Search Results: "xam"

14 November 2007

Michal Čihař: Real address in bug tracker makes sense!

Today, when walking through some Wammu/Gammu bugs, I came to conclusion that the spam changed some people to behave insane. The email field in bug tracker is there to allow developer to contact you, for example when he makes a fix for issue you reported and wants you to test it. Entering addresses as ones at TrashMail which will vanish soon (the bug I'm talking about is two days old, what I feel is good enough reaction time from my side), will not help anybody. Thank you firebird76 (whatever your real name is) for realizing how people are stupid. PS: I use Mantis bug tracker, which I believe does not expose email addresses to anyone besides privileged users.

13 November 2007

Russell Coker: More About Living in Hotels

In the past I have spent about 18 months living in hotels with a couple of months of breaks in between. I have previously written about it in terms of living in London hotels [1], but I have been asked for more generic advice. Firstly the amount of possessions that you may have when living in hotels is seriously limited. For ease of travel you want to restrict yourself to one suitcase for checked luggage and one for carry-on luggage. Hotels often have short-term storage space for possessions of guests, so having a second suitcase of items that are not worth stealing (clothes and books) may be an option. But consumer electronics devices other than a single laptop computer are not an option. I read an interesting blog post on ZenHabits.net titled Minimalist Fun: The 100 Things Challenge [2] which advocates counting and limiting the number of possessions you own. When living in hotels if I considered my books as one collection and my clothes as another (having never been interested in trendy clothes they count as utilitarian items for work or leisure not objects that I seek to own) and as my mobile phone was a tool for work and my computer gear was strictly limited to items that were needed for work (and thus “tools”) my only possessions were a digital camera and some bottles of liquor! The lack of ability to accumulate possessions may be considered as an advantage or a disadvantage depending on what your aims are. If you are moving to another country for work there are three ways of doing it. The easiest is to be a permanent employee of a company that assigns you to work there - in which case they will probably pay to transport your stuff when you buy or rent a house. If you are a looking for new employment (either contract or permanent) in another country then you can either find the work before moving or after arriving there. Finding work before arriving in the country is difficult and generally only works for short-term contracts. So it’s most likely that you will either be looking for work immediately after arriving or after a short contract. In either case having better mobility increases your employment options - why restrict yourself to one city or region when you can choose from all jobs in an entire country or (in the case of the EU) half of a continent! The career benefits of being able to accept any job anywhere in the world at short notice are significant! There are situations where an employer will pay hotel bills. One example was when I was working for a London based company and they assigned us to work at the other side of London. My colleagues complained and the company paid for hotel bills for everyone Sunday night to Thursday night inclusive as well as an extra hour of pay per day as compensation for the inconvenience. For me of course one hotel was as good as another so it just meant that my employer was covering 5/7 of my living expenses. Then I had a meeting with the hotel manager and pointed out that having me check out every Friday would be bad for them as the hotel was mostly empty on the weekend and suggested that they make me a deal for the other two days - I ended up paying something like one night of hotel fees per week! If I had rented an apartment I would have still been paying the full rent (which while less than 30 days hotel fees per month would have been considerably more than 4 or 5 days of hotel fees per month). If you live in a hotel then there is always some sort of deal that can be arranged. Apart from certain busy days (such as around the Christmas and new-year time) they always want long-term guests and will be willing to reduce the price, give free dinner or drinks from the bar, etc. The cost of living in a hotel at times such as Christmas may be as much as five times the regular rate. That is a further incentive to visit friends or relatives at Christmas. If you can’t visit your family (which may be difficult if they live on the other side of the world) then finding a friend who has a spare room might be an option.

Steve Kemp: I love this hive employee

Russell Coker wants something to save and restore file permissions en masse. That exists already:
apt-get install acl
Once installed you can dump the filesystem permissions of, for example, /etc/ recursively with this:
 getfacl -R  /etc > orig.perms
Want to see what is different? First change something:
steve@steve:~$ sudo chmod 0 /etc/motd
Now see what would be restored:
setfacl --test -R --restore=./orig.perms /etc   grep -v "\*,\*"
etc/motd : u::rw-,g::r--,o::r--,*
Finally lets make it do the restoration:
steve:/# setfacl -R --restore=./orig.perms /etc
Job done.

