Nagstamon 0.9.3 just landed in Sid. Nagstamon is a Nagios status monitor for the desktop. It connects to multiple Nagios or Opsview monitoring servers and resides in systray or as a floating statusbar at the desktop showing a brief summary of critical, warning, unknown, unreachable and down hosts and services and pops up a detailed status overview when moving the mouse pointer over it. Connecting to displayed hosts and services is easily established by context menu via SSH, RDP and VNC. Users can be notified by sound. Hosts and Services can be filtered by category and regular expressions. Successfully tested Nagios versions include 2.x and 3.x. Opsview connectivity has been tested with Opsview 3.5. If you don t like having a Nagios webpage always running in your web browser, you ll appreciate Nagstamon.

SSH is definitely one of my most often used tools, not only for system administration at work but also on the road with my netbook, an EeePC 701 running Debian Sid. On the road, it often happens that I have a flaky WLAN or UMTS connection, so I often have to kill (via <Enter>~.) and reconnect my SSH session due to a changed IP address or so. First step against problems arising from using SSH over unreliable network connections is of course GNU Screen. Second step is use SSH keys and ssh-agent to not needing to type the password on every reconnect. But it s still very annoying to kill the SSH connection and call ssh again manually. For luck there is autossh, a wrapper around SSH which regularily checks via two tunnels connect to each other on the remote side if the connection is still alive, and if not, it kills the ssh and starts a new one with the same parameters (i.e. tunnels, port forwardings, commands to call, etc.). It s quite obvious that this is perfect to be combined with screen s -R and -d options (Reattach if a detached screen is around, else start a new screen; detach a currently attached screen), so I found myself very often typing (or fetching it from the commandline history :-):

autossh -t sym.noone.org 'screen -Rd'

-t is necessary to allocate a terminal device on the remote machine which is not done by default if you directly call a command via ssh. In comparision to OpenSSH, autossh needs the single quotes, because otherwise it would parse -Rd as options to parse to ssh and bail out. That s not a real problem, but when you re used to just type ssh -t sym.noone.org screen -Rd without any quotes, you ll run into this then and when. Update, 25-May-2010, 14:55: As Carsten Hey points out, autossh also supports the -- option to declare that all following options and parameters must be passed to ssh itself. (End of Update) Typing that often and mistyping it then and when cries for an shell alias or an shell function. So I came up with the following shell function:

asc()  
    autossh -x -a -t "$@" 'screen -RdU'
 

I used a function instead of an alias in case of autossh will in future regard all parameters given after the command as part of the command as ssh does. The additional options -x and -a disable X and SSH Agent forwarding which both don t work if you reattach to an already running screen. And if you re using Zsh as I do, you can even add some more format string magic to set the window title more or less to the expanded alias, eh, function:

function asc()  
    # Set the title to something more obvious, e.g. the expanded
    # alias, eh, function
    print -Pn "\e]0;%n@%m: autossh -t $* 'screen -RdU'\a";
    autossh -x -a -t "$@" 'screen -RdU'
 
compdef asc=ssh

Update, 25-May-2010, 14:59: As Hauke points out in a comment, Zsh users should also declare that asc should have the same tab completion as ssh itself. The example above has been updated accordingly. (End of Update) In the meanwhile on the EeePC I use asc on the commandline more often than ssh itself. And I nearly no more type autossh. (The most common exception here is autossh hostname tail -F /path/to/some/logfile.) Using that function you can also add common ssh options for tunneling, etc. I use it most often like this:

asc -D 1080 sym.noone.org

This opens a SOCKS proxy on localhost, port 1080 and that way I can surf via the host I m connecting to by SSH. There s one small drawback though: You didn t expect that I can just invent some new three letter command without a namespace clash, did you? There is a free game called Advanced Strategic Command whose binary (and Debian package) is named asc, too. If you have that game installed, you can always call it using its full path, e.g. /usr/games/asc on Debian. P.S.: My whole grml based .zshrc is also available via git at git.noone.org as well as on github.

The usual semi-regular bits of news from the FusionForge project. We continue being quite active, with several hundred commits each month. The momentum doesn't seem to stop even after the 5.0 release last month. A large part of the activity stems from the Coclico project, which has several work-packages related to convergence of code across forges (mostly between FusionForge and Codendi). This convergence comes in three flavours:

• some new features are developed in common for both forges; as an example, the Mailman and ForumML plugins recently committed can now run unmodified in FusionForge and in Codendi (or at least that's the goal);
• some features existing only on the Codendi side are ported across to FusionForge; this includes the Codendi widgets system, which allow drag-and-drop customization of some of the web pages, and the Hudson plugin;
• finally, some of the core code is rewritten so that a common API and abstract data model can be used by higher-level pieces of code; the configuration system has been almost completely converted to a simple API, and the role-based access control system has also been rewritten into a clean model that extends both FusionForge's previous RBAC system and Codendi's, so each forge will provide new features for access control (the immediate gain for FusionForge is the ability to grant different permissions to anonymous visitors and to visitors that are logged in even if not members of the current project).

All in all, a fairly busy period for FusionForge. The current trunk is evolving rather fast, with some long-overdue rewrites being underway. Interesting times.

