There are a lot of different workflows to maintain Debian packages under a Version Control System. Some people prefer to only keep the debian directory, some the whole source. And in the latter category, some prefer the source tree to be patched with Debian changes, while others prefer to keep it unpatched and exclusively use debian/patches. It turns out the former and the latter don t work so well in one specific case that any package may hit some day ; and that day, you realize how wrong you were not tracking the entire patched source. That happened to me recently, though instead of actually going forward and switch to tracking the patched source, I cheated and simply ditched the patch, because I didn t strictly need it. In all fairness, this is not only a case against not tracking patched source, but also a case of the 3.0 (quilt) source format being cumbersome. In my specific case, I cherry picked an upstream patch modifying and adding some test cases related to a cherry-picked fix. One of the added test cases was a UTF-16 file. UTF-16 files can t be diff ed nor patch ed except in the git patch format, but quilt doesn t use nor support that. The solution around this limitation of 3.0 (quilt) format is to include the plain modified file in the Debian tarball, and add its path to debian/source/include-binaries. On the VCS side of things, it means you have to modify the file in the source directory, and fill debian/source/include-binaries accordingly. Wait. Modify the file in the source directory ? But the other files aren t ! They re tracked by patches ! So here you are, with all of your modifications exclusively in debian/patches except one.

mksh-current has just gained an experimental recursive parser for command substitutions, fixing RedHat BZ#496791 and decades-old complaints about the pdksh codebase, compared to AT&T ksh93. (GNU bash could also do the example, but not some other things mksh(1) parses fine now.)

This means that things like the following work now.

Next on my TODO is the complete rewrite of the read built-in command, as well as its documentation. I think that the (reduced) goals for mksh R40 will have been met by then, except porting to LynxOS and MPE, but we re working on it, and re-testing Syllable and Plan 9). Of course, a release implies testing on a lot of the supposedly supported platforms, so it won t be out immediately . Though, associative arrays have been removed from the R40 goals, so that I can at least get a new release out. Note that Debian and OpenSuSE Buildservice users have been provided with somewhat well-tested mksh-current snapshots for a while already, and Gentoo users can use the live ebuild ; there s always compiling from source too

In LaTeX, it seems like you can't define a command with a really optional argument, using \newcommand. You can make commands with arguments having a default value though. Now, I found myself in need of having such a functionality. I had to google a while, but finally found it, so I'm posting it here, both to share knowledge and to remember it in future :) Suppose you want to do something like \mycmd foo and \mycmd foo bla , doing different things (in my case, I needed to add the second argument enclosed by parenthesis in the TOC and other places, but only if it was present) Here's the code:

\def\mycmd#1 \def\tempa #1 \futurelet\next\mycmd@i % Save first argument
\def\mycmd@i \ifx\next\bgroup\expandafter\mycmd@ii\else\expandafter\mycmd@end\fi %Check brace
\def\mycmd@ii#1 ... %Two args
\def\mycmd@end ... %Single args

In the last two lines of the code, use \tempa for your first argument, and #1 for your second optional argument. If you need spaces there (maybe as part of some text), be sure to escape them with a backslash \. I think it's expandable for additional arguments, but I haven't tried, and I don't feel like getting my hands dirty with TeX yet

The test suite for recently added ODBC support in Gammu was consistently failing on Win64 platform (all others were just fine). It took me some time to figure out why. The reason is SQLLEN type, which is in some sort special, that generated code for it is broken. All started with pretty much standard retrieving value from ODBC result:

SQLLEN size;
SQLRETURN ret;
/* Figure out string length */
ret = SQLGetData(res->odbc, 1, SQL_C_CHAR, NULL, 0, &size);
if (!SQL_SUCCEEDED(ret))  
    return NULL;
 
/* Did not we get NULL? */
if (size == SQL_NULL_DATA)  
    return NULL;
 
/* Allocate buffer for string */
out = reallocate(out, size + 1);

The first problem was comparing of size against SQL_NULL_DATA. It simply always failed even if size did contain -1 (what is actually value of SQL_NULL_DATA). Yesterday, I've come out with typecasting magic that worked fine for this case. However what I've missed is that even reallocate is failing with this parameter. No matter what the size would be, it would return NULL. Typecasting again did help here. Hey, should not be compiler clever enough to typecast this for me? It turns out that in case of MinGW64 it is not. Anybody has suggestion why? At the end I ended up with pretty ugly duplicating of the variable just to avoid mixing it up in future changes (as would happen with typecasting everywhere). I'd really like to know why my assumptions are wrong in this case.

Filed under: English Gammu 0 comments Flattr this!

As part of moving my site around, I needed a bunch of redirects so that http://enc.com.au/docs/linuxload.html now becomes http://enc.com.au/2010/07/manually_calculating_process_times/ because its now controlled by WordPress. so I used the RedirectPermanent feature of mod_alias to do it with lines like: So you come in on /docs/linuxload.html and redirect to the blog entry, simple really! It actually works, kinda, but the log files fill with things like: What is going on? Why won t Apache just be quiet and be happy? The reason is in the Redirect Directive documentation on the 2.0 mod_alias page:

Also, URL-path must be a fully qualified URL, not a relative path, even when used with .htaccess files or inside of <directory> sections.

But I m running Apache 2.2 and the 2.2 mod_alias page says:

The new URL should be an absolute URL beginning with a scheme and hostname, but a URL-path beginning with a slash may also be used, in which case the scheme and hostname of the current server will be added.

That s it, you two choices:

• Use relative urls and have Apache complain
• Use absolute urls and have a happy Apache

Changing the above config snippet to use absolute paths fixed it.

