement that this happen and it just doesn't work on a bunch of machines.
  
• pci - not actually pci. Traditional PCI config space access is achieved by writing a 32 bit value to io port 0xcf8 to identify the bus, device, function and config register. Port 0xcfc then contains the register in question. But if you write the appropriate pair of magic values to 0xcf9, the machine will reboot. Spectacular! And not standardised in any way (certainly not part of the PCI spec), so different chipsets may have different requirements. Booo.
  
• efi - EFI runtime services provide an entry point to reboot the machine. It usually even works! As long as EFI runtime services are working at all, which may be a stretch.
  
• acpi - Recent versions of the ACPI spec let you provide an address (typically memory or system IO space) and a value to write there. The idea is that writing the value to the address resets the system. It turns out that doing so often fails. It's also impossible to represent the PCI reboot method via ACPI, because the PCI reboot method requires a pair of values and ACPI only gives you one.

Now, I'll admit that this all sounds pretty depressing. But people clearly sell computers with the expectation that they'll reboot correctly, so what's going on here?

A while back I did some tests with Windows running on top of qemu. This is a great way to evaluate OS behaviour, because you've got complete control of what's handed to the OS and what the OS tries to do to the hardware. And what I discovered was a little surprising. In the absence of an ACPI reboot vector, Windows will hit the keyboard controller, wait a while, hit it again and then give up. If an ACPI reboot vector is present, windows will poke it, try the keyboard controller, poke the ACPI vector again and try the keyboard controller one more time.

This turns out to be important. The first thing it means is that it generates two writes to the ACPI reboot vector. The second is that it leaves a gap between them while it's fiddling with the keyboard controller. And, shockingly, it turns out that on most systems the ACPI reboot vector points at 0xcf9 in system IO space. Even though most implementations nominally require two different values be written, it seems that this isn't a strict requirement and the ACPI method works.

3.0 will ship with this behaviour by default. It makes various machines work (some Apples, for instance), improves things on some others (some Thinkpads seem to sit around for extended periods of time otherwise) and hopefully avoids the need to add any more machine-specific quirks to the reboot code. There's still some divergence between us and Windows (mostly in how often we write to the keyboard controller), which can be cleaned up if it turns out to make a difference anywhere.

Now. Back to EFI bugs.

Puppet labs's use of the term puppetmaster is rather clever (in contrast to other un-necessarily offensive uses of "master" in the software world). While I appreciate the clever name, I'm less impressed with the concept. At May First/People Link we've spent the last several years (including the last couple months in earnest) working to transition management of our 90-some servers from a collection of hand-written bash scripts to puppet. Over the years, we've worked hard to keep our servers as secure as possible. We have a team of about a half dozen people who all have root access on all servers. It's all key-based access. To help mitigate a disaster if one person's keys were compromised, we've implemented monkeysphere on all servers, allowing us to easily revoke access. After spending so much time thinking through our root-access strategy and fully implementing the monkeysphere to reduce our exposure to a single point of vulnerability, I was disappointed by puppet's use of a puppet master. For those less familiar with puppet, it goes something like this: One server (or god forbid multiple servers), run an externally accessible daemon. Each and every server on your network runs a daemon as root that periodically communicates with the puppet master, receives new instructions, and then (again, as root) executes these instructions. In other words, if your puppet master is compromised, I'm not sure exactly what you would need to do, short of rebuilding every server in your network. To make matters worse, it seems as though some users generate and store all server ssh keys (private and public) on the puppet master and then push the private keys to their respective nodes. That means an intruder doesn't need to write to the puppet master, just reading these keys would be enough to compromise all servers in your network. There must be a better way. Puppet without masters After some web-searching, I found a promising thread on the puppet list asking what's lost without a puppet master. This thread lead to a couple other blogs by people who have worked out a system for using puppet without a master. It turns out that there are two distinct points of centralization with puppet. One is the puppet master (as described above). In addition, there is a concept called storeconfigs - which allows each node in the network to store information in a central database. For example, one server can store a request for an account to be setup on a backup server. The next time the backup server runs, it checks the storeconfigs, finds the request, and creates the user. It's possible to run puppet with storeconfigs but without running a puppet master (that avoids the hassle of running the puppet daemons, while providing the convenience of centralization). For our purposes, however, we decided to forego both the puppet master and storeconfigs. We did not want any form of centralization that would provide an additional point of vulnerability. As is common with puppet, we are storing our puppet recipes in a git repository. And, we are publishing to a single, canonical git repository on the Internet. On each node, we have two git repositories - one is a bare repo (that we can push to) and the other is a checked out repo (in /etc/puppet) that is read by puppet. The bare repo has a post-update hook the changes into the /etc/puppet directory, pulls in the changes from the bare repository, and runs puppet against the newly checked out files. Therefore, we can apply new puppet recipes to any server on the network with