The music industry seems fairly aggressive in taking legal action against children when they break the licence terms of copyright material. I think it would be good to teach children about how the IP industry really works. It seems to me that you could have a school project that involves an entire year level (maybe 100 students depending on the size of the school) each of whom can produce copyright material (everything they do in art and English classes would be suitable as a start). Then they could register their work (make digital photographs and then store them in a school database that records the entry date) and sue anyone who infringes their work. Every student would receive licence fees for their work, but if they are sued for infringement they would have to pay all revenue plus damages. Other students could work as lawyers and take a portion of the proceeds of any successful law suit, and finally some students could run recording companies and spend their time hunting for infringing work for the purpose of launching legal action. In terms of the licence fees paid, this could be done by just allocating a fixed value per item to each student as a way to get the system running without regard to the fact that some students just aren t able to create good art. It could however have a large portion of the value coming from what other students choose to spend, every student gets to spend $10 per week on art and they can choose from the database what they want to buy copies of. The most popular art could then be printed on every notice-board in the school as an incentive for students to vote with their play-money for something that they don t mind seeing all the time. It s obvious that popularity would be a significant factor in the success of some artists, but that s OK, a casual review of the chart topping music reveals that it s quite obviously not created by the world s best musicians so it seems that rewarding popularity rather than skill just adds some realism. One possibility would be to allow the students to elect representatives to create their own IP laws. It would be interesting to see how the IP laws voted on by representatives of the students (who are all in some way involved with the process of creating, buying, selling, and distributing artistic products) differ from those which we have foisted upon us in the real-world. Also an interesting possibility would be to allow corruption in the election process and observe how the results differ from year levels where corruption is not permitted. I expect that teaching children how political corruption works would be a little controversial, but it s nothing that they can t learn from reading news reports about what the entertainment industry is really doing. Really being a corrupt politician for a school project shouldn t be as bad as playing a murderer in a school play! Naturally this couldn t be done with real money, but giving higher marks at the end of the year to the students who accumulate the most play money would be quite reasonable. I don t think that there would be a problem with giving higher marks to a student who succeeded through political corruption as long as they gave a good written report of how they did so and the implications for society. Please note that I am not suggesting this for a subject that is used for university entrance, I think it would be a good project for years 8-10 which in Australia have no relevance to university entrance. So the marks would just be letters on a bit of paper that might make parents happy or unhappy and otherwise mean nothing. I anticipate responses from people who believe that educating children about how the world works is not appropriate for a school. Such people are never going to convince me, but if anyone thinks that they can make a good point to convince some of the readers then I encourage them to write it up in the comments section if it s short or on their own blog if it s longer.

I'we just launched website (well it's quite pretentious name for few pages), which shows debts for politics when they were in government in Czech Republic. We're still not in situation like in Greece, but it can quite easily happen that we would be in few years and it's good to show some numbers describing what was happening in past. It took just few hours of coding yesterday evening using Django. Domain has been registered and it is online now. While doing such thing, I decided to make more fun for me and publish the link just on social networks (Identi.ca, Twitter, Facebook, LinkedIn) and follow if (and how) the link will spread. So no, you will not find link in this blog post :-).

We had a Microsoft salesperson stop at our offices today to tell people about wonders of cloud computing and Microsoft s Azure will save us all. The following is a short and non-exhaustive list of what Azure does not do according to their own experts:

• no Infrastructure as a Service which means that they actually don t offer you servers to run you code on, they only offer Windows Server instances to which you can deploy your code. There is no imaging and no platform choice. In a half a year or so they plan to roll out Virtual Machine Instances where you will actually be able to upload your own images of what you want to run and then running Linux on Azure will be possible, but that will run with a double virtualization, so it is likely to be incredibly slow
• No fast key-value storage they only provide SQL servers, with blob storage if you want, but nothing in the NoSQL scalability department
• their Windows Azure (limited version of Windows Server OS that they actually run in their cloud) does not run most of their current server solutions they are working to migrate them one by one
• SQL service has no backup (but raw data storage has data triplication)
• No autoscalability as such (but they do provide a tool that you can install on your cloud servers to launch additional instances when load rises, or kill instances reliability and configurability is unclear)
• No VPN (they are working on it, might be delivered in 12 months, meanwhile they suggest to use a Service Bus their equivalent of Amazon SQS to communicate to you cloud servers, and pay a subscription fee + per-request fee + bandwidth fee)
• No way to launch a server with more than 14 Gb of RAM both Amazon High CPU and High RAM server offerings were alien to the presenter
• Their SQL server offering is a monthly subscription no pay-as-you-go there
• No reserved instances, but Microsoft is willing to talk about volume discounts, but later, at some point in a year or two when they start actually providing service contracts
• Their bandwidth fees for Asia are three times higher than in other regions for some reason
• If you think of any interesting feature, like CloudFront, CloudWatch, MapReduce, FWS, load balancing, notification service, Microsoft Azure does not have that.

The Microsoft presenter also repeatedly engaged in shady tactics when presenting his information:

• he implied that you need to pay for Windows licences on Amazon
• he claimed that starting up an instance on Amazon with any custom configuration (like from your own image) would take a lot of time
• he claimed the invention of container data centres
• he claimed that Microsoft is the only provider that you can trust to store your data in the location that they advertise when confronted that Amazon has a EU datacenter and provides you a clear way to get your data there, he actually claimed that Amazon might leak your data to other datacenters How can you know they will not?
• He impled multiple times during the presentation that no other cloud providers can be trusted to keep data within EU he even tried to say that Amazon only opened their first EU datacenter last month and was very surprised and annoyed when corrected (they opened an Asian datacenter and had a EU datacenter for a long time)
• Tried to pass off the fact that you can only run Windows provides a good choice for the customers
• Talked about planned features like they were implemented and available already like MS Systems Centre online which he spend 5 minutes talking about how it will enable to migrate services from your private cloud in-house to the Azure cloud and then barely mentioned that it might mature to a beta status at the end of 2010
• Tried to pass off Amazon as too low level and complicated while contrasting it to niche force.com and Google App Engine and then presenting their solution that will run all kinds of .Net and Silverlight applications ! Yeah, apparently their platform does not even run regular Windows .exe files
• Tried pass off their SLAs (non-contractual guarantees of service levels, which are unlikely to be enforceable beyond money back guarantee ) as key selling point, even though they don t even offer actual service contracts Update: Also claimed that Amazon does not provide SLAs, while the actually do
• With fanfare claimed 14k applications running in their cloud, when pressed noted that most of these application don t even pay them, because they got in on special promotions.