This probably won't affect many people, but I wanted to note it here just in case. I've now finished the (long-delayed) work of updating my personal archive for the squeeze release. There is now a new wheezy distribution and squeeze is now treated as stable. lenny has become oldstable. For my future reference and for anyone else for whom it might be helpful, the changes required in reprepro:

1. Update the distributions config file to add the wheezy distribution with a suite of testing and a pull policy of everything. Change the suite of squeeze to stable and the pull policy to arch-all. (These are pull policies defined elsewhere in my configuration that do what they say.) Change the suite of lenny to oldstable.
2. Update the incoming config file to map the suites to new release code names.
3. Pull all packages from sid into the new wheezy distribution:

       env GNUPGHOME=/srv/debian/keyring reprepro -b /srv/debian pull

4. Update the archive symlinks:

       reprepro -b /srv/debian --delete createsymlinks
       reprepro -b /srv/debian createsymlinks
   

That's all there was to it. Easier than I was expecting it to be.

Christian is a figure of Debian, not only because of the tremendous coordination work that he does within the translation project, but also because he s very involved at the social level. He s probably in the top 5 of the persons who attended most often the Debian conference. Christian is a friend (thanks for hosting me so many times when I come to Paris for Debian related events) and I m glad that he accepted to be interviewed. He likes to speak and that shows in the length of his answers but you ll be traveling the world while reading him. My questions are in bold, the rest is by Christian. Who are you? I am a French citizen (which is easy to guess unless you correct my usual mistakes in what follows). I m immensely proud of being married for nearly 26 years with Elizabeth (who deserves a statue from Debian for being so patient with my passion and my dedication to the project). I m also the proud father of 3 wonderful kids , aged 19 to 23. I work as team manager in the Networks and Computers Division of Onera the French Aerospace lab , a public research institute about Aeronautics, Space and Defense. My team provides computer management services for research divisions of Onera, with a specific focus put on individual computing. I entered the world of free software as one of the very first users of Linux in France. Back in the early 1990 s, I happened (though the BBS users communities) to be a friend of several early adopters of Linux and/or BSD386/FreeBSD/NetBSD in France. More specifically, I discovered Linux thanks with my friend Ren Cougnenc (all my free software talks are dedicated to Ren , who passed away in 1996). You re not a programmer, not even a packager. How did you come to Debian? I m definitely not a programmer and I never studied computing (I graduated in Materials Science and worked in that area for a few years after my PhD). However, my daily work always involved computing (I redesigned the creep testing laboratory and its acquisition system all by myself during my thesis research work). An my hobbies often involved playing with home computers, always trying to learn about something new. So, first learning about a new operating system then trying to figure out how to become involved in its development was quite a logical choice. Debian is my distro of choice since it exists. I used Slackware on work machines for a while, but my home server, kheops, first ran Debian 1.1 when I stopped running a BBS on an MS-DOS machine to host a news server. That was back in October 1996. I then happened to be a user, and more specifically a user of genealogy software, also participating very actively in Usenet from this home computer and server, that was running this Debian thing. So, progressively, I joined mailing lists and, being a passionate person, I tried to figure out how I could bring my own little contribution to all this. This is why I became a packager (yes, I am one!) by taking over the geneweb package, which I was using to publish my genealogy research. I applied as DD in January 2001, then got my account in July 2001. My first upload to the Debian archive occurred on August 22nd 2001: that was of course geneweb, which I still maintain. Quite quickly, I became involved in the work on French localization. I have always been a strong supporter of localized software (I even translated a few BBS software back in the early 90 s) as one of the way to bring the power and richness of free software to more users. Localization work lead me to work on the early version of Debian Installer, during those 2003-2005 years where the development of D-I was an incredibly motivating and challenging task, lead by Joey Hess and his inspiring ideas. From user to contributor to leader, I suddenly discovered, around 2004, that I became the coordinator of D-I i18n (internationalization) without even noticing You re the main translation coordinator in Debian. What plans and goals have you set for Debian Wheezy? As always: paint the world in red. Indeed, this is my goal for years. I would like our favorite distro to be able to be used by anyone in the world, whether she speaks English, Northern Sami, Wolof, Uyghur or Secwepemcts n. As a matter of symbol, I use the installer for this. My stance is that one should be able to even install Debian in one s own language. So, for about 7 years, I use D-I as a way to attract new localization contributors. This progress is represented on this page where the world is gradually painted in red as long as the installer supports more languages release after release. The map above tries to illustrate this by painting in red countries when the most spoken language in the country is supported in Debian Installer. However, that map does not give enough reward to many great efforts made to support very different kind of languages. Not only various national languages, but also very different ones: all regional languages of Spain, many of the most spoken languages in India, minority languages such as Uyghur for which an effort is starting, Northern Sami because it is taught in a few schools in Norway, etc., etc. Still, the map gives a good idea of what I would like to see better supported: languages from Africa, several languages in Central Asia. And, as a very very personal goal, I m eagerly waiting for support of Tibetan in Debian Installer, the same way we support its sister language, Dzongkha from Bhutan. For this to happen, we have to make contribution to localization as easy as possible. The very distributed nature of Debian development makes this a challenge, as material to translate (D-I components, debconf screens, native packages, packages descriptions, website, documentation) is very widely spread. A goal, for years, is to set a centralized place where translators could work easily without even knowing about SVN/GIT/BZR or having to report bugs to send their work. The point, however, would be to have this without making compromises on translation quality. So, with peer review, use of thesaurus and translation memory and all such techniques. Tools for this exist: we, for instance, worked with the developers of Pootle to help making it able to cope with the huge amount of material in Debian (think about packages descriptions translations). However, as of now, the glue between such tools and the raw material (that often lies in packages) didn t come. So, currently, translation work in Debian requires a great knowledge of how things are organized, where is the material, how it can be possible to make contribution reach packages, etc. And, as I m technically unable to fulfill the goal of building the infrastructure, I m fulfilling that role of spreading out the knowledge. This is how I can define my coordinator role. Ubuntu uses a web-based tool to make it easy to contribute translations directly in Launchpad. At some point you asked Canonical to make it free software. Launchpad has been freed in the mean time. Have you (re)considered using it? Why not? After all, it more or less fills in the needs I just described. I still don t really figure out how we could have all Debian material gathered in Rosetta/Launchpad .and also how Debian packagers could easily get localized material back from the framework without changing their development processes. I have always tried to stay neutral wrt Ubuntu. As many people now in Debian, I feel like we have reached a good way to achieve our mutual development. When it comes at localization work, the early days where the everything in Rosetta and translates who wants stanza did a lot of harm to several