git push <server>

No daemons: neither a master daemon nor a puppet daemon running on the node using up memory or providing a potential security hole. The git push happens over an ssh connection - since all system administrators already have root-level ssh access on every server - there is no need to grant any additional access above what we already have. Pushing works great - but with 90 nodes we don't want to have to push to 90 servers everytime we want a change made. That's where the canonical git repository comes in. A cron job runs a script on each node once an hour that runs git remote update from /etc/puppet. The script then checks the time stamp on the most recent gpg-signed tag and compares it with the time stamp of the current commit. If the most recent gpg-signed tag is newer, it verifies that the tag came from a list of authorized gpg keys (the very same gpg keys used by the monkeysphere to grant root level ssh access). If the gpg signature of the tag can be properly verified, then the changes are merged and puppet is run on the new recipes. What about privacy? One of the benefits of a puppet master setup is that nodes get configuration details on a need-to-know basis. The puppet master doesn't share the entire puppet repo - only the compiled manifest for the node with which it's communicating. Our solution to this problem was to go screaming in the other direction. As you might notice from our support wiki and ticket system, we generally favor transparency. Since we are publishing our entire puppet git repo publicly, there seems little point in trying to hide one node's configuration details from another node. That also means each node carries around about 4Mb of extra weight in the form of disk space for the git repo. That seems like a small price to pay for the resource savings of not running a puppetd process all the time. More differences As I've read the puppet lists, faqs and documentation, I've found yet more ways our use of puppet diverges from the norm. The first is a little thing really - most people seem to store all their node configurations in a single nodes.pp file. I'm not sure why. Fortunately, puppet's include syntax allows globbing, so we've created a directory and gave each server it's own .pp file. This arrangement makes it much easier to parse the configuration with tools other than puppet (like, Q. How many servers do we have? A. ls wc -l). Backup and Nagios monitoring without storeconfigs More significantly - there are some things we can't do since we are not using storeconfigs. While many puppet users add a variable, like $nagios = true before including their sshd class (which then causes the sshd class to store a configuration for the nagios server to monitor ssh on the node in question), we were forced to come up with alternatives. My first solution was to simply list all the servers that needed to be monitored in the server node configuration file for the nagios server. Ditto for the backup servers. This approach, however, proved cumbersome and error prone. When adding a new node, I now have to edit three files instead of one. And, how can I easily tell if all nodes have their nagios and/or backup configurations set? The solution was rather simple - there's more than one way to store a config for another node. Our nagios server is called jojobe.mayfirst.org and our backup server is luisa.mayfirst.org. A typical node.pp file looks like this:

node pietri.mayfirst.org  
  # node config goes here
 
if ( $fqdn == "jojobe.mayfirst.org )  
  nagios_montior   "pietri":  
 
if ( $fqdn == "luisa.mayfirst.org )  
  backup_access   "pietri":  
 

This way all configuration related to pietri stays in a single file. Host keys and granting access between servers storeconfigs is commonly used to distribute host ssh keys. Every node that is added to puppet has it's ssh host key stored centrally and then re-distributed to every other node. That way, you can ssh from node to node without ever getting the ssh fingerprint verification. Avoiding that prompt is particularly important when backing up from one server to another via automated scripts. storeconfigs can additionally be used to copy user's public ssh keys - thus granting user access between servers. Our solution to this problem: monkeysphere. Rather than maintaining our own private data store of keys, we publish (and sign) our ssh keys via the web of trust. In addition to server keys, each one of our servers' root user has an ssh-enabled gpg key (also publicly signed by us). By configuring each server to trust our system administrators' gpg keys for verifying other keys, we can both avoid the ssh fingerprint manual verification step and we can grant a root user on one server access to another server by simply dropping root@$server.mayfirst.org into an authorizeduserids file on the target server. There's no question - the setup was rather tedious (we're using runit to maintain an ssh-agent for each root user), however, now that's in place (and configured via puppet), it's a breeze to add new servers. The only extra step we have to take is to confirm and sign each new server's keys. This "extra" step not only allows our servers to verify each other, but also allows our users to verify the servers as well, so it's hardly an extra step at all. Shared modules There's a vibrant community of third party module developers for puppet. Rather than figure out the intricacies of having puppet configure sshd, for example, you can install a contributed sshd module and then you simply add:

include sshd

And you get a default sshd setup. Many of these modules are fairly well developed, offering the ability to easily customize your setup in a number of different ways. Unfortunately, most of the modules assume you are using storeconfigs and if you are not, they will either fail to work right or you will get noisy errors. At first, this seemed like a problem. However, as I built our puppet recipes, I found myself increasingly frustrated with the third party modules that we could use. Configuring servers is hard - and requires constant debugging and trouble shooting. puppet already provides a layer of abstraction between you and the server you are setting up. Given the benefits of puppet, I'm willing to spend the time learning the puppet syntax and asking the rest of our system administrators to do the same. This layer of abstraction is further compounded by our use of git to store the configurations (not a problem if you are git hero - but most of us are already struggling to get a handle on using git). Again, all seems worth it for the pay off. Now enter the puppet module. In addition to learning puppet syntax (and struggling with git) you now need to understand how the third party module works. With software programming, I typically don't need or want to learn how a library or class does what it does - that's the beauty of object-oriented programming: it hides the complexity. But when it comes to configuring the servers that I will be responsible for debugging and maintaining, I really need to know exactly what is happening. To further compound the problem, I found myself wading through third party module code designed to work on Debian, Ubuntu, CentOS, Redhat, gentoo... and more. We run entirely on Debian - we don't need any of this extra code. And, once I got rid of all the other operating systems, I was still left with a complex module that allows you to configure software in ways we'll never need. In the end, we tore out most of these third party modules and replaced them with file and exec puppet resources that did exactly what we needed them to do. Our code base is now much smaller and simpler. Not just a whiner I have a lot more to whine about (like why native resources for things like nagios that are so easily handled with the file resource?). However - the remarkable thing about puppet is that it's flexible. Despite some fairly substantial problems with the "typical" use of puppet, the program provides enough flexibility for us to use it in a way that fully meets our needs. After having built my own bash-based set of configuration scripts and deeply exploring puppet, I have a great appreciation for the difficulty of building system configuration software (we considered and rejected cf-engine and chef as not being any better). And, if you are still not convinced that puppet will work fo you ... you might consider a package I learned about after going down the puppet route: slack.

Nowadays, many websites provide a mobile version, like Wikipedia, which usually is a version tailored to device with less bandwidth and smaller screen. CSS Media Queries is a candidate recommendation from the W3C to support different stylesheets depending on the how the document is displayed. This allows to build a mobile version just by providing additional instructions in your CSS style sheet.

Using CSS Media Queries There are two ways to use CSS media queries. You can provide an additional CSS stylesheet and let the browser knows when to use it:

1	<link rel="stylesheet" media="screen and (max-width: 700px)" href="mobile.css">

When the width of the viewport is less than 700 pixels, the stylesheet mobile.css will be used. Another way to use CSS media queries is to declare a section inside your current CSS style sheet:

1 2 3 4 5

@media screen and (max-width: 700px) #article margin: 0.3em 0.2em;

While there are many available properties, the most two common ones will be max-width and min-width. You can use this feature to modify some aspects of your web site like reducing margins or hiding some extra navigational blocks.

Browser support Current versions of mobile browsers support CSS media queries: Safari Mobile, Android browser and Opera mobile will handle it without a glitch. If you use CSS media queries to provide a mobile version of your web site, you don t really have to worry about browser compatibility. There exists polyfills that will enable this feature on unsupported browsers like Internet Explorer 8. One of them is Respond which is a lightweight polyfill targeted at supporting only min-width and max-width in Internet Explorer 6, 7 and 8.

Example I have added CSS media queries to my website. Try it by resizing the window of your browser. Here are some of the changes depending on the width of the window:

• the sidebar transforms into a topbar
• the search box is hidden
• padding is reduced at various places

Here is the current look in a classic browser: If you reduce the size of your window, you will get something like this: Browse my CSS files for more examples. Look at the end of each file. For further information, have a look at the article from CSS Tricks.

