Search Results: "xam"

21 December 2007

Ian Wienand: Playing with the x86 PMU

A discussion about commas lead to an excuse to have a play with the IA-32 processor performance managment unit (PMU). To start, take two versions of a program to count the number of commas in a text file — one in C and one in Python. The C one runs faster on the input data set of ~60MiB of random data, but why? The CPU performance monitors give are the key to getting some idea of where the programs spend their time. I like to use perfmon2 because it's what I know, but Oprofile can do it too. All the available events for IA-32 are described in the manual; I currently of no better way of finding out about them than just reading it. On Itanium I reccommend Caliper which, for the most common situations, does most of the work for you and presents it in a nice report. Intel's Vtune also does a similar thing. The first thing to investigate is if the CPU is getting enough instructions to keep busy. The IFU_MEM_STALL metric is a good place to start as it is triggered when the instruction fetch pipeline is stalled, presumably waiting on either the ITLB or the trace buffer (Icache).
$ pfmon -e CPU_CLK_UNHALTED,IFU_MEM_STALL ./comma < ./randomcommas
340559375 CPU_CLK_UNHALTED
   192115 IFU_MEM_STALL
$ pfmon -e CPU_CLK_UNHALTED,IFU_MEM_STALL python -Sc "import sys; print sum(l.count(',') for l in sys.stdin)" < ./randomcommas
1287100
4571257047 CPU_CLK_UNHALTED
 71981750 IFU_MEM_STALL
That works out to 0.05% of total cycles for the C version and 1.5% for the Python version, neither of which sets off immediate warning bells. If it did, we could start drilling down to things like the L2_IFETCH and ITLB_MISS events, or the BR_* branch events to try and see why the CPU is having to wait to get its next instruction. Next it is useful to find the CPI (cycles per instruction). This is calculated by the ratio of retired instructions against the number of CPU cycles; since a superscalar machine can issue more than one instruction per cycle this should ideally be much greater than 1 (for example, an Itanium can execute up to 6 instructions each cycle).
$ pfmon -e INST_RETIRED,CPU_CLK_UNHALTED ./comma < ./randomcommas
542953593 INST_RETIRED
340612036 CPU_CLK_UNHALTED
$ pfmon -e INST_RETIRED,CPU_CLK_UNHALTED python -Sc "import sys; print sum(l.count(',') for l in sys.stdin)" < ./randomcommas
1194455205 INST_RETIRED
4569931735 CPU_CLK_UNHALTED
This works out at a CPI of 1.59 for the C version and 0.26 for the Python version. The Python version is clearly spending a lot of time waiting, because it isn't even able to issue one instruction every cycle. At this point it seems the CPU has enough instructions to do, but it is sitting around waiting to get through those instructions. This suggests the waiting is related to getting data from the cache. The load and store requests from the L2 cache are accounted to the L2_LD and L2_ST events respectively. These have the ability to mask out cache lines in different states of the MESI protocol, but for this we don't care so just ask pfmon to show us everything.
$ pfmon -e L2_LD:M:E:S:I,L2_ST:M:E:S:I ./comma < randomcommas 
102505 L2_LD:M:E:S:I
   167 L2_ST:M:E:S:I
$ pfmon -e L2_LD:M:E:S:I,L2_ST:M:E:S:I python -Sc "import sys; print sum(l.count(',') for l in sys.stdin)" < ./randomcommas
3278774 L2_LD:M:E:S:I
  10457 L2_ST:M:E:S:I
This shows us that the Python version does quite a few more stores than the C counterpart. Considering this program should simply be reading the input stream and counting the number of commas, we do not expect much store traffic at all. This suggests the Python version is doing some extra copying, for whatever reason (maybe some Python expert can pinpoint it?). We can drill down a bit more into the memory related latencies. The DCU_LINES_IN event gives the total number of lines allocated in the cache. Another event, DCU_MISS_OUTSTANDING, gives a weighted measure of the cycles spent waiting for a cache line to be brought in. Each cycle spent waiting is weighted by the number of outstanding cache misses (I think the Pentium M I'm using can have up to 4 cache miss requests outstanding at once) and has some caveats, but can be considered a rough estimate of the time spent waiting for a cache line to be brought in. Therefore divding DCU_MISS_OUTSTANDING by DCU_LINES_IN gives us an approximate metric of how long a cache miss takes.
$ pfmon -e DCU_MISS_OUTSTANDING,DCU_LINES_IN ./comma < randomcommas 
769736 DCU_MISS_OUTSTANDING
102387 DCU_LINES_IN
$ pfmon -e DCU_MISS_OUTSTANDING,DCU_LINES_IN python -Sc "import sys; print sum(l.count(',') for l in sys.stdin)" < ./randomcommas
99810150 DCU_MISS_OUTSTANDING
 4240179 DCU_LINES_IN
So that works out to 7.5 cycles for the C version and 23 cycles for the Python version. This seems to strongly suggest that it is memory traffic that is weighing the Python version down. That is only the initial phase; the results give a high level idea of why one program is running slower than the other. The initial analysis phase generally consists of taking the ratios of certain events to try and get some idea in your head of what the program is doing. Then comes the really hard work; drilling down to figure out how to fix it! Some useful references:

20 December 2007

Stefano Zacchiroli: pts face lifted

PTS face lift(ed!) Ok, by now you've probably all already noticed, but I've finally committed the changes to the PTS package pages which implement a new layout and CSS. Thanks to Dan Callahan, Enrico Tassi and madcoder for their help with the CSS and to all who gave feedback (sorry, if it wasn't possible to satisfy all look and feel requests at the same time). There are still some minor, freshly introduced, glitches to fix (see for example 457168 and 457169), but I'm kinda tired to play with CSS and I'll give up for a while. But patches are always welcome!, I'll do my best to apply them timely. While I was at it, I've also fixed some other minor nuisances, such as the svnbuildstat link which is now shown only if the package is actually indexed by svnbuildstat. Thanks to Gon ri for having made available the info. PS totally unrelated, but thanks to Lucas now the homepage and vcs stats page sport wonderful graphs!