upstream localization projects is, I think, way over. Many people who currently contribute to D-I localization were indeed sent to me by Ubuntu contributors .and by localizing D-I, apt, debconf, package descriptions, etc., they re doing translation work for Ubuntu as well as for Debian. Let s say I m a Debian user and I want to help translate Debian in my language. I can spend 1 hour per week on this activity. What should I do to start? Several language teams use Debian mailing lists to coordinate their work. If you re lucky enough to be a speaker of one of these languages, try joining debian-l10n-<yourlanguage> and follow what s happening there. Don t try to immediately jump in some translation work. First, participate to peer reviews: comment on others translations. Learn about the team s processes, jargon and habits. Then, progressively, start working on a few translations: you may want to start with translations of debconf templates: they are short, often easy to do. That s perfect if you have few time. If no language team exists for your language, try joining debian-i18n and ask about existing effort for your language. I may be able to point you to individuals working on Debian translations (very often along with other free software translation efforts). If I am not, then you have just been named coordinator for your language I may even ask you if you want to work on translating the Debian Installer. What s the biggest problem of Debian? We have no problems, we only have solutions We are maybe facing a growth problem for a few years. Despite the increased welcoming aspects of our processes (Debian Maintainers), Debian is having hard times in growing. The overall number of active contributors is probably stagnating for quite a while. I m still amazed, however, to see how we can cope with that and still be able to release over the years. So, after all, this is maybe not a problem Many people would point communication problems here. I don t. I think that communication inside the Debian project is working fairly well now. Our famous flame wars do of course still happen from time to time, but what large free software project doesn t have flame wars? In many areas, we indeed improved communication very significantly. I want to take as an example the way the release of squeeze has been managed. I think that the release team did, even more this time, a very significant and visible effort to communicate with the entire project. And the release of squeeze has been a great success in that matter. So, there s nearly nothing that frustrates me in Debian. Even when a random developer breaks my beloved 100% completeness of French translations, I m not frustrated for more than 2 minutes. You re known in the Debian community as the organizer of the Cheese & Wine Party during DebConf. Can you tell us what this is about? This is an interesting story about how things build themselves in Debian. It all started in July 2005, before DebConf 5 in Helsinki. Denis Barbier, Nicolas Fran ois and myself agreed to bring at Debconf a few pieces of French cheese as well as 1 or 2 bottles of French wine and share them with some friends. Thus, we settled an informal meeting in the French room where we invited some fellows: from memory, Benjamin Mako Hill, Hannah Wallach, Matt Zimmermann and Moray Allan. All of us fond of smelly cheese, great wine plus some extra p t home-made by Denis in Toulouse. It finally happened that, by word of mouth, a few dozens of other people slowly joined in that French room and turned the whole thing into an improvized party that more or less lasted for the entire night. The tradition was later firmly settled in 2006, first in Debconf 6 in Mexico where I challenged the French DDs to bring as many great cheese as possible, then during the Debian i18n meeting in Extremadura (Sept 2006) where we reached the highest amount of cheese per participant ever. I think that the Creofonte building in Casar de C ceres hasn t fully recovered from it and is still smelling cheese 5 years after. This party later became a real tradition for DebConf, growing over and over each year. I see it as a wonderful way to illustrate the diversity we have in Debian, as well as the mutual enrichment we always felt during DebConfs. My only regret about it is that it became so big over the years that organizing it is always a challenge and I more and more feel pressure to make it successful. However, over the years, I always found incredible help by DebConf participants (including my own son, last year a moment of sharing which we will both remember for years, i think). And, really, in 2010, standing up on a chair, shouting (because the microphone wasn t working) to thank everybody, was the most emotional moment I had at Debconf 10. Is there someone in Debian that you admire for their contributions? So many people. So, just like it happens in many awards ceremonies, I will be very verbose to thank people, sorry in advance for this. The name that comes first is Joey Hess. Joey is someone who has a unique way to perceive what improvements are good for Debian and a very precise and meticulous way to design these improvements. Think about debconf. It is designed for so long now and still reaching its very specific goal. So well designed that it is the entire basis for Joey s other achievement: designing D-I. Moreover, I not only admire Joey for his technical work, but also for his interaction with others. He is not he loudest person around, he doesn t have to .just giving his point in discussion and, guess what? Most of the time, he s right. Someone I would like to name here, also, is Colin Watson. Colin is also someone I worked with for years (the D-I effect, again ) and, here again, the very clever way he works on technical improvements as well as his very friendly way to interact with others just make it. And, how about you, Rapha l? I m really admirative of the way you work on promoting technical work on Debian. Your natural ability to explain things (as good in English as it is in French) and your motivation to share your knowledge are a great benefit for the project. Not to mention the technical achievements you made with Guillem on dpkg of course! Another person I d like to name here is Steve Langasek. We both maintain samba packages for years and collaboration with him has always been a pleasure. Just like Colin, Steve is IMHO a model to follow when it comes at people who work for Canonical while continuing their involvment in Debian. And, indeed, Steve is so patient with my mistakes and stupid questions in samba packaging that he deserves a statue. We re now reaching the end of the year where Stefano Zacchiroli was the Debian Project Leader. And, no offense intended to people who were DPL before him (all of them being people I consider to be friends of mine), I think he did the best term ever. Zack is wonderful in sharing his enthusiasm about Debian and has a unique way to do it. Up to the very end of his term, he has always been working on various aspects of the project and my only hope is that he ll run again (however, I would very well understand that he wants to go back to his hacking activities!). Hat off, Zack!I again have several other people to name in this Bubulle hall of Fame : Don Armstrong, for his constant work on improving Debian BTS, Margarita Manterola as one of the best successes of Debian Women (and the most geeky honeymoon ever), Denis Barbier and Nicolas Fran ois because i18n need really skilled people, Cyril Brulebois and Julien Cristau who kept X.org packaging alive in lenny and squeeze, Otavio Salvador who never gave up on D-I even when we were so few to care about it. I would like to make a special mention for Frans Pop. His loss in 2010 has been a shock for many of us, and particularly me. Frans and I had a similar history in Debian, both mostly working on so-called non technical duties. Frans has been the best release manager for D-I (no offense intended, at all, to Joey or Otavio .I know that both of them share this feeling with me). His very high involvment in his work and the very meticulous way he was doing it lead to great achievements in the installer. The Installation Guide work was also a model and indeed a great example of non technical work that requires as many skills as more classical technical work. So, and even though he was sometimes so picky and, I have to admit, annoying, that explains why I m still feeling sad and, in some way, guilty about Frans loss. One of my goals for wheezy is indeed to complete some things Frans left unachieved. I just found one in bug #564441: I will make this work reach the archive, benefit our users and I know that Frans would have liked that.