Adrian von Bidder: Layer Cake

Recently spent three days playing poker, watching movies and drinking beer (we call that military service in Switzerland.) Layer Cake: Fun, somewhere in the vicinity of Betelgeuse^W Pulp Fiction or Lock, Stock and Two Smoking Barrels (Hmm. Why am I not surprised that Matthew Vaughn was also involved in the latter? I need to pay more attention to the names of directors and producers.) Also watched Meaning of Life one more time, no comment needed, I guess. Started watching Man on Fire (2004, by Tony Scott) but went to bed before the action really started, so I can't comment on it. Discussed modern (fast-paced, nervous etc.) moviemaking which reminded me that I should mention (Russian Ark) as a counter-example: the whole movie is one single 90 min long steadicam shot.

Russell Coker: Restorecon Equivalent for Unix Permissions

SE Linux has a utility named restorecon to set (or reset) the security context. This is useful for many reasons, corrupted filesystems, users removing files or changing the context in inappropriate ways, and for re-creating files from tar files or backup programs that don’t restore SE Linux contexts. It can also be used to report the files that have different contexts to that which would be set by restorecon to verify the contexts of files. Restorecon determines the context from two sources of data, one is the policy that came with the system (including any policy modules from other sources which were loaded) and the other is the local file contexts that were created by semanage. It’s a pity that there doesn’t seem to be an equivalent program for Unix permissions. rpm has a -V option to verify the files from a package and dpkg doesn’t seem to have an option to perform a similar operation (/var/lib/dpkg/info/* doesn’t seem to have the necessary data). But even on an RPM based system this isn’t possible because there is no way to add local files into the list. I would like to be able to specify that an RPM system should have root:root as the owner and permission mode 0755 for all files matching /usr/local/bin/* and use a single command to check the RPM database as well as this extra data for the permissions of all files. Does anyone know of any work in this area? I’m going to file Debian and Fedora bug reports about this, but I would appreciate any comments first. Update: Here is an example of how this feature works in rpm:
# rpm -Vv nash
…….. /sbin/nash
…….. d /usr/share/man/man8/nash.8.gz
# chmod 700 /sbin/nash
# rpm -Vv nash
.M…… /sbin/nash
…….. d /usr/share/man/man8/nash.8.gz The “M” character indicates that the permission mode of the file does not match the RPM. There is no way to automatically correct it (AFAIK) but at least we know that something changed. With Debian AFAIK it’s only possible to verify file checksums not the permission.

10 November 2007

Russell Coker: Optimising Swap Performance

I recently wrote some suggestions about appropriate swap space sizes [1], the main point being that the advice to use 2* RAM size never really applied to Linux and a system that actually has swap space equivalent to 2* RAM in use will usually be too slow to use (and you are better off having the kernel OOM handler kill some processes). There were a number of responses to that post, Ingo suggested that significantly larger amounts of swap can be used for compiling [2]. I have had similar experiences when compiling KDE long ago on a machine with 96M of RAM. Even in 1999 96M was not a lot of memory for a machine running KDE, and when compiling MICO (the CORBA system) a single G++ process could use more than 96M of memory. Obviously a lot of swap was used, but performance didn’t seem too bad. I avoided touching the keyboard or mouse (so most of the X server was paged out) and allowed all memory to be used by the build process. It seems to me that the build process is not as intensive as other processes in terms of swap use because it is a chain of processes that call each other. You may have several instances of make running (launching a new instance for each directory as you descend the build tree is common) and then a gcc process that launches some child processes. But unless you use the -j option to make at most times during the build there is only one process with any serious work to do. So the parent processes can be entirely paged out to make room for the process that is doing the work. A counter example is a shell server that has many interactive users, on such a machine if it runs slow then the users start opening more sessions so that they can perform other operations while waiting for a slow command to complete, opening more sessions uses more memory and makes the problem worse. Ingo notes that he uses several hard drives to give good performance. The priority of swap spaces is listed in /proc/swaps and can be set by pri=N in the options field in /etc/fstab. If you have multiple hard disks then the performance of swapping on a system that is being used intensively for multi-tasking will increase significantly at a rate that would hopefully be close to linear scaling with the number of disks. If a system only has one active process that is being paged (which might be reasonably common as part of a build process) then the performance benefits for reading will be significantly reduced.