Simon Richter: The Debian package namespace

A Debian package is uniquely identified by its name and version; there is no further information taken into account by dpkg. This keeps the packaging system rather simple, but has the disadvantage that all information that would otherwise be placed in extra data fields has to be encoded into these two fields. As the names of all binary packages generated from a single source package need to be known when building the .dsc file, no substitutions are allowed in the package name. Back in the Good Old Days, the only extra bit of information in the name field used to be the SONAME from the library in the package (thus implicitly saying that each library should have its own package), which meant that the maintainer had to adapt the debian/control file every time a library's ABI changed. This being the Good Old Days, people writing libraries actually thought about things, so ABI changes were few and far between. These days, libraries are stacked on top of each other, re-exporting the underlying libraries' ABI. The SONAME system could in theory handle these situations if the SONAME of every library whose ABI is re-exported is encoded into the SONAME of the newly built library. So if my own ABI version is "2", and some of the functions I export use types defined in glib, then after building against glib1.2, my SONAME would be somewhat similar to "2+glib1.2". For languages that don't have a well-defined ABI (i.e. anything but C), the version of the language ABI(s) used will also have to be added. Obviously, this would also have to be encoded into the package name, which is where trouble starts during transitions. The last C++ ABI transition had all C++ library maintainers add a suffix to the package name; dependent ABIs are not handled at all in Debian right now (which led to the libpng mess). The existing encoding rules are not entirely formalized, and it is not guaranteed that they are bijective. For example, packages used together with cross compilers have been following the convention of using the name that the native package would use, followed by a dash, the target architecture name, another dash and the word "cross". There is no guarantee that the architecture name does not contain a dash, however, so we cannot simply take the second to last word as the architecture name if the last word is "cross" (think "libgcc1-kfreebsd-i386-cross"), which makes it difficult to write a plug-in to apt that would automatically download the binary for the target architecture and convert it using dpkg-cross. I've decided to nonetheless go ahead with my request that the "-*-cross" part of the package name space be reserved for packages related to cross compilation; it will work for the time being.

19 December 2007

Neil Williams: First working version of em_installtdeb in Emdebian SVN

Emdebian SVN r2618 includes my first working implementation of em_installtdeb. Barring a single annoyance message from dpkg, the script works. :-)
The warning arises from the need for a modified "source" tarball that can be uploaded alongside the .deb, containing only the sources needed for this specific translation: debian/control, debian/changelog, po/$lang.po /* if any */ and po/$GETTEXT_PACKAGE.pot. Where a package contains more than one po directory, all POT files are included and all po files for the requested translation. This allows translations to be updated independently of the upstream package.
I would advise using a test directory if you do want to try it, not your main package building directory. ;-)
Output (using gpe-expenses as the demo package) in translator mode:

$ em_installtdeb sv
dpkg-deb: building package gpe-expenses-locale-sv' in ../gpe-expenses-locale-sv_0.1.4-1_all.deb'.
dpkg-source: warning: .orig.tar name gpe-expenses_0.1.4.tdeb.tar.gz is not _.orig.tar (wanted gpe-expenses_0.1.4.orig.tar.(?:gz bz2 lzma))
dpkg-source: building gpe-expenses using existing gpe-expenses_0.1.4.tdeb.tar.gz
dpkg-source: building gpe-expenses in gpe-expenses_0.1.4-1.diff.gz
dpkg-source: building gpe-expenses in gpe-expenses_0.1.4-1.dsc
dpkg-genchanges: including full source code in upload
Format: 1.7
Date: Fri, 07 Dec 2007 00:08:39 +0000
Source: gpe-expenses
Binary: gpe-expenses-locale-sv
Architecture: source all
Version: 0.1.4-1
Distribution: unstable
Urgency: low
Maintainer: Neil Williams
Changed-By: Neil Williams
Description:
gpe-expenses-locale-sv - sv translation for gpe-expenses
Changes:
gpe-expenses (0.1.4-1) unstable; urgency=low
.
* New upstream release
* use machine operable debian/copyright, migrate to standards 3.7.3
Files:
781a60eccc4396ee3f0f86a01150e755 316 misc extra gpe-expenses_0.1.4-1.dsc
f9dd946db27ff6077f8e85f7100d3ea4 5863 misc extra gpe-expenses_0.1.4.tdeb.tar.gz
894f5789ee0348abfa61a5e7342ed6a7 20 misc extra gpe-expenses_0.1.4-1.diff.gz
56f8d22c30cb5502633ff4d26862db78 4532 misc extra gpe-expenses-locale-sv_0.1.4-1_all.deb
Package-Type: tdeb
Changes file: ../gpe-expenses_0.1.4-1_tdeb.changes
signfile ../gpe-expenses_0.1.4-1.dsc 0x28BCB3E3