---

Thank you to Christian for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

7 comments Liked this article? Click here. My blog is Flattr-enabled.

It looks like many peoples decided it is right time to bloat my system with stuff I don't use. The first think I did not like when squeeze went out was libpcsclite1 pulling pcsd and hal into my system. This is being solved on two fronts - porting pcsd to udev (in #612971) and disabling libpcslite1 support in wpasupplicant. Both of them being good ideas. What actually drove me to writing this post is today's update, where aptitude suddenly wanted to install whole latex and thus using about 760MiB of extra disk space. I know disk space is supposed to be cheap these days, but it's not that cheap with SSD in notebook. The culprit turned out to be doxygen, which up to now happily lived without single bit of latex, but now needs it (though temporarily according to changelog). I know it is tempting to enable every possible feature in your package, but in same cases it is really not something what most of people would appreciate.

Filed under: Debian English 4 comments Flattr this!

I was interested to hear about a company here in the UK called ALLOW Ltd., offering marketing database management under a we ll get you off lists, then pay you to go back on at your pleasure basis. That sounds a fair deal to me, so I decided to sign up for it.

Our technology is built using some of the best and most secure tools in the industry. We have partnered with infrastructure providers who handle some of the most sensitive data in the UK (such as medical and financial records). Both the digital and physical security measures we have implemented are amongst the strongest available anywhere. This includes full encryption of all data at all times, full implementation of secure socket layers, security certificates and physical restriction of access to the data, our servers and our offices. Our systems have been fully penetration tested (that means we ve asked people to try and break in).

(There are other suitable assertions in various places they even have a set of principles about safeguarding data.) Unfortunately, this promise is rather undermined in several ways after noticing the first couple, I did a little digging to see what else was exploitable. Here s the final part of the joining process, where you choose a username and password combination: The text I ve cropped too eagerly says Choosing a secure password is an essential part of protecting your personal information , or thereabouts. I duly chose a complex password that fitted the requirements, and to my surprise it was rejected. I tried another, and it was rejected; then a third and a fourth. By trial and error I worked out what was going on: 1. The password must contain only the listed special characters, not just include one of them. That s a bit of a problem, because even assuming a basic ASCII set, 15 characters are unavailable to users; 80 are left, so that s about a 15% fall in the available combinations*. Not a good start. More concerning is the presence of a security question field. It s used for resetting the password in the event losing it, but this technique for recovery has long been ridiculed the shared secret is often common knowledge amongst friends, and sometimes (as in this case) the available questions are fairly easy for an attacker to find the answer to in public records or solicit from the victim without arousing much suspicion: 2. The security questions available include First pet s name and worse, First school name . It s pretty pointless enforcing stringent password requirements, and then bypassing them with something so susceptible to a dictionary attack. I was pleased to find that failing to log in to an account more than a few times results in a temporary lockout, which should deter casual brute force attacks. But I wanted to know how that security question would be used, so I forgot my password and followed the links to reset it. Here s the form: Actually the first form, not shown here, initially just asks for a username, giving an error message if it isn t registered, and here s another problem: 3. The password reset process confirms the existence, or non-existence, of a given username half the credentials required to log in to any visitor. I d be prepared to take a bet that most users will choose What was the name of your first school? as a security question. The first pet you have is often at such a young age you can t remember it clearly; the name of the street you grew up on might change a couple of times if you moved house. But first school I attended? I ll never forget that, so it makes most sense to use as a backup password . It s also the best one for an attacker to try and find out from public sources. But that aside, as you can see the password is not generated at random and communicated to the real account holder out-of-band, in the manner of many other sites. Instead: 4. A new password is immediately set to a value already known by the attacker. Once inside, an attacker can also change the security question or answer, or both, so you can t even regain your account by telephoning the company unless you can convince them you re genuine, in which case the security question was a total waste of time anyway. I awarded some marks for notifying the user by email that the password has been changed, but immediately docked them again because bingo! You re now a victim of identity theft! Let s assume you ve been locked out, the security question has been changed and you want your account back. ALLOW don t let you telephone them; you either have to dig around and find an address to send an email, which we all know can be intercepted, or (and you re encouraged to) contact them through a form on the site. You ll probably include some personal details, because you want to convince them of your real identity; indeed, two of the options on the form are I ve got a question and Something doesn t work . I sent my findings through this very form, under the latter heading, and to my surprise: 5. Despite promises of full encryption of all data at all times, full implementation of secure socket layers , the contact form is transmitted to ALLOW in the clear, with no protection whatsoever. So now anyone listening in your connection knows all about you too: your ISP, any of the peers along the route, the deep packet inspection advertisers if your ISP is less than reputable, and the neighbour who connects to your wireless and slips you a fiver every month for the privilege. Nice work, privacy specialists. (For the record:

• I have sent these findings to ALLOW and await a response have a response.
• Yes, this scenario is unlikely, but it doesn t fill me with confidence about the rest of their business activities.)