So to summarize, Microsoft has build a cloud of Windows-like machines which can run your programs (as long as they are in .Net or Silverlight) and which does not have even a third of the features of such de-facto market leader as Amazon AWS. They try giving away their product for free and only get 14k applications in 6+ months. Note: Amazon has at least 300 000 public applications and God only knows how many more private ones. They will grow, due to companies locked-into Microsoft s way of thinking buying into their marketing, but if you have a head on your shoulders, you should avoid it as a trap, which it actually is. All that can be done on Azure, can also be done on Amazon. The opposite is not always true. In addition, if you will want have a mixed environment with both Windows and Linux servers, you will not be able to deploy Linux servers to Azure (or they will be very slow) and you ll have to put your Linux servers into Amazon (or another) cloud and pay double traffic fees for every byte of traffic between your own servers. Microsoft Azure prices are exactly the same as Amazon EC2 prices with Windows instances. However on Amazon you actually get fully capable Windows Server instances. And if you don t need Windows, you can get a much better price on Amazon. The only companies that can safely use Azure are companies that only have Windows servers AND plan to only have Windows servers for the foreseeable future. Knowing how dominant Linux is in the server market and how many Windows-only shops actually have a few Linux servers in the back room, there is very little future for Azure, until they wise up and make Linux instances first class citizens in their cloud. If not because their customers need them, then because their customers think that they at least might need them in the future. Update: Amazon now released a Reduced Redundancy storage for S3 that provides the exacts same level of storage guarantees that regular Microsoft Azure SLA (99.9%) for two thirds of the price, and also Amazons now explicitly says that their regular S3 is Designed for 99.999999999% Durability , which is worlds above what Microsoft provides. Now in this case Amazon again is cheaper than MS. Also Amazon bandwidth prices are 33% lower compared to Azure. In Azia the difference is simply staggering (0.45$ vs 0.19$ per Gb).

A year ago, i wrote about how New York City's Summer Youth Employment Program (SYEP) requires the use of Internet Explorer to apply online (and it even appears to require IE just to download the PDF of the application!) Sadly, the situation has not changed, a year later. Today, I'm writing to Dan Garodnick, Chair of The City Council's Committee on Technology (and the rest of the committee members), Carole Post, Commissioner of DoITT (the city's Department of Information Technology and Telecommunications), and Jeanne B. Mullgrav, Commissioner of DYCD (the Department of Youth and Community Development, which runs SYEP). Here's what i wrote:

For the last two years at least, the DYCD's Summer Youth Employment Program
(SYEP) has been only available to users of Internet Explorer:
 https://application.nycsyep.com/
Internet Explorer (IE) is only made by Microsoft, and is only available for
people running Microsoft operating systems.  Users of other operating systems,
such as GNU/Linux, Macintosh, or others cannot access the SYEP application
process.  Even users of Windows who care about their online security or simply
desire a different web browsing experience might prefer to avoid Internet
Explorer.
Not only is the online form inaccessible from browsers other than IE, even
retrieving a copy of the PDF to print out and fill in manually is unavailable
for web browsers other than IE.
What is the city's policy is on access to government sites?  Is it city policy
to mandate a single vendor's software for access to city resources?  Should NYC
youth be required to purchase software from Microsoft to be able to apply
for the Summer Youth Employment Program?
The sort of data collection needed by such an application is a mainstay of the
standards-based web, and has been so for over 15 years now.  There is no reason
to require particular client on an open platform.  I can point you toward
resources who would be happy to help you make the system functional for users
of *any* web browser, if you like.
I raised this issue over a year ago (see nyc.gov correspondence #1-1-473378926,
and a public weblog posted around the same time [0]), and got no effective
remedy.  It's worrisome to see that this is still a problem.
Please let me know what you plan to do to address the situation.
Regards,
	--dkg
[0] https://www.debian-administration.org/users/dkg/weblog/47

Feel free to send your own message to the folks above (especially helps if you live in or near NYC) Finally, Carole Post, the head of DoITT will also be present at a panel tonight in Soho, which i'm unfortunately be unable to attend. If you go there, you might ask her about the situation.Tags: policy

That's a phrase I fully adhere to (I don't want to work), but that's not the point. There's a catchy song that I like a lot, it's sung in French and sounds like an old song (most places say it's an Edith Piaf's song). The chorus goes "Je ne veux pas travailler, je ne veux pas d jeuner...", and one would imagine that that's indeed the title. But nothing of this is true, once again the Internets is full of fail. The band who performs the song is called Pink Martini, two of them are the authors of it, and they are from Oregon. It was recorded in 1997 (some audio filters did the magic), and it's called "Sympathique". It also seems that it was a big success, but probably not in my part of the world. I thought that somebody should set this straight somewhere, as I couldn't find anybody speaking of this confusion. Having settled that, I invite you to listen to this wonderful song, and sing along that you don't wanna work (forget about the rest of the lyrics, it's a love song :-)). Tags: Planet Debian, Planet Lugfi, M sica

After several other Debian developers convinced me that a ShortURL service, which is under control of a Debian Developer would be useful for them, I've spent some time to write the necessary code for it. And if it will be used regulary, I'll ask DSA if they want to host it on a proper machine. So I'm happy to announce the public beta test of deb.li (also available under go.debian.net)! Please note that neither the content of the pages nor the CSS is finished... As this should not become just another random, spammer-attracting ShortURL service, I will not provide a web based form to add new URLs. Instead new URLs have to be added via a simple JSON-RPC based interface. Other ways to add new URLs will be added on request (or by sending patches ;)), at least an email-gateway similar to db.debian.org is planned. The small piece of documentation which exists so far is available at wiki.debian.org/deb.li And if you want to give it a try now, log into alioth.debian.org and have a look into

/var/lib/gforge/chroot/home/users/bzed/godebian-client

- the usage is documented in the README file and should be pretty straight forward. I hope it will be useful - comments, bugreports and patches are welcome!

Yesterday I finally found the time to update gimp-plugin-registry, the (hopefully!) largest and best collection of plugins for The GIMP. As usual here comes a short summary of the changes:

• The wonderful scripts from El Samuko are included now:
  • Antique Photo Border Script
  • Che Guevara Script
  • Cyanotype Script
  • Difference Layer Script
  • Escape Line Script
  • Film Grain Script
  • First Photo Border Script
  • Lomo Script with Old Style Colors
  • Movie 300 Script
  • National Geographic Script
  • Obama "HOPE" Script
  • Rainy Landscape Script
  • Photochrom Script
  • Sprocket Hole Script
  • Sunny Landscape Script
  • Technicolor 2 Color Script
  • Technicolor 3 Color Script
  • Vintage Look Script
• Included the X11 Mouce Curser (XMC) plugin as requested by KiBi.
• Removed the GREYStoration plugin. This plugin was superseded by the gimp-gmic plugin, which is built from the gmic source. Most of the packaging work was done by Jakub Wilk (thanks!), it is waiting in NEW currently. Btw, gmic lives in the collab-maint git folder, don't hesitate to help with the packaging work.
• The following plugins were updated:
  • focus-blur
  • contactsheet
  • normalmap
  • save-for-web
  • seperate+

Hope you like my work, suggestions and bug reports are welcome as usual!