You need a passphrase to unlock the secret key for
user: "Neil Williams (Debian) "
1024-bit DSA key, ID 28BCB3E3, created 2002-01-27


signfile ../gpe-expenses_0.1.4-1_tdeb.changes 0x28BCB3E3

You need a passphrase to unlock the secret key for
user: "Neil Williams (Debian) "
1024-bit DSA key, ID 28BCB3E3, created 2002-01-27


Successfully signed dsc and changes files
neil@holly:gpe-expenses$ dpkg -c ../gpe-expenses-locale-sv_0.1.4-1_all.deb
drwxr-xr-x neil/neil 0 2007-12-19 14:37 ./
drwxr-xr-x neil/neil 0 2007-12-19 14:37 ./usr/
drwxr-xr-x neil/neil 0 2007-12-19 14:37 ./usr/share/
drwxr-xr-x neil/neil 0 2007-12-19 14:37 ./usr/share/locale/
drwxr-xr-x neil/neil 0 2007-12-19 14:37 ./usr/share/locale/sv/
drwxr-xr-x neil/neil 0 2007-12-19 16:09 ./usr/share/locale/sv/LC_MESSAGES/
-rw-r--r-- neil/neil 6419 2007-12-19 16:09 ./usr/share/locale/sv/LC_MESSAGES/gpe-expenses.mo
-rw-r--r-- neil/neil 1796 2007-12-19 16:09 ./usr/share/locale/sv/LC_MESSAGES/qofexpensesobjects.mo

Hmm, that isn't right - need to check on the ownership of those files - might be enough to use fakeroot.

$ dpkg -I ../gpe-expenses-locale-sv_0.1.4-1_all.deb
new debian package, version 2.0.
size 4532 bytes: control archive= 302 bytes.
230 bytes, 9 lines control
Package: gpe-expenses-locale-sv
Source: gpe-expenses
Version: 0.1.4-1
Architecture: all
Maintainer: Neil Williams
Installed-Size: 44
Section: misc
Priority: extra
Description: sv translation for gpe-expenses


em_installtdeb is a debhelper add-on created by Emdebian to create translation packages (tdebs). em_installtdeb is intended to separate out the individual translation files from the current Debian packages into packages without any translation files and a series of tdeb locale packages, one per translation. Generated packages use the syntax: $package-locale-$language_code_$version_all.deb
Certain language codes need to be modified to make acceptable components of a debian package name. Underscores are converted to hyphens, '\@' is converted to '+' and all codes are made lowercase. These changes only apply to the package name, the installation location is unchanged.
The locale package must use GETTEXT_PACKAGE for the eventual filename of the binary translation file - not the $dh MAINPACKAGE . GETTEXT_PACKAGE is determined by upstream, not Debian. When building the whole package, the binary translation file may be in debian/tmp/usr/share/locale/$lang/LC_MESSAGES but when in translator mode, this location is not available. Instead retrieve GETTEXT_PACKAGE from the POT filename. debian/control is needed for various dpkg and debhelper calls only.

The "source" for translators therefore includes:
debian/control
debian/changelog
po/$lang.po /* if any */
po/$GETTEXT_PACKAGE.pot

Note that no rules file exists. (i.e. dpkg-source -x will complain when trying to extract it later so a new wrapper is needed (not difficult).)
em_installtdeb will try to generate the necessary POT file(s) and then create a $package_$version_tdeb.tar.gz containing the source files.
The default action is to process all available po files.
The above example uses translator mode where LANG_CODE is passed to only handle that language. In translator mode, em_installtdeb builds a tdeb package, a source tarball, a .dsc and a .changes file (and signs the .dsc and .changes). In default mode, em_installtdeb builds the package(s) but leaves the source, .dsc and .changes to the rest of the build process.
LANG_CODE can either be the name of the locale as specified in the PO filename (fr, en_GB, sr@Ltn etc.) or the name of the locale as specified in the eventual package name (fr, en-gb, sr+ltn etc.).
If a po file already exists for this locale, em_installtdeb processes just that one translation and builds a single tdeb package.
If the po file does not exist, em_installtdeb exits with an error. (Copy the POT file from the original source to create a new po file for the new locale and edit it to include the new translation, then run em_installtdeb again.)

Output in default mode:
$ em_installtdeb
dpkg-deb: building package gpe-expenses-locale-cs' in ../gpe-expenses-locale-cs_0.1.4-1_all.deb'.
dpkg-deb: building package gpe-expenses-locale-de' in ../gpe-expenses-locale-de_0.1.4-1_all.deb'.
dpkg-deb: building package gpe-expenses-locale-pt' in ../gpe-expenses-locale-pt_0.1.4-1_all.deb'.
dpkg-deb: building package gpe-expenses-locale-sv' in ../gpe-expenses-locale-sv_0.1.4-1_all.deb'.
dpkg-deb: building package gpe-expenses-locale-vi' in ../gpe-expenses-locale-vi_0.1.4-1_all.deb'.

Next stage is to fold this into emdebian-tools so that the emdebian patch files can be cleaned up and various complex patches to debian/rules can also be cleaned up.
Finally, note that this only supports gettext and only supports program translations. This is an Emdebian script written with an eye on usage in Debian but primarily intended to meet Emdebian requirements. As outlined before, Emdebian does not want language packs or translation grouping. One locale, one package.
See also langupdate in Emdebian SVN.