* please feel free to correct my maths. It was never my strongest subject.

---

Privacy specialists should hire security specialists is a post from: jwiltshire.org.uk Flattr

As mentioned earlier this week, I changed the server for my hoster from server4you to Hetzner. Because the contract for my old server is still running until the 14th of April, I thought I can make some good use of it by running an Tor exit node on it. Tor, The onion router is a world-wide network of server to anonymize network connections, and used for example by freedom-loving people in repressive countries, or by Facebook users in repressively proxied university networks Naturally, such a system is also used by people with lesser motives, and after nearly one week of running the server, some complaints were reaching server4you a honeynet supposedly detected botnet activity from my IP address, another company hired by Paramount Pictures claimed that someone downloaded Iron Man 2 over BitTorrent via my server. These were forwarded to my by server4you, demanding an explanation. I explained that I am running a Tor node, that such things are unavailable, and that neither I nor server4you is going to be held responsible. Nevertheless, they insist that I should stop whatever I am doing (I am not sure if they really understood what tor is), and when I said that I won t, they decided to unilaterally and immediately end my contract by tomorrow. Thus a powerful exit node that might have made life better for Tor users is doing to disappear again. They will not reimburse the advance fee that I had paid in advance and made a non-specific threat about further claims they might have. So server4you was, at least in my case, not only an unreliable and inflexible provider, they also prefer to cut off their customer s server just because of two complaints by third parties. I conclude that this is not a hoster that you should trust important services to. And I am not a unique case: There are reports of similar server shut-downs by server4you (in German).

[ If you haven't heard of this debate yet, you probably want to read Vincent Untz's and Mark Shuttleworth's blog posts. ] Last year, I gave a talk at FOSDEM about Debian and Ubuntu (slides of a slightly updated version). One of my points was that Debian has better values, being a volunteer-driven project where decisions are taken in the open. In contrast, Ubuntu is a project managed and controlled by Canonical, and recent history has shown that Canonical had no problem imposing some decisions to the developers community: first with the inclusion of UbuntuOne, then the switch from Google to Yahoo! to Google as the default search engine, both to increase revenue streams. So one should not be surprised by the Banshee story. I find Mark s justification quite difficult to buy, and similar to Apple s model where 30% of the revenues from the App Store go to Apple, and 70% to the seller of the application. For those wondering how much work was done by Canonical directly on the Banshee package: the banshee package in Ubuntu natty is based on the package currently in Debian experimental. The package is mainly maintained in Debian by an Ubuntu developer not paid by Canonical AFAIK, Chow Loong Jin. There are some differences between the Debian package and the Ubuntu package, which are fairly limited (full diff here) and mainly about enabling UbuntuOne and disabling the other music stores. That patch itself apparently was provided by Jo Shields, who doesn t seem to be a canonical employee. (Feel free to correct me) I think that one of the conclusions to draw from this story is that we now have several proofs that Ubuntu isn t a volunteer-driven project, and that volunteer contributors should really decide whether they are OK with working for free for Canonical, or if their free time would be better spent on other projects where they actually have a chance to influence decisions. From the Debian POV, I m still convinced that we should take the feedback that we receive from Ubuntu in consideration to improve our Debian packages (by looking at patches made by Ubuntu, or at bugs reported in Launchpad). But my motivation for contributing to Ubuntu directly has just diminished a bit more (not that it was very high before).

Downloading videos from YouTube isn't a problem thanks to tools like clive. But fetching all videos of a playlist was always a little bit tricky. There is clivescan, but it requires user intervention and needs Tk. Other tools have focused on feed parsing, so in case you have a playlist feed you can then download all (listed) videos. But none of the tools offered me a simple way to download all videos in a playlist from the command line. That's when I started writing ytplaylistfetcher, a simple shell script aiming to parse a YouTube playlist, extract all unique video ids and pass the list on to clive for downloading. By now ytplaylistfetcher is pretty much complete and there aren't many changes ahead (unless YouTube changes its page layout again, e.g. back to multi-page playlists). At the moment ytplaylistfetcher can handle the three common playlist link formats. If you've encountered another format or found a playlist link that doesn't work, let me know. ytplaylistfetcher has just one limitation in my opionin (but one I can live well with): it is limited to YouTube playlists. But that isn't a severe drawback in my opinion, as I rarely receive playlist links to other video hosting platforms (at least none where a simple wget call doesn't solve the problem. This little script show-cases one reason, why I like Linux so much: there is always an easy way to extend existing functionality.