Ondřej Čertík: Downloading images from Nokia N70 over bluetooth in GNOME

is actually very easy. I connect the bluetooth dongle to the USB port on my laptop and:


$ wajig install gnome-bluetooth
$ gnome-obex-server
conn_request: bdaddr 00:19:79:86:EB:BC
conn_complete: status 0x00
** Message: Incoming connection from 00:19:79:86:EB:BC
** Message: Device 00:19:79:86:EB:BC is about to send an object.
** Message: File arrived from 00:19:79:86:EB:BC
** Message: Filename '09112007196.jpg' Length 297132
** Message: Saving to '/home/ondra/Desktop/Downloads/09112007196.jpg'
** Message: Incoming connection from 00:19:79:86:EB:BC
conn_request: bdaddr 00:19:79:86:EB:BC
conn_complete: status 0x00
** Message: Incoming connection from 00:19:79:86:EB:BC
** Message: Device 00:19:79:86:EB:BC is about to send an object.
** Message: File arrived from 00:19:79:86:EB:BC
** Message: Filename '10112007197.jpg' Length 289214
** Message: Saving to '/home/ondra/Desktop/Downloads/10112007197.jpg'
** Message: Incoming connection from 00:19:79:86:EB:BC
conn_request: bdaddr 00:19:79:86:EB:BC
conn_complete: status 0x00
** Message: Incoming connection from 00:19:79:86:EB:BC
** Message: Device 00:19:79:86:EB:BC is about to send an object.
** Message: File arrived from 00:19:79:86:EB:BC
** Message: Filename '10112007198.jpg' Length 287449
** Message: Saving to '/home/ondra/Desktop/Downloads/10112007198.jpg'
** Message: Incoming connection from 00:19:79:86:EB:BC


And then I just click on the image on my phone and say "send over bluetooth", it finds my computer, I say yes, and that's it. It ends up in my Downloads folder on the desktop.

Then I just upload the images to my blog, see an example how it looks like.

Raphael Geissert: My future: only 14 hours away

Finally, the first university admission test is tomorrow, or in numbers: in 14 hours.

So, here I am, sitting in front of my computer thinking about tomorrow.
It's exciting to think about it: in 14 hours I'll do an exam which could change the rest of my life! :).

I'll do my best and hope to get the best from it :D

8 November 2007

Miriam Ruiz: C and multithreading

Reading mig21’s weblog, in which I often find really interesting stuff, I found Ian Lance Taylor’s article “Single Threaded Memory Model“, which kind of bothers me a bit. It reports a recent discussion on the gcc and LKML mailing lists about how C compilers, gcc in this case, optimize for single threaded code, sometimes leading to counter-intuitive results which won’t work properly in multi-threaded software (leading, for example, to race conditions). The interesting part is that the C language standard, which in general describes a single threaded model, apparently says nothing about when values have to be written to memory. Thus, this kind of optimization seem to be perfectly valid. Linus Torvalds complains about gcc developers taking more care about “what the spec says” than about real problems, but the fact is that if those kind of optimizations are valid according to the specs, there’s no guarantee at all that it won’t happen with whatever C compiler you might be using. To prevent this kind of behaviour in standard C, according to Ian, the variable needs to be marked as volatile, or it needs to use an explicit memory barrier. The moral in this case is that multithreading might not be as easy as it seems and should be handled with caution.

Martín Ferrari: I (heart) pkg-perl

After DebConf7, I started to work with the Debian Perl Group, which I think is an example of how good a packaging group can work. We maintain currently 400+ packages, with a log bug-count (0.11 active bugs per source package says asdfasdf, and it's not like we are a lot of people there. To be honest, I haven't been too active on the packaging front, but I spent countless hours on tweaking and modifying what I think it's the most important tool for the group success: a script that generates a webpage where you can instantly see the status of every package in the SVN repository. The great thing about this is that it gives you a visual idea of the status of everything in a moment: which packages have bugs, which one are ready to be uploaded, and —since we keep all watchfiles updated— also which have a new upstream version. Being a group with many non-DDs, it's great that there's no need for maintaining a list of to-be-sponsored packages; we just mark the package as ready to go, and when somebody can do it, reviews and uploads the package. I can hear the cries of people who think that sponsored packages are the incarnation of the devil, but our bugcount backs me :-). I tell you all of this because, first of all, I'm really glad to be part of a healty group of great people, and secondly, because we are finishing a completely new version of the tool, which was thought from the beggining to be used by other groups. In fact, a lot of debugging has been done by checking that it could process correctly other groups' data (it only works with SVN by now, but that's easily fixable as the code is pretty modular). You can see the (static) pages I've done while testing, showing the packages from the Collab-maint, Games, Java, KDE and Python-modules teams/groups. If you find a bug, I'd love to hear about it. So, if you're interested, grab the sources from the repository, and drop in #debian-perl@OFTC if you need help. Tags: Planet Debian, Debian