Lucas Nussbaum: Is it hard for new contributors to help Debian? Can we improve things a bit?

Debian could use more manpower, but is it actually easy for new contributors who would like to help to do useful things, and get the impression that they actually improved Debian? There are several problems here: I think that other projects are better than us at providing directions to newcomers. Gnome has the whole Gnome Love thing, for example. I’m thinking about building lists of “interesting” bugs. That would include RC bugs without patches, of course, but could also include a list of bugs based on an usertag that would mean “This bug is suitable for new contributors (it’s not too hard, and you could learn things fixing it). If you want to work on this bug, I’ll provide help and feedback and integrate your patch ASAP.” (This is very different from the “help” tag, which usually means “I couldn’t fix this, it’s too hard, I need help.“. It’s a bad idea to direct newcomers to bugs that are too hard for the package’s maintainer!) Additionally, a nice feature would be to be able to filter the list of bugs with the packages that the user has installed. Comments are open, please us them ;)

18 December 2007

Russell Coker: The Net - Good for Literature

A recent news article has Doris Lessing (a Nobel prize winner for literature) claiming that the net has “created a world where people know nothing” [1]. However the Internet is a great tool for learning for people who choose to use it in that way, for example I have learned many interesting things from reading Wikipedia and following the links which I probably wouldn’t have learned in any other way. Criticising the Net for the lack of reading by the population makes just as much sense as criticising newspapers. She gives an example of a North London school where the library was under-utilised and compares it to schools in Africa where students beg for books and claims that the Net is at fault. But you could just as easily blame newspapers as Britain has some of the worst examples of tabloid journalism in the English language - of course Britain also has some really high quality papers and anyone can choose which ones to read. I think that when children don’t have much interest in reading it’s more sensible to criticise the education system. The article is not that great either, one significant flaw is referring to Elton John as “another creative type“. No, Elton is a formerly creative type who’s afraid that the pension he expected from his back catalogue is threatened. Ex-artists who complain about the Net merely demonstrate that for them it’s not about the music. The Wikipedia article about Elton John [2] documents his career and you can see that since the late 80’s it’s been steadily going downhill. To create literature you must read it - which doesn’t mean being close to old-fashioned libraries (as Doris claims). Currently I am trying to write science fiction, largely inspired by Cory Doctorow [3] and www.365tomorrows.com/. One good thing about the Internet is that there is a reasonably level playing field that everyone can compete on. Bloggers compete for readers using all forms of writing - including literature. The speech has more information about Zimbabwe [4] and the difficulties faced by people there who want to learn. One thing that has the potential to improve the situation there is the One Laptop Per Child [5] project. Such a laptop costs about the same amount as 20 novels (based on US prices) or 5 text books but can be used to store many more books.

16 December 2007

Erich Schubert: Keeping the website up in rankings

My personal web site - which actually is not particularly interesting, IMHO - used to get in a lot of traffic via Google. It was highly ranked on several quite interesting search terms. For example, it's still number 1 on the search term "Halbleiterlaser" (semiconductor laser), which is the topic of my secondary school thesis. So I still win against Wikipedia on this one. For "flowers" I sometimes and up at #1 in Google image search (causing lots of people to hot-link certain images from my site... might be with some geo targeting though?) But I've lost other battles to Wikipedia by now, such as the search term "Liebeskummer" ("lovesickness"; I have some old old poetry online that people dig a lot; this still makes up the biggest share of my visitors)My rankings have dropped quite a lot the last year, down about 50% within a year. I don't know if this is because I'm blogging a lot less, because I'm not updating it often enough or because Google doesn't like the redesign as much as it did like the old one. (The redesign was 2 years ago, followed by a drop in visitor numbers but a recovery to like 70% within a month)Algorithmic changes of Googles ranking are just another possible reason; I always felt as if my placement was highly overrated anyway.I added at a Google sitemap some months ago and other things that people expect to help with their site being well included, but it didn't stop the numbers from going further down. For obvious reasons I didn't buy any links or anything; I'm not making my living with that page or anything, it's just a pet project thingy. (So obviously, don't make me any SEO offers for my page!)Still it's a pity: I used to have a couple of really major placements on Google - so much that I've had some inquires if I'd like to sell my personal homepage (nah, I don't want to have to get a new email address!), offers by reputable and huge dating sites to put up ads on my page and surprisingly high offers for including my web page in link farms - but I'd have issues with that (I'd like to keep control of what my page contains; including content that might get Google to ban my page is scary), and it would have required me to run my page on PHP (ugh).I wish there was an easy way to just keep the rankings I mysteriously had acquired the last years. :-) For some time it looked like I had some magic SEO capabilities, and friends suggested I should consider actually going into the SEO business. My page is still overrated by Google, but it seems like it has lost much of it's magic.P.S. A fun story followup: I've just noticed that someone in a french cooking forum hotlinks to a photo of mine, claiming that he had cooked the food I did. Isn't that hilarious? Should I substitute that image with a g*atsee?