I doubt I have ever read a book that had as significant an impact on me, and my act of reading it had on others, as this one. Conversations like this were frequent: Someone, upon seeing me reading my Kindle, would ask what I am reading. War and Peace. Oh. . . uhm, wow. Yeah, it s great. I m reading it for fun. Uhm, OK then, see you later. . . It seems to be so revered, and also so loathed, that I had to read it. At 1400 pages, it took me 8 months to finish, though I read several other entire books in that time. I feel rather unequal to the task of expressing how this book impacted me, let alone a review of it. And nonetheless, I also feel I would be remiss if I let it go past saying nothing. I was struck by so many things as I read War and Peace. Some of them I won t mention here and hope to turn into their own blog posts. Of the others, I felt I gained some sense of how the nobility and serfs in Russia (and, to a certain extent, Europe) thought about life, their position, and how things ran. Being a modern Kansan, this thought process was not familiar to me, and though I head read about it in history texts before, felt far more informed having read it in Tolstoy s novel. Although much of the novel centers around Napoleon s invasion of Russia in 1812, the work as a whole spans nearly two decades of time. Tolstoy s characters aren t static; they change over time. Some, yes, die; others go through hardships and triumphs that change them to their core. It evoked a feeling of nostalgia in me at times for the younger, childlike Natasha who was so full of simple delight in life. But then, a thousand pages later, the older Pierre finally was able to find simple delight in life too. Sometimes I have missed on the simple joy of being, and Jacob or Oliver or Terah remind me of that. Today Oliver and I read a book together, one that we read often, and we discovered an illustration of a tiny worm we had never noticed before. And the worm had a red hat ( hat is one of Oliver s favorite words right now.) The happy laughter as he pointed at the tiny hat, saying hat over and over, reminds me that sometimes children know how to live better than adults. Jacob later asked me how my day was, and I told him how I read a book on my Kindle, where I sat, and how I even read it lying down on the couch for a bit. At that he too laughed. As with some other wonderful, engrossing books, I was sad to reach the end of this one. I felt as if I was leaving a conversation early; fictional characters, yes, but their story wasn t over. And really, that was part of Tolstoy s point: things don t happen in isolation, and stories don t have clearly-defined start and end points. The novel touched on politics, religion, philosophy, free will, and just about every topic imaginable. It is, really, unfair to call it a just a novel. Here are some random quotes from the book, which I highlighted:

his heart was now overflowing with love, and by loving people without cause he discovered indubitable causes for loving them. How often we sin, how much we deceive, and all for what? All will end in death, all! A pleasant humming and whistling of bullets were often heard. Looking into Napoleon s eyes Prince Andrew thought of the insignificance of greatness, the unimportance of life which no one could understand, and the still greater unimportance of death, the meaning of which no one alive could understand or explain. If there is a God and future life, there is truth and good, and man s highest happiness consists in striving to attain them. We must live, we must love, and we must believe that we live not only today on this scrap of earth, but have lived and shall live forever, there, in the Whole, said Pierre, and he pointed to the sky. Prince Andrew stood leaning on the railing of the raft listening to Pierre, and he gazed with his eyes fixed on the red reflection of the sun gleaming on the blue waters. There was perfect stillness. Pierre became silent. The raft had long since stopped and only the waves of the current beat softly against it below. Prince Andrew felt as if the sound of the waves kept up a refrain to Pierre s words, whispering: It is true, believe it. He sighed, and glanced with a radiant, childlike, tender look at Pierre s face, flushed and rapturous, but yet shy before his superior friend. In Natasha Prince Andrew was conscious of a strange world completely alien to him and brimful of joys unknown to him, a different world, that in the Otradnoe avenue and at the window that moonlight night had already begun to disconcert him. Now this world disconcerted him no longer and was no longer alien to him, but he himself having entered it found in it a new enjoyment. All the kings, except the Chinese, wear military uniforms, and he who kills most people receives the highest rewards. But what is war? What is needed for success in warfare? What are the habits of the military? The aim of war is murder; the methods of war are spying, treachery, and their encouragement, the ruin of a country s inhabitants, robbing them or stealing to provision the army, and fraud and falsehood termed military craft. The habits of the military class are the absence of freedom, that is, discipline, idleness, ignorance, cruelty, debauchery, and drunkenness. And in spite of all this it is the highest class, respected by everyone. From the moment Pierre had witnessed those terrible murders committed by men who did not wish to commit them, it was as if the mainspring of his life, on which everything depended and which made everything appear alive, had suddenly been wrenched out and everything had collapsed into a heap of meaningless rubbish. Though he did not acknowledge it to himself, his faith in the right ordering of the universe, in humanity, in his own soul, and in God, had been destroyed. He had experienced this before, but never so strongly as now. When similar doubts had assailed him before, they had been the result of his own wrongdoing, and at the bottom of his heart he had felt that relief from his despair and from those doubts was to be found within himself. But now he felt that the universe had crumbled before his eyes and only meaningless ruins remained, and this not by any fault of his own. He felt that it was not in his power to regain faith in the meaning of life. When Princess Mary began to cry, he understood that she was crying at the thought that little Nicholas would be left without a father. With a great effort he tried to return to life and to see things from their point of view. Yes, to them it must seem sad! he thought. But how simple it is. The fowls of the air sow not, neither do they reap, yet your Father feedeth them, he said to himself and wished to say to Princess Mary; but no, they will take it their own way, they won t understand! They can t understand that all those feelings they prize so all our feelings, all those ideas that seem so important to us, are unnecessary. We cannot understand one another, and he remained silent. Love hinders death. Love is life. All, everything that I understand, I understand only because I love. Everything is, everything exists, only because I love. Everything is united by it alone. Love is God, and to die means that I, a particle of love, shall return to the general and eternal source. These thoughts seemed to him comforting. People speak of misfortunes and sufferings, remarked Pierre, but if at this moment I were asked: Would you rather be what you were before you were taken prisoner, or go through all this again? then for heaven s sake let me again have captivity and horseflesh! We imagine that when we are thrown out of our usual ruts all is lost, but it is only then that what is new and good begins. While there is life there is happiness. There is much, much before us. I say this to you, he added, turning to Natasha. During that twenty-year period an immense number of fields were left untilled, houses were burned, trade changed its direction, millions of men migrated, were impoverished, or were enriched, and millions of Christian men professing the law of love of their fellows slew one another. What does all this mean? Why did it happen? What made those people burn houses and slay their fellow men? What were the causes of these events? What force made men act so? These are the instinctive, plain, and most legitimate questions humanity asks itself when it encounters the monuments and tradition of that period.