Recently, I ve been working on an exciting project with JaNet(UK) on a project to bring federated authentication to non-web applications. I ve worked on authentication projects a lot, although this is the first federation project I ve worked on. The big difference appears to be an emphasis on credential independence: the subject (person trying to authenticate) and service will not share a common credential type. Within their organization, the subject and their identity provider share a credential. Then, the federation has some credential mechanism such that the user s organization and the service share some (probably completely different) type of credential. The other emphasis is on providing personalization. For web applications, there are a lot of options to achieve this: Information Card, Open ID, SAML, and OAuth all provide solutions in this space. However there are not good options for non-web applications. If you out-source your mail and chat infrastructure but want to use your own chat client or IMAP client, then you will not get the same federation benefits you can get with the web. If you re using usernames and passwords and don t mind the potential problems with your out-sourcing provider being able to impersonate all your users, you can simply synchronize usernames and passwords. Within an enterprise, you can do better using Kerberos. JaNet(UK) runs the UK Access Federation, which is a SAML-based web single-sign-on federation. In order to better meet the needs of their customers they d like to expand this offering to non-web applications. This demand is apparently shared across the European academic community. I suspect there is also some demand in the US academic community and in enterprise situations. With the web, it turns out that you have a convenient platform for interactions with the identity provider: you can simply direct a web browser to the identity provider and need not specify the user interaction with the web browser at all. This is seen as a significant branding and usability advantage. With other environments, it becomes necessary to specify the interaction with the identity provider. Consider an automated client that wishes to examine a mail box and provide advanced mail sorting or aggregation. That automated client cannot directly use a web browser. OAuth solves this issue with an enrollment step that does typically involve a web browser that produces a consumer key and an authentication step that does not. However for non-web clients it seems like avoiding reliance on the browser authentication will be important. It turns out we already have widely used technologies that do this: the Extensible Authentication Protocol (EAP) mediates the interaction between a subject and identity provider for obtaining network access. It also turns out that we have fairly good technologies for abstract security services within non-web applications: thanks to Kerberos and Active Director, many application protocols and a fair number of applications support GSS-API. JaNet(UK) proposes to combine these technologies with SAML in order to produce a solution for federation beyond the web. I prepared a feasibility analysis of this proposal. At a technical level, the proposal is sound. There s a lot of standardization and implementation work, but there appears to be sufficient motivation to form the seeds of a standards activity and put together a proof-of-concept implementation. However, the big question is Will anyone use it? In particular, to be useful beyond fairly small communities, support from client vendors and application framework vendors will be needed. It s taken massive money and around 20 years to get Kerberos support to a point where it is effective within an enterprise. Moonshot can leverage that work to a large extent, but moonshot may also have greater usability and penetration goals. It s interesting that I m advocating EAP for application layer authentication. When I was a Security AD, I made a strong statement that EAP must only be used for network access. I ve been fairly consistent about that since then. I think there are two huge problems with using EAP for application authentication. The first is that EAP only authenticates the home realm; it does not authenticate what service you re going to. So you might try to connect to your e-mail and end up giving something access to your stored files and pictures instead. That is, EAP has a phishing exposure in the federated context. If the only thing you can get by using EAP is network access, that exposure is only moderate. However in a fully federated environment that is a huge exposure. Moonshot will address this problem by using EAP channel binding and by doing the necessary work to make that a viable solution. The second concern is that interoperability is reduced when you have multiple authentication approaches for the same problem. If EAP is going to be used for application authentication, we need to understand how it relates to the rest of the application authentication metasystem. Moonshot proposes such a relationship, addressing my objection. Moonshot is designed to work well with the objectives of the Identity Metasystem and its laws of identity. It uses a different technology, but does have an approach for dealing with claims-based identity and hopefully will have a user experience very similar to the identity metasystem. It uses a different underlying technology. However one of the main beliefs behind the identity metasystem is that is the user experience and universal interoperability that is important, not any specific technology. In its domain, the technologies Moonshot selects will be a better fit than a web services stack. It s strange not to be working on Kerberos; Moonshot uses some Kerberos technology, but its core is definitely not today s Kerberos. In some ways it is fun to be working on something new. There s one aspect of Kerberos I really miss: Moonshot has nothing like tickets. There s no place to remember state or exchange to directly involve the client in what the server learns. My analysis talks about ways to make Moonshot more like Kerberos; there are some potential advantages, but so far, the tradeoffs do not justify changes. We re hoping to have a bar BOF at IETF 77 and a BOF in the summer at IETF 78.

Some notes I think are worth sharing about the upgrade to KDE 4.4:

• The upgrade is disruptive enough that it is not possible^Wrecommended to upgrade while logged-in (kwin and plasma crash.)
  
• Either you have mysqld running or you can't use kmail (and others) anymore. 4.4's kmail appears to use akonadi resources directly, so the "workaround" to disable the migration no longer helps.
  I wonder how this is going to affect login time and resources/energy consumption once I give up and let it start mysqld.
  
• Kopete's statistics plugin makes kopete freeze at startup.
  
• The sound card keeps getting turned on and off. It's probably knotify that is happy.
  
• nepomuk is back! (the server is running even if it is disabled via systemsettings.)
  

Let's see how long I last before I regret upgrading...