Dear Mr. Rabellino, Actions speak louder than words. So stop giving interviews and do your homework. Release documentation without license and patent threats surrounding them (how about all protocols related to Sharepoint and Exchange?) Support stuff like Ogg Theora in HTML 5 for IE and the OpenDocument format in MS Office. Admit that you just bought the OOXML standard and that you can't even implement it yourself. Hand over your patent portfolio to the Open Invention Network. Use your cash reserves to buy Nvidia and then release a proper driver for their GPUs (obviously, I'm talking about a driver for the X window system under appropriate licenses, not a Windows driver.) If you ever are challenged that Microsoft should do something like this, don't come up with lame excuses like I would like to do this but the company won't let me. Either you can move your company or admit defeat and resign instead of pretending to care about relationship to the Free Software communitites. Your company has a long, long history and needs to make good on it. Talking won't change any of this. Being forced to take some (very small) steps towards openness by court decisions won't change any of this. Probably, even being a model citizen for 5 years won't change much because people have long memories, but hey, you worked hard to get this reputation.

As Squeeze was just released, some might be on the lookout for a replacement for LiquidWeather++, a SuperKaramba script. Others might just search for the first time for a way to have a weather forecast displayed on their desktop. With my yaWP maintainer hat on, I'd like to recommend yaWP for the job. Why yaWP? Short answer: because it's the best (SCNR). Longer answer: because yaWP is easy to use, yet highly customizable. yaWP can track the forecasts of several cities for you, you can put yaWP on your desktop or in your control bar. You can limit the amount of days displayed (in the control bar mode). It's localized for many languages (if your language isn't among the already existing ones, please consider translating yaWP). yaWP can work with multiple services, is themeable and can display a satellite image for your area. Now, some of you might still (don't ask me why) prefer a different Plasmoid for displaying the weather forecasts. But even those can benefit from yaWP and use one of its three data engines (AccuWeather, Google Weather Service and Weather Underground (Wunderground)), thanks to KDE's Weather Ions. Ok, and how does it look? Please remember, that yaWP can be themed, so the picture below just shows one option of many.
Included from screenshots.debian.org (License: GPL2 or later + OpenSSL exception)

Another month and thus another issue of Flattr FOSS. Time flies but Flattr s usage seems to remain relatively strong. I was fearing that people get bored after some time but that does not seem be to the case, my Flattr income does not really drop (it doesn t take off either ). I get a bit less for dpkg than at the start but a bit more for my blog. Enough babbling, let s go straight to the 5 projects to flattr this month:

1. Linux Mint (Flattr link) is a Linux distribution based on Debian and Ubuntu that targets home desktop users. I have never tried it (I m too much of an hardcore Debianer) but I ve read several good reviews saying that it works well out of the box with good multimedia support. If you try it out, be sure to pick Linux Mint Debian Edition (LMDE).
2. Network Block Device (NBD) user-space support tools (Flattr link) is the set of tools to setup a block device whose content is really on a remote server. It requires support of NBD in the kernel of course. The user space tools are maintained by Debian developer Wouter Verhelst.
3. Tahoe LAFS (Flattr link) is a filesystem that implements a cloud storage. The data are distributed across multiple servers in such a way that it can continue to work even if one of the servers fails.
4. Gajim (Flattr link) is a full featured and easy to use Jabber client. If you don t need support of multiple instant messaging protocols, this Jabber client might be a good fit for you.
5. Aur lien Gateau (Flattr link) is a KDE developer who takes one day per week off his work to work on KDE. He seeks support from the community to compensate for the loss of revenue. Much like me, he has a support page with a complete history of the amount of donations received. I can only sympathize with people who try to live true to their passion good luck Aur lien!

This article is part of the Flattr FOSS project.

5 comments Liked this article? Click here. My blog is Flattr-enabled.

Wow, it's the last day of February and this is the first journal post I've made for the whole month. Needless to say, this month isn't working out quite the way that I'd intended at the start of year, although this is due to external forces that I hadn't been able to predict. The work project that I've been working on since last September or so (and in some sense since last June) hit the crunch, and I was pulled off of nearly everything else I was doing to work on that full time. I've been working 45-50 hours a week for the whole month, and probably will for a bit of March as well. The good part is that we're hitting our deadlines. We're going to push back by two weeks due to a design problem we missed until integration testing, but it looks like only two weeks. And given that we're picking up the entire complex account management system, teasing it apart from another major system that it's part of, and bringing it up in my group, along with reimplementing some bits around the edges and working on very old and fragile code, I'm very impressed. Unfortunately, that's also eaten my life. I'm trying to keep up with occasional things here and there, but projects like Debian got put almost entirely on hold. When I'm working this much during the week, I basically collapse on the weekends, rather than work on other projects like I normally do. I've been playing video games or just watching TV, and doing a bit of reading, but not working on free software or writing book reviews. I'm going to get a bit of time off at the end of this project, and hopefully will be able to rebalance my life again. This sort of huge push is quite unusual for work, which I like. I don't like working this way, and I've been occasionally rather unhappy with how little life outside of work I feel like I have (I can't imagine what working 60 hours a week regularly would be like). But there's only about a month or a month and a half left and then we'll be done and can go back to a more relaxed pace. I'm going to see if I can get a review finished tonight just because I hate going through a month without posting a book review. I've read five books (and three magazines) that I've not reviewed yet; sadly, the reviewing brain requires quite a bit more energy than the reading brain. Or perhaps not sadly, since it means I'm still reading. Expect posting to be minimal for the next month or so, and then it will hopefully pick up again.