7 November 2007

Benjamin Mako Hill: Revealing Errors

Groups that campaign for free technology, like the Free Software Foundation and the Electronic Frontier Foundation, tend to be supported primarily by technologists. Both groups have struggled to communicate their messages to non-geeks. I have written an article and helped create a new weblog, both called Revealing Errors, that attempt to address a root cause of this issue in what I hope is both an insightful and entertainingly manner. Geeks support groups like the FSF and EFF because, as people who understand technology, they understand just how powerful technology is. Geeks know that control of our communication technologies is control over what we can say, who we can say it to, and how and when we can say it. In an increasingly technologically mediated age, control over technology is not only the power to control our actions; it is the power to limit our possible actions. Our freedom to our technology is our freedom, full stop. This message fails to resonate with non-geeks but it does not fail because non-geeks are happy to hand over their freedom. It fails to resonate simply because the vast majority of people do not understand that technology, and control over it, is powerful enough to impact their freedom. Most people fail to see the power because, quite simply, most people fail to see technology. While we all see the effects of technologies, the technologies themselves are frequently hidden. We see emails but not mail transport agents. We see text messages but not the mobile phone network. Before one can argue that such systems must be free, one must reveal their existence. Technologists are keenly aware of the existence of these systems. To everyone else, they are completely invisible. Marc Weisner of Xerox PARC cited eyeglasses as an ideal technology because, with spectacles, "you look at the world, not the eyeglasses." When technology works smoothly, its nature and effects are invisible. But technologies do not always work smoothly. A tiny fracture or a smudge on a lens renders glasses quite visible to the wearer indeed. Similarly, people see their MTAs when messages bounce. They see Windows on their ATM or phone when the system crashes. Technological errors are moments when usually invisible technology becomes visible. They are, in this sense, also an educational opportunity. /copyrighteous/images/blue_screen.jpg I have recently published an article in Media/Culture Journal from the University of Melbourne within a special issue called Error. If you are interested in learning more about what I'm trying to do or looking at some examples, please read the article. With support and ontributions from Aaron Swartz, I have also created a new weblog, Revealing Errors, that reveals errors that reveal technology by posting descriptions of errors with commentary on what the error reveals. I've posted a few examples there already and I will be updating it regularly. The goal is to help explain the power and influence of technology in the service of broadening the base of people who can get excited about freedom to technology. Eventually, I hope to be able to communicate this message to a less technical audience. With that said, I hope that even seasoned technologists will learn things about their technological environment through the analysis and interaction. I hope readers of this blog will subscribe to it and, if possible, comment on and contribute to the project as it moves forward.

Bernd Zeimetz: python-application

python-application … is what I'm in love with since a few days. Although I had no real use for it when I packaged it, I'm more than happy to have it now. It comes with the following features: Have a look at the examples in /usr/share/doc/python-application/examples to see how simple common things become if you use python-application for them, or just read trough the code, it's well commented and easy to understand.

6 November 2007

Enrico Zini: axi-searchasyoutype

apt-xapian-index: search as you type I've recently posted: Note that I've rewritten all the old posts to only show the main code snippets: if you were put off by the large lumps of code, you may want to give it another go. Today I'll show how to implement a very attractive feature for a user interface: search as you type. The idea is that you don't need to press enter to fire up a query: instead, the results materialise in front of your eyes as you type them. The example I created uses curses, but the idea is good on any interactive user interface. The main thing to keep in mind with search as you type is that the last word is likely to be partially typed, unless maybe some timeout expired since the user's last keystroke. Xapian comes into help here, as it allows us to expand the partially typed word into an OR query with all the terms that start with it. This means that if we are typing, for example, "progr", we can turn the query into "program OR programmer OR programming OR programmed [...and so on...]". I won't show the UI code, except a simple input loop that triggers the query at every keystroke:
    def mainloop(self):
        while True:
            c = self.win.getch()
            self.line += chr(c)
            self.results.update(self.line)
The interesting part is in the update function. First we split the line in words and convert the words into a query:
        # Split the line in words
        args = self.splitline.split(line)
        # Convert the words into terms for the query
        terms = termsForSimpleQuery(args)
Then we expand the last word with all possible completions:
        # Since the last word can be partially typed, we add all words that
        # begin with the last one.
        terms.extend([x.term for x in db.allterms(args[-1])])
Now we can build the query. Of course you can add all other sorts of things to the query, for example a boolean expression of tag filter like in axi-query-pkgtype.py; Xapian will cope.
        # Build the query
        query = xapian.Query(xapian.Query.OP_OR, terms)
Finally the query. For bonus points you can do the adaptive cutoff trick to discard bad results. In my case, since I don't implement scrolling of results, I also limit them to what fits in the window:
        # Retrieve as many results as we can show
        mset = enquire.get_mset(0, self.size - 1)
Finally, draw the results on screen:
        # Redraw the window
        self.win.clear()
        # Header
        self.win.addstr(0, 0, "%i results found." % mset.get_matches_estimated(), curses.A_BOLD)
        # Results
        for y, m in enumerate(mset):
            # /var/lib/apt-xapian-index/README tells us that the Xapian document data
            # is the package name.
            name = m[xapian.MSET_DOCUMENT].get_data()
            # Get the package record out of the Apt cache, so we can retrieve the short
            # description
            pkg = cache[name]
            # Print the match, together with the short description
            self.win.addstr(y+1, 0, "%i%% %s - %s" % (m[xapian.MSET_PERCENT], name, pkg.summary))
        self.win.refresh()
That's it, try it out. You can use the wsvn interface to get to the full source code and the module it uses. You can see a similar technique working in goplay, where it is also integrated with an interactive tag filter.