I find it surreal to have people guessing at my motivations when they could just ask me. On top of all that, I find it weird that people spend so much time with in-fighting. I just want my system not to suck. Some time ago (during in the Ubuntu Karmic development cycle maybe in September 2009), I started having giant problems with my build system. All I/O would start to stall, wait times would surge, and usually my entire system would just go unresponsive with the disk light on solid. This scared the crap out of me, and it wasn t entirely obvious what was triggering it. No one else seemed to be seeing it. I managed to start tracking things using latencytop , and saw stuff like liferea going crazy. As I eliminated more and more things, I eventually settled on it being a problem with umount, and I reported an Ubuntu bug. It seemed to look like an upstream bug that no one else but the reporter could reproduce either. Since no one else was seeing this issue, and it seemed related to LVM snapshots, I migrated off of snapshots, and started using aufs overlays for my builds. For a while, it seemed like things went away. It didn t, and I started hitting it again. I opened a new (now famous) bug in Ubuntu, since now snapshots weren t in the picture, and I didn t want to confuse the earlier history. I managed to find a relatively minimal test-case too. A few other people commenting on the bug were seeing the problem now too, but it was less pronounced for them. As an aside, this wasn t a just wait a few seconds longer kind of issue on my system. A single umount would last 30-40 minutes. And when I m doing parallel builds of security updates, this would turn into my system being unavailable for hours at a stretch. Since none of the kernel developers I was in contact with were able to track down the root cause, I asked Ted Ts o in email if he could just quickly peek in on this for me, since I figured he d be in a good position to confirm or deny it. I didn t want to start wasting upstream time with this if it wasn t reproducible (see earlier upstream kernel bug). To my great relief, Ted found a few minutes to check it, and was able to immediately confirm it and give me a viable work-around ( sync; umount ) for the time being. I confirmed the work-around, and went off to do other things. A while later, Ted came back to deliver a bit of a rant, the purpose of which was not clear to me, but I ultimately ignored it I didn t seem directed at me. I just wanted my system operating normally, and he d done me a favor to check in on it and got me a work-around. More time passes, and I eventually get caught in another I/O-wait melt-down. On investigation, it seemed that the in-kernel work-around in the Ubuntu kernel totally back-fired on me in some cases, rendering even the user-space work-around useless. After investigating the Ubuntu-specific work-around, I re-read Ted s rant in the course of researching what had happened during this bug s triage. It seemed that Ted was basically saying:
this is an upstream problem
RedHat hasn t run into it and he didn t know why I figured I should confirm for myself if Fedora was affected, so downloaded and installed Fedora to double-check there. Since I was able to reproduce it there, I opened an upstream bug, linking back to the original Ubuntu bug, and then went to open a bug in the Fedora tracker, linking back to upstream. And it seems to be these actions that everyone has jumped on. I will now bore you with the reality of my motivations: I wanted to fix the bug so no one would end up experiencing the same pain I d been through over the last 6 months. The bug was, from my perspective, a serious issue. Since I d managed to reproduce it in another distro, it was my duty as a Free Software developer to report it to them. And, in what I felt was an unambiguous gesture, I made sure to include the link to the upstream kernel bug. Reproducing it in Ubuntu, in Fedora, and with a stock kernel had me confident that it was an upstream issue. While Ted did correctly suspect the issue was upstream, I really didn t want to just open an upstream bug and have it be ignored. I wanted some additional proof of reproduction, which I got when I tested it on Fedora. So, I m rather saddened that so many people spent so much time questioning my motivations, making fun of Canonical, or doing anything other than trying to just simply solve this problem. I m totally disinterested in inter-distro fighting. Instead, I continue to assume we re all on the same team, fighting a philosophical battle against close-source software. And in that regard, I think it s still true. If I ignore the rants and jeering, I come away thankful for all the people that spent time trying reproduce the issue at Canonical, at RedHat, and in the larger community. I m hugely thankful that Ted made some time to let me know I wasn t crazy, and there was actually a problem. I m thankful for having some work-arounds, and I m thankful that the root cause was eventually ferreted out, with some possible solutions. I m even thankful that some people on the LWN thread saw that, far from malicious, I was trying to be helpful with the bug. I just wanted my filesystem not to eat my computer. And I was hoping other people could maybe help me, since I m not a filesystem expert. The drama around this bug is pathetic, and now by talking about it for almost 1000 words, I m just as guilty.

Linux 2.6.34 was released today. This contains a fairly substantial batch of ASoC updates, including:

• Support for turning CODEC biases off completely when idle, providing power savings for modern devices with ground referenced outputs where this can be done quickly at runtime without pops and clicks.
• Support for disabling physical writes to the device in the generic cache control code, allowing devices to be completely powered off when idle while still providing their control to userspace through the standard register interfaces.
• Support for tuning the time ASoC waits before powering things down after playback has finished (in order to involve issues between tracks or similar) at runtime or from the machine driver.
• New drivers for DA7210, DB1200 I2S and AC97 controllers, i.MX3x SSI ports, OMAP4 McPDM ports, S3C64xx AC97 controller, SH SIU (Sound Interface Unit), WM2000, WM8904, WM8912, WM8955, WM8978, and WM8994

I spent last week at the Ubuntu Developer Summit in Belgium, where we kicked off the 10.10 development cycle. Due to our time-boxed release cycle, not everything discussed here will necessarily appear in Ubuntu 10.10, but this should provide a reasonable overview of the direction we re taking. Presentations While most of our time at UDS is spent in small group meetings to discuss specific topics, there are also a handful of presentations to convey key information and stimulate creative thinking. A few of the more memorable ones for me were:

• Mark Shuttleworth talked about the desktop, in particular the introduction of the new Unity shell for Ubuntu Netbook Edition
• Fanny Chevalier presented Diffamation, a tool for visualizing and navigating the history of a document in a very flexible and intuitive way
• Rick Spencer talked about the development process for 10.10 and some key changes in it, including a greater focus on meeting deadlines for freezes (and making fewer exceptions)
• Stefano Zacchiroli, the current Debian project leader, gave an overview of how Ubuntu and Debian developers are working together today, and how this could be improved. He has posted a summary on the debian-project mailing list.