I've been building unofficial wine-unstable packages for some time now and the amount of people apparently using them has become noticable (not only traffic-wise). Thus the amount of questions send to me has also risen quite a bit. In this post I try to address most of the questions in the hope it'll help people understand my motives for building these packages and potential pit falls for users. First of all: I'll stop building those packages as soon as Debian has a for my purposes recent enough version in the archives. This is expected to happen soon as most/all of the blocking issues should be sorted out now/soon. See e.g. #557783 for some insight into the problems. It might happen after updated packages are in Debian, that I'll build one version or the other occasionally to test a certain patch or version. The bottom line of this is: don't rely on me to provide always the latest packages. (This, by the way, is also explanation enough to the question, whether I'm going to build the "official" (I consider only those entering Debian's archives official) Debian packages for upstream (WineHQ).) Another question, which is seen every now and then in my inbox, is, whether I could add patch xyz to the packages. The answer is no. I maintain those packages for myself and if you want to use them, you're welcome. If you need another patch applied, just download the source package and add the patch with quilt to the series. When a certain version/build doesn't work for you, you can ask me for help, but please don't expect me to handle "doesn't work" reports like I would handle bug reports for my packages. The wine-unstable packages are for myself and if they work for me, that's all I aim for. Before spreading the word about my packages, make sure, you and those who read your post/message/whatever about my packages understand, that it is generally a very bad idea to install third-party packages, even though I'm a Debian Developer. Make also sure everybody understands that only the source package is signed with my key. Please don't download all packages (binary and source), unless you really need all of them. Please pick the ones, you need and just download them. Even though this might sound like begging, which I'm not, it'd be nice, if you could consider donating (via PayPal) something, to help cover the traffic costs. The traffic for just the wine-unstable packages has risen dramatically in the last few months. Thanks! Now, I hope I've answered most questions, if not, feel free to contact me.

I've been out here for 6 months now. At the point in time I was coming out I was pointed at Andrew Pollock's On bootstrapping oneself in the US. I figure some extra data may be useful for anyone considering the same. I moved from the UK rather than Australia. Banking I sorted out my US banking long before I ever moved here; in fact I kicked the process off shortly after I accepted the move offer. Matthew had recommended the HSBC approach, so I did that. This meant when I arrived I had a credit card, debit card and check book. They also allow me to do really easy online transfers between my US and UK accounts. Mobile phone My mobile phone was something else that was dealt with before the move. I bought a Simple Mobile SIM off eBay. I thought I'd end up moving to a contract once I had a credit record here, but actually the $60/month unlimited tariff seems to be fairly reasonable. Their customer service leaves a lot to be desired, but I've sadly come to expect that from phone companies. I've got a Google Voice account which is the number I've been giving out, so it's easily for me to switch providers (or redirect things to a VOIP setup for when I'm back in the UK, but I've got a writeup to do for that at a later point in time). Finding somewhere to live One of my concerns was that it would be hard to find somewhere to live at short notice without any credit history or SSN. This turned out to be ill founded. Both of the managed apartment complexes I looked at were ok with the fact I'd just moved to the country and seemed used to such a setup. The place I went with is privately leased and was a bit more wary, but after a conversation with my US manager (who'd managed me even when I was in the UK) it was fine. Social Security Number AKA existing as an entity as far as the US is concern. I was told to wait at least 10 working days after entry before even applying for this, or I wouldn't be in the system and it could cause delays. I did so and the card turned up within about a week (I had been told up to 2 weeks). Which was good, because work were having problems figuring out how to pay me without one. You do seem to need the SSN for everything. The only times I can remember needing my National Insurance number in the UK is for new jobs and my E111 application. Driving licence I haven't ended up buying a car here; I pretty much don't need one most of the time and I've signed up to ZipCar for easy short term rentals - they're happy to take a UK licence for sign up. However I figured getting a licence here was a good idea in case I did decide to get a car, and even just for ID (I kept having to point people at the DOB on my UK licence - everywhere here seems to card). Applying for a licence ideally relies an SSN, so I did so a few days after I'd got that. I did the car + motorbike written tests and got my learner's permit. I applied for the car theory test the same day, but the first available slot was about 6 weeks later. During this period I did the CMSP basic RiderCourse, which meant that when I passed the car test I was also fully entitled to ride a motorbike here. Other useful notes As I live in the Bay Area I got myself a ClipperCard - it's like Oyster except without the clever discounts. Works on more agencies though and helps avoid having to sort out change. For broadband I went with Sonic.net - I'm in their ADSL2 coverage area so I'm getting a reasonable 17Mb/s connection. The other options were AT&T ADSL (slower) or Comcast cable (evil). I've had zero problems with Sonic; It Just Works. Also I sort of ended up with a trial run thanks to DebConf10 being in New York. Due to the way timings worked out this took place only a few weeks before my move to SF was scheduled. My banking and phone were already in place by this point, so it allowed me to check both were working ok. They were, and I didn't really expect them not to be, but it was a nice safety net to have for the move proper. Overall the main issue I had was that a lot of things were dependant on other things; get the SSN, get a learner's permit, apply for the practical test, wait for the licence to actually turn up etc. It probably took over 3 months for everything to actually happen and come through in the post. I can tell when I actually started to exist in the system because Capital One being junk mailing me about whether I want a credit card with them...

As you probably know, Shani is our pet hedgehog. We finally managed to setup a blog just for her (sorry, it's in italian only), and also we uploaded tons of her photos.

You don't remember her? Here's a cute reminder:

I was going to make this a comment against Ritesh Raj Sarraf's post about patents and pharmaceuticals but the comment got way too long.

The basic problem is that patents on pharmaceuticals cannot be directly compared to patents on software and the explanation gets a bit involved. It's worse than apples and oranges, it's more like comparing an algorithm to a piece of DNA.

Patented pharmaceuticals must declare the precise chemical formula of the molecule (and a whole lot else besides) before the molecule can be brought to market but the company holding the patent is legally prevented from protecting themselves against slightly different molecules which are blatantly based on the protected molecule. All modification results in a new patentable product, legally separated from the original.

Therefore, the first company to patent a molecule from a new class is instantly joined in the field by other companies who are (obviously) watching the research news channels very carefully. (In their shoes, you would do the same or you go bust.) These companies simply add a flourine ion or change a hydrogen to a hydroxl group or any other number of minor, apparently inconsequential, changes. Changes which, in software, would be deemed a derivative work and would be roughly equivalent to changing a single local variable from a 16bit integer to a 32bit integer in a single function in a single file in the entire codebase. i.e. a trivial bug fix or even a typo.