Christian Perrier: RWC: South Africa-England

After Argentina-France on the first day, that one was planned to be one of the few big matches of first round. Of course, after the game won by South Africa (36-0), that seems pretty silly to say... The Springboks were definitely better than England, in all parts of the game. What stunned me, particularly after watching South Africa live , is their complete control on the game, which is a great improvement over their match against Samoa. South Africa scored three tries all of them great examples or organized attacks by the rear lines. Two tries for JP Pietersen, after 3 by Habana on first game: the South-African wing players rock. Despite this, the player of the game was definitely Jason Du Preez, the scrum half (hope this is the correct term in English) who organised all attacks from RSA. England was missing too many key players (several injured) to be able to be a menace for South Africa. They never were really dangerous, except maybe when the magic Jason Robinson has the ball in his hands (what a player!). I was particularly disappointed by their center back players, and even more particularly by Farrel. Ditto for Andy Gomarsall as scrum half. So, South Africa is now probably qualified with two quite easy games against USA and Tonga. England will have to fight to qualify and noone can tell if Samoa or Tonga can surprise them. Watching Samoa-Tonga on Sunday will be interesting and Samoa-England or Tonga-England are already key matches. A great rugby week-end is about to begin, again. Today, Wales-Australia is the match of the day, for sure, with wales playing home (some matches are not in France, but in Cardiff and Edinburgh). New Zealand-Portugal will be...interesting, though the only incertainty is the number of scored tries. And finally, Ireland-Georgia is of some interest for the French. Tomorrow, France could have hard times against Namibia. Of course, the challenge here is winning *and* scoring the bonus point. That match is 5 days before a key France-Ireland, so the challenge is also not wasting too much energy. Of course, tomorrow's top match for me is Samoa-Tonga while I whileprobably skip Fidji-Canada (too bad, I haven't seen those playing yet). BTW, if someone has a recording of the most intense match as of now (Japan-Fidji), I'd be delighted. Rugbystiquement v tre,

Christian Perrier: DADVSI critical day

Today is the day where the very controversial DADVSI bill will be examined by the French Parliament. DADVSI stands for "Droit d'Auteur et les Droits Voisins dans la Soci t de l'Information" which can be roughly translated to "Author Rights and Related Rights in the Information Society". This very controversial bill includes some very ambiguous parts about software "that could be used to illegally exchange data over the Internet". The text is so vague that it can even interpreted as possibly allowing to forbig software authors to publish their sources....which explains why the French Free Software community reacted so strongly. This text is promoted by the major entertainment companies (Vivendi Universal and the like...). Some even said to representatives of the Free Software communities: "we will foirbid you to publish your sources". I'm feeling they're failing, though. The very active lobbying promoted by the EUCD.INFO initiative has already reached one goal: the bill will not be examined confidentially. For instance, I'm currently watching the LCI TV channel, one of the major news channels among satellite/cable/Internet channels in France and this problem is now in their major headlines. You're screwed, pals. Bottom line note: in France, laws are proposed by the government and must be examined, then voted, by the Parliament. The Parliament may "amend" a law (ie propose changes) which sometimes means completely changing it. We now have a great hope that this will happen as many of our representatives ("d put s"), including some from the current majority (right wing) and most of the left wing representatives, have expressed very strong reserves. Additionnal side note: at this moment, there are no less than 200 amendments proposed to this bill...:-)