The talks were all recorded, though they may not all be online yet. Foundations The Foundations team provides essential infrastructure, tools, packages and processes which are central to the development of all Ubuntu products. They make it possible for the desktop and server teams to focus on their areas of expertise, building on a common base system and development procedures. Highlights from their track:

• Early on in the week, they conducted a retrospective to discuss how things went during the 10.04 cycle and how we can improve in the future
• One of their major projects has been about revision control for all of Ubuntu s source code, and they talked last week about what s next
• We re aiming to provide btrfs as an install-time option in 10.10
• In order to keep Ubuntu moving forward, the foundations team is always on the lookout for stale bits which we don t need to keep around anymore. At UDS, they discussed culling unattended packages, retiring the IA64 and SPARC ports and other spring cleaning
• There was a lot of discussion about Upstart, including its further development, implications for servers, desktops and the kernel, and the migration of server init scripts to upstart jobs
• After maintaining two separate x86 boot loaders for years, it looks like we may be ready to replace isolinux with GRUB2 on Ubuntu CDs

Desktop The desktop team manages both Desktop Edition and Netbook Edition, on a mission to provide a top-notch experience to users across a range of client computing devices. Highlights from their track:

• A key theme for 10.10 is to help developers to create applications for Ubuntu, by providing a native development environment, improving Quickly, improving desktopcouch, making it easier to get started with desktopcouch, and enabling developers to deliver new applications to Ubuntu users continuously
• With more and more touch screen devices appearing, Ubuntu will grow some new features to support touch oriented applications
• The web browser is a staple application for Ubuntu, and as such we are always striving for the best experience for our users. The team is looking ahead to Chromium, using apport to improve browser bug reports, and providing a web-oriented document capability via Zoho
• Building on work done in 10.04, we will aim to make simple things simple for basic photo editing
• Security-conscious users may rest easier knowing that the X window system will run without root privileges where kernel modesetting is supported

Server/Cloud The server team is charging ahead with making Ubuntu the premier server OS for cloud computing environments. Highlights from their track:

• Providing more powerful tools for managing Ubuntu in EC2 and Ubuntu Enterprise Cloud infrastructure, including boot-time configuration, image and instance management, and kernel upgrades
• Improving Ubuntu Enterprise Cloud by adding new Eucalyptus features (such as LXC container support, monitoring, rapid provisioning, and load balancing. If you ever wanted to run a UEC demo from a USB stick, that s possible too.
• Providing packaged solutions for cloud building blocks such as hadoop and pig, Drupal, ehcache, Spring, various NOSQL databases, web frameworks, and more
• Providing turn-key solutions for free software applications like Alfresco and Kolab
• Making Puppet easier to deploy, easier to configure, and easier to scale in the cloud

ARM Kiko Reis gave a talk introducing ARM and the corresponding opportunity for Ubuntu. The ARM team ran a full track during the week on all aspects of their work, from the technical details of the kernel and toolchain, to the assembly of a complete port of Netbook Edition 10.10 for several ARM platforms. Kernel The kernel team provided essential input and support for the above efforts, and also held their own track where they selected 2.6.35 as their target version, agreed on a variety of changes to the Ubuntu kernel configuration, and created a plan for providing backports of newer kernels to LTS releases to support deployment on newer hardware. Security Like the kernel team, the security team provided valuable input into the technical plans being developed by other teams, and also organized a security track to tackle some key security topics such as clarifying the duration of maintenance for various collections of packages, and the ongoing development of AppArmor and Ubuntu s AppArmor profiles. QA The QA team focuses on testing, test automation and bug management throughout the project. While quality is everyone s responsibility, the QA team helps to coordinate these activities across different teams, establish common standards, and maintain shared infrastructure and tools. Highlights from their track include:

• There was a strong sense of broadening and deepening our testing efforts, mobilizing testers for specific testing projects, streamlining the ISO testing process by engaging Ubuntu derivatives and fine-tuning ISO test cases, and reactivating the community-based laptop testing program
• In support of this effort, there will be projects to improve test infrastructure, including enabling tests to target specific hardware and tracking test results in Launchpad
• There is a continuous effort to improve high-volume processing of bug reports, and two focus areas for this cycle will be tracking regressions (as these are among the most painful bugs for users) and improving our response to kernel bugs (as the kernel faces some special challenges in bug management)

Design The design team organized a track at UDS for the first time this cycle, and team manager Ivanka Majic gave a presentation to help explain its purpose and scope. Toward the end of the week, I joined in a round table discussion about some of the challenges faced by the team in engaging with the Ubuntu community and building support for their work. This is a landmark effort in mating professional design with free software community, and there is still much to learn about how to do this well. Community The community track discussed the usual line-up of events, outreach and advocacy programs, organizational tools, and governance housekeeping for the 10.10 cycle, as well as goals for improving the translation of Ubuntu and related resources into many languages. One notable project is an initiative to aggressively review patches submitted to the bug tracker, to show our appreciation for these contributions by processing them more quickly and completely.

Conference Management systems are web applications designed to make the lives of conference organisers easier. They usually include features such as registration, payment, paper submission and review, scheduling and publishing of announcements.

Since Wikipedia is apparently not a place for such a "spammy list," I figured I should at least post this here:

Name	Used by	License	Programming Language
A Conference Toolkit	YAPC::Eu	Artistic License	Perl
ConMan	Utah Open Source Conference, Texax Linux Fest	GPL	Python (Django)
Open Conference Systems	various academic conferences	GPL	PHP
OpenConferenceWare	Open Source Bridge	MIT	Ruby on Rails
Pentabarf	DebConf, FOSDEM, CCC	GPL	Ruby on Rails
SCALEreg	SCALE	GPL	Python (Django)
Zookeepr	linux.conf.au	GPL	Python (Pylons)

If you know of any other Open Source systems, please leave a comment!