A molecule with a couple of hundred atoms can have a change affecting one atom and be a completely new patentable item without any risk of the other company being sued for patent infringement, plagiarism, copyright violation (there is no copyright) or any other barrier. It's common to find that molecule foo is joined on the market by a desoxyfoo and a flourofoo etc. with a chlorofoo just around the corner, within months of the class-leader being launched. It can't be compared to software - effectively, every new release gets a new patent which covers the entirety of everything contained in that release, even if 99.999999999% of it is precisely the same as is covered under other several other patents held by extremely litigious competitors.

Modification is simply not prohibited - copying without making any changes whatsoever to the active molecule is prohibited. Changes to the inactive ingredients will be prosecuted - changes to the active ingredient will not. Comparing this with software is likely to drive you insane.

For example, the mere process of packaging an upstream release for a distribution would be patent infringement in pharmaceutical terms - UNLESS you deliberately patch the original source to make an utterly trivial and apparently pointless change. At that point, the upstream completely disown your entire release and you would have to fix every bug yourself - without the original upstream even telling you whether they fixed the same bug themselves, because they aren't ABLE to modify the upstream code without starting a whole new project and they won't tell you why or how they changed things. There is no such thing as an alpha-release of a molecule. Every release is final and no subsequent modification is possible - unless it only affects the inactive ingredients, e.g. by adding a slow release coating. These changes can affect the way that the molecule acts on the test subject / patient but must not change the active ingredient itself in any identifiable way. So the upstream can make a new wrapper (new packaging) but nobody else is allowed to do so until the patent expires. Once the patent expires, every one and their dog is allowed to make identical copies of the active ingredient in their own inactive packaging and these are called generics. Generics still need testing to ensure that the active ingredient truly is the same and that the generic behaves in the same way as the original but this process is cheaper than making a change to the active molecule.

A changed active molecule is an entirely new substance, it gets a new patent and it needs to go through largely the same amount of testing as the patented original but the new company still gets a head start on what the molecule is likely to do and what side-effects (by now noticeable with the class-leader product which is in large scale trials or even on the market) would be harmful to the future usefulness of their new, derivative, molecule. The new company simply jumps onto the bandwagon shouting "I want a piece of that action!" and there is absolutely nothing the original company can do about it, except try to show that their original molecule is better than the new competitors and to try and build a substantial market share before everyone switches to the new derivative. (Prescribers are human and tend therefore to be lazy, so unless there's a reason to change, the class leader will still have substantial share even after several derivatives exist.)

It's an arms race - each company tries to create as many of these potential "me-too" variants as possible in-house, put as many as can be (financially) supported through trials, keep pursuing those which don't have prohibitive side-effects / problems in tests and hope that, at the end, one of their versions will actually turn out to have better effectiveness or fewer side-effects. If not, they just have to market one as "as-effective-and-no-more-harmful-but-CHEAPER-than" the class leader. The majority of "me-too" molecules come under this category - even if the company concerned would try to point to infinitesimal differences in trial data to pretend otherwise. All this with the knowledge that the very hour that the patent expires, a dozen generic manufacturers will flood the market with copies which do not need to recover the massive costs of the original research and are therefore massively cheaper.

How much cheaper? patented molecules may cost 30 for 28 doses on Monday and one generic may cost 3p for 500, another may cost 40p for 10,000 on Tuesday, the day after the patent expiry. Generic houses only need to cover the actual costs of manufacture, not the costs of the original patent etc. and by the time the patent expires, the efforts of the patent holder to generate market share mean that economies of scale become evident. The absolute cheapest isn't necessarily the one who gets the contract either, these things all have expiry dates and all 10,000 have to be sold / supplied from a single location within that date to actually deliver the full savings. So then you get satellite generics who buy in quantities of a few million and pack down into 56 or less so that the total purchased quantity can sit on many shelves instead of just one. It's the same tablet in the end, with the same markings too. All that differs is the marking on the foil and the colour of the cardboard. (Oh and the same foil and colour cardboard can contain tablets with different markings from different manufacturers from one batch to the next, all within the branding of the same repackaging company.)

The original patent-holding company also has an interest in generating their own "me-too" derivatives, sometimes marketed under the name of a company which turns out to be solely owned by the parent of the original company. It can get horribly recursive.
Sometimes, the derivative from the sibling company hits the market before the "true" competitor from a different company - simply because all companies try to have many molecules in development at any one time (because most changed molecules fail in testing) and sometimes they get lucky and come up with two v.similar molecules and have to do something to justify the cost of developing both. That can turn out to be a poisoned chalice rather than two golden geese.

Sometimes, the company fails to get enough variants through testing and the company then gets bought out by a rival - who then gains their research and continues experimenting with other derivative molecules based on the ones already tested and dismissed. The limiting factor is the money.

At this point, I must now declare my cards. I used to be a pharmacist and although I am still entitled to call myself the holder of a Batchelor of Sciences degree in Pharmaceutical Sciences I am most definitely no longer a pharmacist. I therefore defer to my still-registered colleagues in case I've messed up any of the detail here. The above cannot be declared as the opinion of a pharmacist. I am an ex-pharmacist who voluntarily chose to resign his registration to take up full time work as a software developer rather than pay the exorbitant costs of maintaining such registration and all the "proof-of-competency" requirements which such registration requires.

Finally, before you ask, I am very happy to be an ex-pharmacist - my erstwhile colleagues have my ongoing sympathy but no matter how much some of them may beg, they all know that I will not be rejoining them on that side of the dispensary bench if I've got any choice in the matter.

Software is just better. It's all just recycled electrons.