Russell Coker: Squid and SE Linux

Is Squid not returning some data you need on a SE Linux system? The default configuration of the SE Linux policy for Squid only allows it to connect to a small number of ports which are used for web servers. For example ports http (80) and https (443) are labelled as http_port_t which permits serves such as Apache to bind to them and Squid to connect to them. But sometimes services run on non-standard ports and periodically new services are devised which use the HTTP protocol and thus you have Squid and Apache using new ports. semanage port -a -t http_port_t -p tcp 11371 One example of such a port is hkp (11371) - the latest protocol for sending and receiving GPG/OpenPGP keys. Running the above command relabelled the TCP port 11371 in question as http_port_t and thus allowed everything to work. setsebool -P squid_connect_any 1
An alternate option would be to run the above command to allow Squid to connect to any port. I will suggest that the upstream policy be changed to make the default labelling of TCP port 11371 be http_port_t, but the same operations can be used for other ports. Some people may claim that this makes things difficult for sys-admins. But the fact is that a well known port is a significant resource that you don’t want to permit any random user to access. Not only do the SE Linux port access controls prevent malice, but they also prevent system programs from accidentally using the wrong ports. A common example of accidental mis-use is the port 631 used for the IPP (Internet Printing Protocol - CUPS). When system programs need to use TCP source ports below 1024 they start at 1023 and work their way down, having such programs get down to 631 is not uncommon (there are some error conditions which result in ports being reserved for some minutes after use). In terms of malicious operations, it seems that the ports used by database servers such as MySQL and PostgreSQL would ideally be inaccessible to a Squid proxy, and services such as network backup should be inaccessible to everything other than the backup software.

5 November 2007

Uwe Hermann: Recent LinuxBIOS progress

LinuxBIOS ROM Chip Logo Since the "World's First Motherboard Using LinuxBIOS Released" hype at the beginning of this year (which was incorrect btw; it was not the first supported desktop board, there were many others before), LinuxBIOS hasn't been in the news very much. That doesn't mean that there was no progress, however. We've been working hard behind the scenes to improve the LinuxBIOS code, add support for new chipsets and boards, and advance the upcoming next-generation LinuxBIOSv3 version which will brings lots of great improvements in various areas. Here's a random collection of stuff that happened in the last few months. New chipsets: New mainboards: Note that not all of these may be 100% supported, some may still be work in progress with some TODO items left... Check the LinuxBIOS wiki or ask on the mailing list for details. The future Most work will probably go into LinuxBIOSv3 in the future, in order to make it suitable for productive use.
Of course, work on new chipsets and boards will continue, too. For example the VIA CN700 chipset (plus Jetway J7F2WE board using it) is being worked on right now, probably also several others I don't know about. Call for board testers If you're interesting in trying out LinuxBIOS, please check the list of supported motherboards. If your board is not listed there, but the chipset is already supported we can probably add support for your board relatively easy with some testing help from you. Please contact us on IRC or preferrably on the mailing list if you want to help get your board supported! An (incomplete) list of good candidate boards for future support is available in the wiki. Thanks! We're very grateful for the many contributors who have helped us with testing and fixing existing code, or who even contributed code for new chipsets and motherboards. Thanks a lot! Many thanks especially to all hardware vendors who have been supporting us or even actively contributed by submitting code for their chipsets or boards (recently or in the past), including AMD, SiS, VIA, MSI, Tyan, Artec Group, and many others. Your efforts are very appreciated. Thanks!

4 November 2007

Steve Kemp: When the day is through

The webpages for the Debian Security Audit Project have been outdated for quite some time. Specifically because they contained two static pages comprised of large lists which were annoying to update: Last week, with the help of Rhonda, and a couple of other people, I removed the static lists and replaced them with simple data files, and a perl script to convert those data files into HTML content. Now the advisories which have been released are ordered by date, and broken down into years. For example 2002, 2003, & etc. We also have a list of all the people who've been credited with at least one advisory. There are some outstanding advisories still to be included, but otherwise I'm much happier with the process (and feel only guilt at the breakage of the translations). There isn't much actual auditing happening at the moment, with only four advisories released in 2007 compared to many more at the peak. But I guess that is a separate problem, and one that I can do less about - short of finding more time to look at source code.