15 December 2007

Joerg Jaspert: Using a SSH jumphost

As Tolimar was asking about it and I am using the setup at some places to get past idiotic^Wbroken firewalls, where you always want to kill the clueless people that did set them up - lets write a bit how to ease ssh usage at such locations. Imagine a place where you can’t ssh elsewhere directly, you have to go through at least one, in some cases two or three hosts, to get anywhere sane.[1] So the topic is SSH jumphost. Thats basically what you do manually if you
  ssh some.host
  ssh next.host
where some.host is your jumphost. Add as many some.host as you want into this chain. We are all lazy and don’t want to type that by hand, one ssh is enough for everybody. Hurray, ssh already provides what we need, namely the ProxyCommand directive, it’s just not known as much as it should be. For this example imagine I have to ssh via the following host chain to get out: kosh -> vir -> babylon5 -> sheridan and also want to have my local port 2525 forwarded to sheridans port 25. The following config snippet (.ssh/config) is doing that[2]
 Host yay
 ProxyCommand ssh -q -A -X vir ssh -q -A -X babylon5 'nc -w1 sheridan 22'
 LocalForward 2525 localhost:25
   
 Host vir
 ProxyCommand ssh -q -A -X kosh 'nc -w1 %h %p'
The effect of this is: and I end up having a shell on host sheridan. The LocalForward line also tells ssh to tunnel my port forwarding over that multi-hop session, voila, done. Of course there is a little caveat with this - all hosts do have to know the next one (ie. .ssh/known_hosts should have the right data). You should also think about using ssh keys (maybe including Agent forwarding). You really dont want to see 5 Password: prompts right behind each other for a 5-hop setup - with no clue if its for the next host or for a typo… Update: If you are a Debian Developer and do not have a host “outside” that listens to something else than Port 22 but are behind a firewall that only allows Port 80 and 443 - you are lucky. As long as you aren’t hit by [1] you put the following into your .ssh/config file and have fun:
Host foo.gl bar.gl
ProxyCommand ssh -q -a -p 443 -x gluck.debian.org 'nc -w1 $(basename %h .gl) 22'
Add as many other config options as you want. The effect is: and as such you can get out via gluck. We are using the .gl as an extension here to remember that we go via gluck. Idea stolen from someone on IRC, just can’t remember who atm. [1] For added fun, which I have at one place, add things like a proxy with user authentication done in a way that tools like tor or openvpn can’t get through it and you always wish those admins use Windows, just so they suffer. Anyway, I talk about the first part only, using jumphost, other ways getting around crap admins needs, in my case, an own script to do it, not part of this topic… [2] Yes, one can do it in lots of ways and those here might not be the most optimized/nice/whatever ones. But they work and are just examples here, select your own parameters if you dont like mine!

Russell Coker: AISA

When I worked for Red Hat I joined AISA [1] (the Australian Information Security Association - formerly known as ISIG). Red Hat marketting paid for my membership so it was a good deal, I went to meetings (which often had free drinks), said good things about Red Hat security, and it cost me nothing. I was recently asked why I chose not to renew my membership, I didn’t have time to give a full answer so I’ll blog it now. AISA offers discounts on some conferences, books, and training related to computer security, if you plan to purchase such things then they do offer good deals. However I have little time to attend conferences at the moment, not enough time to read all the free Internet resources related to computer security, and feel no need to pay for such training. If at any time I plan to attend a conference where the discount for AISA members is equal or greater than the AISA membership fee then I can easily re-join. AISA membership seems largely to consist of managers and consultants not technical people or people doing R&D type work. This isn’t a bad thing if you are a manager or consultant, but when attending AISA meetings I don’t meet the type of people I meet at events such as SecureCon [2], Linux Conf Au [3], RuxCon [4], and the SE Linux Symposium [5] (which I think is not going to be held again for a while). Meetings of my local LUG [6] typically have more people doing serious technical work related to computer security than the AISA meetings I’ve attended. The AISA code of Ethics has as it’s second criteria “I will comply with all relevant laws“. Some laws can not be obeyed by decent people (study some German or Russian history or what is happening in China right now for examples). Many other laws should not be obeyed. Many countries (including Australia) have enacted many laws which should not be obeyed in the name of the “war on terror“. A final thing that irked me about AISA is their professional membership system (click on this link and download the AISA_Professional_Membership_Requirements_Nov_2006 document for details). It seems that I don’t qualify because I don’t have one of the listed certifications, and a public credit on the NSA web site [7] doesn’t count (yes, I asked about this). I’m not overly worried about this, I figure that any clique that won’t accept me also won’t accept a significant portion of the people that I want to associate with - so we can hang out elsewhere. I don’t recall there being any great benefit to professional membership apart from the possibility of adding it to your business card if you are so inclined (I don’t recall ever putting B.Sc [8] on a business card and don’t plan on adding anything less). There are some real benefits to AISA membership, but not for me.

14 December 2007

Joerg Jaspert: Using a SSH jumphost

As Tolimar was asking about it and I am using the setup at some places to get past idiotic^Wbroken firewalls, where you always want to kill the clueless people that did set them up - lets write a bit how to ease ssh usage at such locations. Imagine a place where you can’t ssh elsewhere directly, you have to go through at least one, in some cases two or three hosts, to get anywhere sane.[1] So the topic is SSH jumphost. Thats basically what you do manually if you
  ssh some.host
  ssh next.host
where some.host is your jumphost. Add as many some.host as you want into this chain. We are all lazy and don’t want to type that by hand, one ssh is enough for everybody. Hurray, ssh already provides what we need, namely the ProxyCommand directive, it’s just not known as much as it should be. For this example imagine I have to ssh via the following host chain to get out: kosh -> vir -> babylon5 -> sheridan and also want to have my local port 2525 forwarded to sheridans port 25. The following config snippet (.ssh/config) is doing that[2]
 Host yay
 ProxyCommand ssh -q -A -X vir ssh -q -A -X babylon5 'nc -w1 sheridan 22'
 LocalForward 2525 localhost:25
   