Some students of the Google Summer of Code are required to make a weekly report describing their activities. As far as I know, I m not, but I think it s a good idea in general, to comunicate to my mentor and other interested folks what I ve been doing. So I ll start to do them here. My project is Implementing the Immix Garbage Collector Algorithm on GHC. Last week I was most of the time involved in my school activities, so I didn t have much time to work on the project. I went to the bureaucratic services of my university to get a Proof of Enrollment in English, print/sign/scanned the Foreign Certification Form and sent them to Google on Friday afternoon. I asked them to confirm the receival, which they didn t. I m planning to ask again for a confirmal today in the afternoon, if I still get no reply. I also tried to build the current version of GHC, from the darcs repository. I was getting an error with my old (and updated) repository, so I donwnloaded a new one and could build nicely. Then I noticed that with make distclean I could also build with my older one, so I just removed the new. I downloaded the nofib benchmark suite and made an initial benchmark. While I was reading the documentation of the build process of GHC, I noticed a bug, and submitted a patch to the cvs-ghc mailing list. The patch was applied, with some changes. This week I plan to focus more on the project, and spend the weekly 36 hours working on it. I m planning to start reading the Immix Technical Report to see if there s anything new there with regard to the article. After that I ll read the wiki documentation on the GHC current GC, together with the GHC source code. I ll also experiment with Criterion. While I was writing this post I noticed that the GC benchmark in nofib is failing:

==nofib== fibheaps: time to run fibheaps follows...
/usr/bin/time ../../runstdtest/runstdtest ./fibheaps  -o1 fibheaps.stdout -o1 fibheaps.stdout  -ghc-timing     300000;  /usr/bin/time ../../runstdtest/runstdtest ./fibheaps  -o1 fibheaps.stdout -o1 fibheaps.stdout  -ghc-timing     300000;  /usr/bin/time ../../runstdtest/runstdtest ./fibheaps  -o1 fibheaps.stdout -o1 fibheaps.stdout  -ghc-timing     300000;  /usr/bin/time ../../runstdtest/runstdtest ./fibheaps  -o1 fibheaps.stdout -o1 fibheaps.stdout  -ghc-timing     300000;  /usr/bin/time ../../runstdtest/runstdtest ./fibheaps  -o1 fibheaps.stdout -o1 fibheaps.stdout  -ghc-timing     300000;
Command exited with non-zero status 2
0.72user 0.05system 0:00.77elapsed 99%CPU (0avgtext+0avgdata 277664maxresident)k
0inputs+32outputs (0major+17695minor)pagefaults 0swaps
././fibheaps 300000 < /dev/null
**** expected exit status 0 not seen ; got 2
././fibheaps 300000 < /dev/null
expected stderr not matched by reality
--- /tmp/no_stderr3559  2010-05-17 07:35:09.000000000 -0300
+++ /tmp/runtest3559.2  2010-05-17 07:35:10.000000000 -0300
@@ -0,0 +1,2 @@
+Stack space overflow: current size 8388608 bytes.
+Use  +RTS -Ksize -RTS' to increase it.
Command exited with non-zero status 1
0.72user 0.06system 0:00.85elapsed 92%CPU (0avgtext+0avgdata 277664maxresident)k
368inputs+48outputs (1major+22085minor)pagefaults 0swaps
Command exited with non-zero status 2
0.71user 0.04system 0:00.78elapsed 97%CPU (0avgtext+0avgdata 277664maxresident)k
0inputs+32outputs (0major+17694minor)pagefaults 0swaps
././fibheaps 300000 < /dev/null
**** expected exit status 0 not seen ; got 2
././fibheaps 300000 < /dev/null
expected stderr not matched by reality
--- /tmp/no_stderr3578  2010-05-17 07:35:10.000000000 -0300
+++ /tmp/runtest3578.2  2010-05-17 07:35:11.000000000 -0300
@@ -0,0 +1,2 @@
+Stack space overflow: current size 8388608 bytes.
+Use  +RTS -Ksize -RTS' to increase it.
Command exited with non-zero status 1
0.72user 0.06system 0:00.80elapsed 98%CPU (0avgtext+0avgdata 277664maxresident)k
0inputs+48outputs (0major+22093minor)pagefaults 0swaps
Command exited with non-zero status 2
0.72user 0.06system 0:00.80elapsed 98%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+32outputs (0major+17696minor)pagefaults 0swaps
././fibheaps 300000 < /dev/null
**** expected exit status 0 not seen ; got 2
././fibheaps 300000 < /dev/null
expected stderr not matched by reality
--- /tmp/no_stderr3597  2010-05-17 07:35:11.000000000 -0300
+++ /tmp/runtest3597.2  2010-05-17 07:35:12.000000000 -0300
@@ -0,0 +1,2 @@
+Stack space overflow: current size 8388608 bytes.
+Use  +RTS -Ksize -RTS' to increase it.
Command exited with non-zero status 1
0.72user 0.07system 0:00.83elapsed 96%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+48outputs (0major+22095minor)pagefaults 0swaps
Command exited with non-zero status 2
0.68user 0.08system 0:00.78elapsed 97%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+32outputs (0major+17695minor)pagefaults 0swaps
././fibheaps 300000 < /dev/null
**** expected exit status 0 not seen ; got 2
././fibheaps 300000 < /dev/null
expected stderr not matched by reality
--- /tmp/no_stderr3616  2010-05-17 07:35:12.000000000 -0300
+++ /tmp/runtest3616.2  2010-05-17 07:35:12.000000000 -0300
@@ -0,0 +1,2 @@
+Stack space overflow: current size 8388608 bytes.
+Use  +RTS -Ksize -RTS' to increase it.
Command exited with non-zero status 1
0.70user 0.09system 0:00.80elapsed 98%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+48outputs (0major+22089minor)pagefaults 0swaps
Command exited with non-zero status 2
0.71user 0.06system 0:00.93elapsed 82%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+32outputs (0major+17695minor)pagefaults 0swaps
././fibheaps 300000 < /dev/null
**** expected exit status 0 not seen ; got 2
././fibheaps 300000 < /dev/null
expected stderr not matched by reality
--- /tmp/no_stderr3635  2010-05-17 07:35:12.000000000 -0300
+++ /tmp/runtest3635.2  2010-05-17 07:35:13.000000000 -0300
@@ -0,0 +1,2 @@
+Stack space overflow: current size 8388608 bytes.
+Use  +RTS -Ksize -RTS' to increase it.
Command exited with non-zero status 1
0.73user 0.06system 0:00.95elapsed 83%CPU (0avgtext+0avgdata 277680maxresident)k
0inputs+48outputs (0major+22089minor)pagefaults 0swaps
make[1]: ** [runtests] Erro 1
Failed making all in fibheaps: 1
make: ** [all] Erro 1

Erro is error in Portuguese. I ll investigate on that.