This week saw again some progress for samba packages. May is indeed my samba month..:-). So, I uploaded samba 3.5.8~dfsg-3 and -4. For whatever reason, -3 was rejected three times and, as I already tagged it in our SVN then started adding changes for an upcoming -4, I finally uploaded that -4. It fixed about 10 more bugs and the bug count is now 62. Upstream also release 3.6.0-rc1, which I uploaded in experimental and which fixed an RC bug. I also began working on Pootle 2.1.6 as an attempt to resync with upstream. I integrated patches by Alaa Abd El Fattah to have it use dbconfig-common to setup a database. However, this revealed that more invasive work is needed to satisfy dependencies...that may depend on the database backend chosen by users. As I'm quite ignorant with these things, I might need some help, here. I uploaded a new release of xgridfit to fix an important bug and avoid an NMU. xgridfit is team-maintained in pkg-fonts. I'm not very active in this team ATM. I shoul dresume work for it as I proposed a talk about it at Debconf11..:-) I continued hard work on French DDTP. Martijn made changes to stats pages and it makes interesting challenges to complete. You know I like challenges.. Smith reviews continue to go on: I launched a call for translations for slapos.tool.format and started the review of ntfs-3g. Finally, on Saturday....I upgraded churro (aka i18n.debian.net) to squeeze. Really. All alone..:-)...on a server that lies in Spain. "Meme pas peur" (not even scared) as we say in French. I'm really highly confident in squeeze upgrades now....and I was right. After only 5 hours work (mostly looking at packages downloads and configuration), nearly everything was back to work. As of now, we got three glitches, with only one bignot yet fixed:

• the wiki that uses MoinMoin is severely broken. So, as of now, http://i18n.debian.net yields an error (but all other i18n.d.n URLs are working)
• HTTPS was broken for ddtp.debian.net, which prevented people to login to work on the DDTP. I partly fixed that today (Monday) and Felipe will have a closer look at VirtualHosts in Apache to fix the remaining glitches
• cron jobs for i18n robots were no longer working. After some headache and googling, it turned out one file in /etc/cron.d was group-writable, which cron translates to "WRONG INODE INFO".

Quite active week, finally. This week should be quieter as I'm on holidays with Elizabeth in our country house in Normandy, in Seine valley (this house belonged to Elizabeth parents and she inherited it). I'm in deep love with this house and there are tons of things to do there...which leaves few room for hacking. We'll see what will be next weekly summary!