 Host vir
 ProxyCommand ssh -q -A -X kosh 'nc -w1 %h %p'
The effect of this is: and I end up having a shell on host sheridan. The LocalForward line also tells ssh to tunnel my port forwarding over that multi-hop session, voila, done. Of course there is a little caveat with this - all hosts do have to know the next one (ie. .ssh/known_hosts should have the right data). You should also think about using ssh keys (maybe including Agent forwarding). You really dont want to see 5 Password: prompts right behind each other for a 5-hop setup - with no clue if its for the next host or for a typo… [1] For added fun, which I have at one place, add things like a proxy with user authentication done in a way that tools like tor or openvpn can’t get through it and you always wish those admins use Windows, just so they suffer. Anyway, I talk about the first part only, using jumphost, other ways getting around crap admins needs, in my case, an own script to do it, not part of this topic… [2] Yes, one can do it in lots of ways and those here might not be the most optimized/nice/whatever ones. But they work and are just examples here, select your own parameters if you dont like mine!

Martin F. Krafft: Finally on the right track

It's now three weeks since I am officially a Ph.D. student at the University of Limerick, but I've been too busy to do anything about it. Today, I finally updated my research webpage and sat down to tell you the tale of how I successfully defended my research, but failed to leave the country the next day. As is customary in the British system, I initially enrolled at UL as a Master student. In October, I then applied for a transfer to the Ph.D. track, submitted a transfer report and prepared for a live defence, according to the UL code of practice. On 23 November, I presented my research to my examiners, Dr. P r gerfalk and Patrick Healy, who found my work to be at Ph.D. level and approved of my transfer. I was moderately nervous going into the presentation, not really knowing what was expected of me. In the end, however, the presentation went well and the ensuing discussion provided valuable feedback. Thank you, P r and Paddy, as well as Norah (who chaired), and Brian (my supervisor) for all your time, help, and support. After the defence, Mel waited outside with a beer in hand, and it being Friday and all, I happily popped the cap and drank. Plans to head to The Stables gave way to chilling on the couch in 110 (my home away from home), before we headed to town for the Kila gig. We arrived early, had some beers, enjoyed the show, had some more beers, went home, and had some more beers to Guitar Hero, and when I crawled into bed, I was shocked to find out that I had lost all track of time and it was in fact already 5:30 on Saturday morning, instead of the perceived 2 o'clock. See, the source of this shock was a plane that left Dublin the next day around noon, and a rental car that was to get me there, leaving the house at 8. But when my alarm shattered my drunk dreams at 7:30, it quickly became clear (or well, everything was blurred, actually), that I would have a hard time getting into the car, and I would certainly never manage to navigate it to Dublin, a three hour drive. So I called up the airline and the rental company and rescheduled for the next day (only one flight from Dublin to Zurich a day), and went back to dreamland. I am entirely unsure whether my Ph.D. transfer defence was enough of a reason to get smashed. I still had a good time, though as always in Ireland, especially with this crowd NP: The Flower Kings: The Rainmaker

Russell Coker: Blogroll - Bad Social Networking

A common feature in blog software is a Blogroll, this is a list of links to blogs which are associated in some way with the blog in question - most commonly it’s a list of blogs run by friends of the blogger in question. Now in the case of friends with very similar interests (IE same religious and political beliefs, sexual preferences, hobbies, etc) this wouldn’t cause a problem. In the case of commercial blogs it also will work well (EG Google runs a large number of blogs which contain links to all the rest - they may not interest all readers but should be expected not to offend any). In the case of personal blogs where people don’t always have the same interests there is scope for problems. A link to the main page of a blog is an unconditional recommendation for the blog. There are not many of my friends who I share that much in common with that I would be prepared to give such a recommendation for a frank personal blog, and for those few I am unwilling to do so as it generates social pressure to include others. Some of my friends who didn’t get listed in my blogroll would probably get offended, even though it’s only the occasional post that I strongly disagree with which would make me refrain from such a listing. I appreciate it when people add me to their blogroll, but don’t have any expectation that the listing will remain (I’m not going to get offended if someone changes their criteria for listing and removes my entry). But I consider it an equal compliment when someone cites one of my blog posts as a reference and recommends that other people read it. Citing an individual post has the advantage (for the person citing the post) they are specifically not recommending my entire blog. For example if you recommend one of my posts about Linux and one of your readers goes further into my site and is offended by my posts about politics then it’s not your issue. Tim Berners-Lee made an interesting point [1] “so readers, when they find something distasteful or unreliable, don’t just hit the back button once, they hit it twice“. I know that some people who would be interested in the technical Linux issues I write about don’t read my blog because they are offended by my political beliefs, I am not concerned about this - but I don’t expect that everyone who chooses to link to me will necessarily want to make the same trade-off. When citing individual posts it’s possible to strongly agree with one post and strongly disagree with another by the same author. Probably the best way of acknowledging your friends via blogging (if you choose to do so) would be to make an occasional links post which contains short positive recommendations to the best posts your friends wrote. If every month or two someone writes a links post (post which has little content, merely recommendations for other posts) which references your posts then you know that they like you (and you get a Technorati.com boost), so a blogroll entry hardly seems necessary. An additional benefit for giving such direct credit is that the person receiving the links will know what you consider to be their best work which will help them in their future writing. I believe that adding this feature to common blogging software was a mistake. The small number of people who actually need this (such as Google) can create it via a HTML widget (IE writing raw HTML for the page - it’s really easy to do) and the rest of the population would be better off without it.