Marc 'Zugschlus' Haber: exim4 vs. OpenSSL vs. GnuTLS

Judging from the long list of exim4 bugs, especially #446036, I find myself between a rock and a hard place, and having to choose between staying with GnuTLS and accepting a probably continuing flow of technical issues, or moving over to OpenSSL, setting an example against GNU software, and probably generating a new flow of license issues. GnuTLS is the “clearer” solution from a license point of view: The client library is LGPL, and it can thus be safely linked to everything that is part of Debian main. This is the main reason why we decided to use GnuTLS for exim4 years ago, so that we do not need to worry about licensing issues when some other library is linked to by exim some time in the future. On the other hand, my impression gets stronger and stronger that GnuTLS is not ready for prime-time. There is a truckload of interoperability problems with a number of “remote sides”. The most prominent issues are TLS aborts when exim4 is SMTP server for some clients, most notably Incredimail and some mobile Phones from Nokia and other vendors. Most of them can be nailed down to misnegotiation of certain ciphers, but exim does currently not allow disabling of some ciphers at run-time, and - even worse - one would need to disable them completely since one cannot judge in advance whether we are facing a client with issues or one without. The GnuTLS maintainers of both Debian and upstream try being helpful, but I do not see a long-term solution here. Additionally, nobody upstream knows its way around the GnuTLS related code in exim, which was contributed by Nikos Mavroyanopoulos years ago. So, there is little chance to get GnuTLS-related bugs ironed out from exim. OpenSSL, on the other hand, does not have these interoperability issues. At least, I haven’t heard of any, and the recommended fix for the reporters of GnuTLS related bugs, “recompile exim with OpenSSL” (which the packaging has been supporting for nearly two years now), usually fixes their problems. I am not in a position to judge whether this is caused by people actually testing against OpenSSL, or OpenSSL generally being more tolerant towards strange implementations, or GnuTLS being buggy or poorly written. However, building exim4 again OpenSSL may post the license issues that convinced us to use GnuTLS in the first place. Exim itself has an OpenSSL exception, and from what I have been told, the MySQL FLOSS License Exception allows linkage to OpenSSL as well. At least, it does now, since historical evidence in the exim4 package either shows that it used to be a license violation to link MySQL and OpenSSL in the past, or that we (the Debian exim4 team) wrongly thought so. On the other hand, if it is illegal to have OpenSSL and “really” GPLled code in the same execution space, we already have that license violation today, brought to us by PostgreSQL, which links against OpenSSL. ftpmaster has already indicated that they won’t consider an exim4 linked against OpenSSL a license violation and that the packages would go through, the packaging can handle the change by virtue of flipping a switch and rebuilding, but I am still not fully convinced that doing so is the right thing from a political and license point of view. I might still need that final nudge by feedback to this blog article, or have my reluctance fed. Please comment. No, I do not plan to take this to debian-legal; I’d prefer exim4 staying in Debian main.

Daniel Burrows: Lessig at the University of Washington

On Friday 2007-11-02, I watched Larry Lessig give a presentation at the University of Washington entitled Is Google (2008) Microsoft (1998)? Since it was Lessig, the talk was articulate and thought-provoking, and he used his slides very well (unlike many presenters who just read bullet points).

The argument he made is that Google is like Microsoft in some ways (and so are other companies like Facebook). In his analysis, the problem with Microsoft was that so many companies made themselves Microsoft-dependent, which both forced other companies to follow suit (due to network effects) and gave Microsoft leverage they could use against everyone in their ecosystem (e.g., Netscape). According to Lessig, Microsoft was not evil to use this leverage, but you have to recognize that Microsoft will do what is best for Microsoft, and this may not be what is best for you. He then suggested that we should be aware of the potential for the same thing to happen; in support of this point, he quoted excerpts from the terms of service from the APIs of Google and Facebook, which contain typical statements like we reserve the right to terminate your use of this service for any reason or for no reason, and asked: What if Microsoft had written this license agreement?

But it seemed to me that this wasn't his main point. He was using this observation as a springboard to talk about issues revolving around competition and public policy. Specifically, he feels that we should work towards a more just model of interaction between companies and users whose work makes the company more valuable (by contributing to a software ecosystem, by posting content on the Web site, etc). But the correct way to do this (he says) is not via competition, after-the-fact litigation, or voluntary codes of conduct: competition may not be around to enforce good behavior (as we've seen with Microsoft), litigation may be too late and ineffective (again, see Microsoft), and voluntary codes of conduct will disappear as soon as they get in the way of the bottom line. The correct approach, he argued, is across-the-board regulation so that all the companies have to play by the same rules.

From there he went on to talk about governmental corruption. He said (quoting Robert Reich's book Supercapitalism) that the reason we consistently look for solutions in the market and in voluntary compliance is that our governmental system is broken and does not effectively regulate corporations in the public interest. But Lessig is optimistic that we can change things (he joked that his publisher was unhappy with this point of view, because his brand has been built on pessimism). In his view, the politicians in Washington, by and large, want to be honest and do good, but they aren't able to within the current political system. For instance, on the few occassions that he managed to get access to lawmakers to discuss copyright issues, it was often the first time they had heard that there was more than one side to the argument. He thinks we need a national political movement that will shame politicians into being less corrupt.

This is all a simplification of what he said, of course; unfortunately, I wasn't able to find a recording of this talk on Lessig's Web site, or I'd point you at primary source material. I don't know if this is because he chose not to post it, or because it just hasn't been made available yet.