The Problem I was asked for advice on buying headphones to protect students who have medical conditions that make them sensitive to noise, such headphones would have to allow them to hear human voices. Due to the significant differences in hearing issues (including physical damage and sensory issues) it seems unlikely that getting identical headphones for all students will give an ideal result. The person who asked me the question didn t explain what type of students are being taught. If it s an adult education class then getting everyone the ideal headset wouldn t be particularly difficult. If however it s the special needs class in a high school then students would probably want the most shiny headphones rather than the ones that are a best match to their hearing issues. Also some combinations of hearing problems and ambient noise can t be addressed by such headsets. A friend who developed Noise Induced Hearing Loss from shooting tells me that he really can t stand brass instruments. But the high frequencies from such instruments tend not to be filtered well by noise canceling headphones, so any student who has such a problem would probably need hearing aids that filter out high frequencies I believe that such hearing aids are available but don t have any particular knowledge about them. Test Results I did a quick test on my Bose QC-15 noise canceling headphones [1] which cost me $320US including tax and my cheap Bauhn headphones from Aldi [2] which cost me $69AU (and which apparently could later be purchased on special for $35AU to clear stock). I found that when not playing music they seemed to perform about equally well in terms of allowing me to hear people speaking, although I admit that just having a conversation with the nearest people wasn t the most scientific test. When I was playing music I found that the Bose headset made it significantly more difficult to hear people speak than the Bauhn headset. This is an advantage for the Bose for it s intended use, and I expect that students who need a headset for medical reasons won t want to listen to music while studying so it s never a disadvantage. In both cases, if the headphones are used for just canceling unwanted noise the speaker shouldn t need to raise their voice significantly to be heard. In some situations the noise canceling headphones make it easier for someone with good hearing to hear what people are saying, for example a conversation in a car or plane could probably be held at a lower volume if all people involved were wearing suitable noise canceling headphones. If however the students have damaged hearing then I can t make any prediction as to whether the teacher could speak at a lower volume or whether they would be required to use a higher volume if the students wore such headphones. The Brookstone on-ear headphones that I tested [3] seem particularly noteworthy in this regard due to the way they canceled the melody of the store background music and just left the singing. If someone wants to buy headphones for people with physical damage to their ears then the Brookstone product is really worth investigating. If however the target market happens to be people on the Autism Spectrum then they may hate anything that presses on their ears (as I do) in which case the Brookstone product can t be considered. The Brookstone price of $150US (presumably $160 including tax) was also the best price I saw when shopping in the US but I presume that I could have found something with a similar quality and price to Bauhn in the US if I looked hard enough. Conclusion The big advantage of the Bose for this use is that it blocks a wider range of frequencies than some other noise canceling headsets. They all work really well on regular low frequency noise such as car engine noise (whether a car passenger or a pedestrian) but to stop certain higher frequencies such as those from air conditioning systems the Bose wins hands down. I guess this may depend on what noise is to be blocked, if a class was held in the same room every time and noise canceling headsets were purchased specifically for that class then it would probably make sense to ensure that the acoustic capabilities of the headsets match the unwanted background noise and the hearing issue that each student has. Here s an Amazon link: Bose QuietComfort 15 Acoustic Noise Cancelling Headphones I ve been reading about Sensory Processing Disorder. I m sure that some children are doing poorly in the default school system because they either have an undiagnosed case of SPD or who don t have enough symptoms to get a diagnosis. I think it would make a good experiment to try noise canceling headphones on some of the difficult children, I wouldn t expect a high success rate but if it worked in as little as 5% of cases and did no harm to the children who didn t benefit then it would be worth doing.

• [1] http://etbe.coker.com.au/2009/12/20/bought-the-qc-15/
• [2] http://etbe.coker.com.au/2010/03/25/bose-bauhn-aldi-noise-canceling-headphones/
• [3] http://etbe.coker.com.au/2009/12/04/testing-noise-canceling-headphones/

Today I strapped a kayack on a car (badly) and gingerly drove it out to the country, stopping for Greek food enroute. Now at my yurt, where I hung out and played Agricola all afternoon with my sister. Working on some processing of the 19 applicants for DebConfNewbies sponsorship while amazing venison potstickers are started. Tomorrow morning three kayackers will go out early and float down the river, and maybe find where the underriver creek emerges. Good times! Backing up a bit, the past two months have been significant ones. First, I quit my job. Then I almost bought a lot of land, which would have been huge, especially without an income. But it fell through just before closing, and I've had to push the idea of getting some land in the country back off into the indefinite future, where it probably belongs. Instead, Anna and Mark have been amazing, letting me come out here very regularly to unwind. And I've been very wound up, since there's a secret project under development that I can't discuss yet. Hmm, maybe not being on Facebook anymore will mean more personal blogging. That would be good. Now to go help with the potstickers..

Since AdBlock in Chrome does not block, just hide (the same probably applies to Safari and other WebKit-based-browsers), here's a simple method to actually block Facebook Like tracking:Use a proxy.pac file, also known as Proxy auto-config. Then redirect Facebook Like to a blackhole or filtering proxy. I use privoxy, and this replaces Facebook Like embeds with an error message, which enables me to see which site uses Facebook like and that my filter is working.Here's the relevant excerpt of my proxy.pac file:

function FindProxyForURL(url, host)  
  var fblike = /https?:\/\/([^/]*)\.facebook\.com\/(plugins widgets)\/like.*/;
  if (fblike.test(url))  
    return "PROXY 127.0.0.1:8118";
   
  return "DIRECT";
 

Where "127.0.0.1:8118" is the proxy to use. If you use an unreachable proxy - I've seen 255.255.255.0:3421 used as blackhole server - then it should just time out as "unreachable". Or you use a proxy such as privoxy and block the URL there. Any proxy that refuses to serve the request will do.Note that you can add arbitrary domains and regexps to this filter, if you want to block additional sites, such as Google Analytics, that you do not want to be able to track your surfing behaviour.