13 December 2007

Michael Prokop: Checklist for 1:1 clone of a Debian system

When cloning a Linux/Debian system 1:1 you should have a checklist of what’s important to change on the cloned system. For cloning I use the grml Linux Live-CD of course (the following tips are part of grml-tips as well). To create a 1:1 clone I boot grml on the systems (usually using the ssh=password bootoption to be able to access the system remotely as well) and use something like:
Listener:
# nc -vlp 30000 > /dev/sda1
Source:
# dd if=/dev/sda1 bs=$VALUE   nc -vq 0 $IP_OF_LISTENER 30000
When I have to leave the place where the clone process is running and if the CD-ROM doesn’t reinsert CDs on reboot automatically (usually that’s the case for server systems) I can use my remote-reboot procedure via ssh later on like:
eject &>/dev/null
umount -l /cdrom
eject /dev/cdrom
echo b > /proc/sysrq-trigger
But stop: before executing the last steps to reboot the server you should take care of a few important steps, otherwise rebooting might fail and you won’t be able to login via SSH. ;-) That’s my personal checklist: Tip: I highly recommend the use of a version controll system for maintaining /etc, for example etckeeper and mercurial should do the job for you.

12 December 2007

Alastair McKinstry: Waiting for CoRoT

So, the CoRoT team apparently had a meeting in Paris on Monday. I've been waiting with baited breath (and intermittent internet access, for assorted reasons) for the results of a "Press Conference", that according to the blogosphere rumour mill, and a (started by a breathless interim report) was going to rewrite the sciences of exoplanets and stellar seismology. There were rumours of special editions of Nature (or Science, or A & A), Earth-mass planets (possible according to the apparent spec. of CoRoT). This mattered to me as I'm finishing up a literature review for a PhD and the work is on exoplanets, and depends a lot on stellar variation. CoRoT could rewrite large sections of my conclusions. So, it looks like I finish my review and just have to be patient while they release their results in the proper peer-reviewed manner. But it would probably be a good idea for the CoRoT team to set up a blog, as Rumour Central, to respond to mentions and rumours about their project that appear on the 'net. Kudos, for example, to Wesley Traub for taking the time to answer my questions aboout Darwin/TPF in this manner. Tags , , ,

11 December 2007

Neil McGovern: Tor, privacy and anonymous browsing

An interesting discussion appeared on #debian on OFTC regarding TOR. One person was of the view that "many intelligence and other agencies are probably heavily involved in tor". As the discussion continued (yes, I should have pointed out it was OT for the channel...) it appeared that privicy and anonymity were getting confused.

Now, I'm not a huge TOR fan (being an oper on OFTC), but I seriously doubt that government agencies are 'heavily involved'. I was pointed at an article to back this claim up, but the article doesn't. Instead, it (and the original claim) raises a couple of interesting issues.

Firstly, there is a difference between privacy and anonymity, although closely related. Privacy allows you to keep information about yourself secret, and anonymity allows you to keep you yourself secret. In the case linked, although the people browsing were anonymous, and maintained privacy, this was broken when they revealed information about themselves. Breaking this privacy broke their anonymity. TOR doesn't even grantee complete anonymity:
Tor can't solve all anonymity problems. It focuses only on protecting the transport of data. You need to use protocol-specific support software if you don't want the sites you visit to see your identifying information. For example, you can use web proxies such as Privoxy while web browsing to block cookies and withhold information about your browser type. Also, to protect your anonymity, be smart. Don't provide your name or other revealing information in web forms.
[http://www.torproject.org/overview.html.en]

Used properly, TOR can be a very powerful tool to help, but certainly isn't a silver bullet. It needs to be used properly to prevent your identity being known (anonymity). However, without privacy, this is nothing.
Even without these safeguards, it would require significant resources (and may not be possible) to reliably retrieve useful information about one particular person. This leads to the Greater Internet Fuckwad Theory, which is the main issue I have with TOR, but that's a different post.

So, the question is: do you want privacy or anonymity when using the internet? You need to know what you want before you use a tool, as nothing can beat user education on how to keep your browsing details out of the 'wrong hands'.

10 December 2007

Ross Burton: Philosophical Sifting

The Daily Mail, as you know, is engaged in a philosophical project of mythic proportions: for many years now it has diligently been sifting through all the inanimate objects in the world, soberly dividing them into the ones which either cause - or cure - cancer. The only tragedy is that one day, amongst the noise, they might genuinely be on to something, and we would simply laugh. That day has come. ― A Rather Long Build Up To One Punchline
A classic example of the Mail taking a valid scientific press release (that is a surprise) and twisting it into a scare story for no real reason. I wish I could understand how this works to sell papers, although I guess at the end of the day regurgitating a press release with added anger and Moral Outrage without doing any relevant research is a pretty cheap way of filling column inches. NP: F♯ A♯ ∞, Godspeed You Black Emperor!