My view

In general, I thought that the speech was very interesting and well thought out. But as much as I'd like to buy into his optimism that we can fix our system, I don't think it's well-founded, for two reasons.

First, he argued that competition will resolve some of these problems (that was before and after he said we can't rely on competition, which I found confusing and may indicate that I misunderstood something). His evidence for this seemed to be that when Microsoft was dominating the world, users responded by reducing their dependence on Microsoft products and by switching to alternatives such as Linux. But, in fact, although more people may be using Linux than in the past, virtually everyone is still only using Windows, it's still almost impossible to find a programming job that isn't Windows-only, and Microsoft is still raking in money hand over fist; indeed, they're doing so well that they're planning to expand their workforce by a third. To take just one data point of many: I ride the bus to Seattle and back, and I regularly see other people using laptops as they commute. Virtually all the laptops run Windows. Occasionally I'll see a Mac, and every few months I'll see a guy running Linux on his laptop; I say "a guy" because it's the same guy every single time. So by my estimation, use of Linux on laptops in buses on the 545 route from Redmond to Seattle is way below 1%, with Macintoshes somewhere around 5%.

To broaden my point, I think Lessig has fallen into a trap that highly intelligent people, particularly those in academia, tend to fall into. In academia, you are surrounded by people who value learning and thinking deeply about the world. These are people who will give serious and unbiased consideration to questions like what is the social effect of my acceptance of the Facebook Terms of Service? and If I become dependent on this service, will that possibly affect me in five years if the company decides to act against my interests? The problem with this is that these people are not representative of the population at large. The population at large thinks why is this check-box getting in the way of me sending pictures to my friends? And I have no doubt that any kid who, e.g., refuses to sign up for Facebook as a protest against their TOS will be roundly mocked in their social circles for being a weird antisocial nonconformist. (of course, this may not apply to the small minority of people like myself whose social circles consist of weird antisocial nonconformists)

Second, Lessig's optimism about the political system seemed to be based on his observation that the people in government are, by and large, not venally corrupt: they want to do good, but the system is constructed in a way that makes this impossible. To me, that's a tremendously disheartening statement. If our problem were simply a few, or even many, corrupt politicians, this would be a solvable problem: even nowadays, Americans have some ability to choose who gets elected, and I believe that a sufficiently well-coordinated campaign could replace bad politicians with good ones.

But if the problem is that the system is corrupt even when the individuals are honest, it's a much deeper problem and frankly one that I don't know how to solve. While individuals have some direct control over who gets elected, we have no way to directly change the system that produces the corruption; the levers to do this are in the hands of the politicians elected through that broken system. It's unlikely that the politicians themselves will fix the problem, because they've benefited deeply from it: if the system is left as it is, well over 90% of Congress members will keep
their jobs
in the next election cycle, and any effective change seems likely (by definition) to disrupt this cushy arrangement.

On the other hand, running new candidates for office will not fix the problem. After all, if the problem is that the system is corrupt even when the participants are honest, then putting more honest people into government will have no effect. In order to get elected, these new politicians will have to become just as corrupt as the old ones, because that's how the system is set up. So we might change the faces, but we'll have the same old problems.

I recall two specific concrete proposals that Lessig made to make the system more responsive. First, he suggested shaming politicians who engage in corrupt behavior -- presumably taking large donations from interested parties. I don't see how this will help. Americans generally have a very low regard for the political class as it is; will pointing out particular examples of politicians taking money really make a difference when it comes to votes? And if it doesn't, will it really produce any change in their behavior? Politicians are motivated by votes the same way corporations are motivated by money; unless they stand a chance of losing their job (which is virtually impossible in any event), there's no reason for them to change how they behave.

His second proposal was for a system of contributions where it's impossible for any individual to prove they had donated a particular amount of money to a particular candidate. Even assuming it could be implemented perfectly, I don't think this will really solve the problem, for two reasons. First, it's not generally a secret what moneyed interests want. Politicians who want to attract large donations can just take positions that they know will appeal to donors of that sort. The donors themselves can make this easier on the candidates by, e.g., posting public position statements on issues of the day. Secondly, and this is far more insidious, even if politicians honestly represent their positions, then because success in running for office is so tied to the amount of money the candidate can raise, only candidates who hold opinions favorable to large corporations and wealthy individuals will be able to get elected. In fact, for all I know this is what happens already!

But with all that said, it was a really interesting talk and Lessig tied together some things you might not think would go together. If a video or Flash presentation becomes available, I would recommend watching through it. And hopefully my pessimistic predictions will be wrong; it's certainly happened before.

Next.

Previous.