9 December 2007

Ross Burton: Glib and Serial Port Help

So I want to write a small program to read and write data to a serial port (115200 baud, 8N1) using GIOChannel. No matter what I try, I can't seem to get input callbacks from the channel. :( Does anyone have any small working examples of using a GIOChannel to drive a serial port I can look at? NP: Mungo's Hi-Fi at Exodus

Evan Prodromou: 18 Frimaire CCXVI

Chris Messina wrote an interesting post on his blog about his OpenID Shitlist, Hitlist and Wishlist for 2008. (I'm going to briefly try to remember if using the word "shit" is cause for alarm on Planet Debian, and then I'm going to ignore the problem and move on.) I think it's a good post and it really identifies some of the key players that are helping and failing in the OpenID space. I got a shout-out for Wikitravel and for the MediaWiki OpenID extension, which yay for me. I think Chris was probably a little unfair about Wikimedia's lack of support. The site is moving very slowly towards a unified login for all its wikis, which is a really difficult task to make happen. OpenID is slated for installation some time after that, so it's going to be a while. But I hope that it will be useful for Wikipedians. My main impression from this blog post, however, is that OpenID's day in the sun might be over. That's not a bad thing -- usually the hard work gets done after the cameras are turned off. Zealots like myself tend to think that if only the world knew about our latest-greatest idea or technology, they'd fall right into line and adopt it immediately. But my experience has been that things work a lot slower than that, and I'd guess that OpenID is probably going to have a similar adoption curve. In thinking about opening up the Social Web, it's probably good to compare the opening of the Web Web in the mid-1990s. At the time, most Americans who were "online" were subscribed to a proprietary network like AOL, Compuserve, Delphi or MSN. (I'm not sure how things were in the rest of the world... Similar? Worse?) Many of these services either walled their users from the Internet entirely, or made it a one-way interaction. AOLers could read stuff from the rest of the Web, for example, but others couldn't see what AOL folks were doing. That system looked impenetrable; after all, AOL was paying millions of dollars to make great content and manage forums and the like, and why would they give that away to Internet leeches for free? But eventually it came apart because the Web became more interesting than the on-line services. (I personally think the watershed was the Ate my balls meme, but others might differ. I just kind of picture hundreds of thousands of AOLers calling up technical support asking to see the Mr. T pictures, and that's what finally broke things down.) Today, on-line service "walled gardens" are a negligible part of the on-line world -- those that still exist are more or less big ISPs. I think that the parallel with the Social Web is probably pretty apt. Today, Google, Facebook and Digg are reluctant to open up their identity silos to a distributed social Web. Their main asset today is their collection of identities and the relationships between them -- why give away the crown jewels? My guess is that it's not going to be until a mature, standardized and distributed Social Web exists outside the walls of the big social-networking players that we'll see them really willing to sit down at the table and come to the party. Of course, by that time, it'll be a moot point. But that just means there's a nice big fat market for somebody smart to take advantage of. tags:

7 December 2007

Benjamin Mako Hill: New Antifeatures Article and FSF Members' Bulletin

The FSF's fall members bulletin is out. For it, I spent some time refining the blogpost I recently wrote on antifeatures into an article. I got a whole lot of feedback last time (Thanks!), most of which criticized my choice of examples. I've structured this version around different, and I hope less controversial, examples. Please read the new article and leave comments here, especially if you criticized the old one. The bulletin also includes two pieces introducing a campaign against software patents that the FSF plans to launch early next year and a discussion of the AGPL by Brett Smith. This bulletin hints at what I think are the big issues that the FSF plans to take on next year: software patents, web services, and creative new takes on the free software message that are designed to resonant beyond our historically very technical community of hackers. I'll write more on this in the next week or so. To support this mission, and to receive future copies of the bulletin directly, please consider becoming an associate member today during the FSF's year-end members drive.

Jan Wagner: Package updates and others

Since some weeks I’m really busy, private and at work. It’s going into the end of the year and everybody is in hurry. There seems also coming some changes for our family down the road in the future, but more maybe later. Additionally one months ago Santiago Ruano Rinc n did surprisingly turn up as my AM. We started fast, but I got stuck at P&P part 1 with the License comparisons, cause actually I’m so busy at work and with my family, that I can’t concentrate enough late at night, when trying to work on the papers. For example the graphviz license is completely overwhelming me. My hope in the last time was some bigger timeslots at the weekends, but they got smashed by my family and/or work issues. I hope Santiago is not getting annoyed by me and I can find hopefully some free time on holidays or in the first weeks next year. Anyways … Christian Perrier started a review and translation process of ipplans debconf templates by the debian-i18n contributors. The templates was in really bad conditions, most of it was copied over from gallery2 and I did know that they wasn’t so good. Thanks for all your work, when the process is over I’m proud to include your really nice work. Two other packages got updates. php-suhosin got new upstream release after months which fixes the broken perdir/.htaccess support. Unfortunatly I missed the release (cause there is no announcement list and there was no watch file) unless Raphael Geissert did leave a note. I integrated the new VCS and homepage stuff also and formorer did fix some minor issues. So we can hopefully upload now (when it arrives testing) the first package to backport.org and sleep little bit better, when using PHP on stable.
nagios-plugins also got updated. Since Seanius seems really busy (like allways), nobody did really took care of the package. In October it got two CVE which was solved via NMU by the testing-security team, also two new upstream releases where available. So I droped the obsolete patches, integrated new once, did make the new shiny lintian a bit more happy, some minor fixes and queued the package to Seanius. ;)
You can expect both packages on backport.org soon. My other (comaintained) packages will get updated to latest policy and VCS/homepage guidelines in the near future. Actually I’ve to prioritize what to do with the left time slots. :/

Next.

Previous.