I've changed jobs recently and after 5 years of not having to work with a Windows system I am having all sorts of adaptation-to-Windows problems at the new job.

First I just had to have the usual X-mouse behaviour and so I installed True X-Mouse Gizmo for Windows. This provides focus under mouse, middle click paste after select (not perfect, but it works), right click to push to bottom the window.

Second I had to have a virtual desktop, so I installed Microsoft's Virtual Desktop Manager from the PowerToys page. I tried another virtual desktop manager before using MSVDM, but I found it too clumsy so I switched to MSVDM which I knew from way back when I used Windows the last time. Good, now I can have my applications organised the way I am used to.

UPDATE: I gave up on MSVDM in favour of Virtual Dimension since I wasn't able to send a particular window to the intended desktop unless I had in the taskbar all apps visible (Shared Desktop option). I might try other suggestions (Virtual Dimension does not have a way to send a window directly to a specific desktop, but just to the neighbours of the current one.)


Third, I had to make Caps Lock work as Ctrl. I just can't go back to an inferior setup. I found information on this page and ended up at this page from where I got a zip file with various registry keys which allow the deactivation of caps, or turning it into another Ctrl.

Fourth, I am used to write with diacritics in Romanian with the secondary layout of the standard (SR 13392:2004), so I rushed to Cristian Secar 's page for the keyboard driver since on XP the Romanian layout is retarded (some history in which some arbitrary German guy decided y and z had to be switched on Romanian keyboards and some other similarly weird stuff). Since the installation, my keyboard behaves according to this layout:




Things started to look well, but I soon was reminded that Outlook is an idiotic mailer since it doesn't require a confirmation on send, not even if you didn't set a subject. And this is problematic since sending the mail is done via Alt+S, so if the current layer is NOT Romanian, when I want to type (s with a comma below), a fairly common character in Romanian words, you end up looking like an idiot on the recipient side since they receive an incomplete mail. Remember, no confirmation AND no default spell checking before send. Yay!

At my second such accidental mail sending (of which the last two were sent to the same person), I decided to see if this can't be fixed. I initially looked for changing the short cut, but I couldn't find it (I might be inept at finding things in Windows, remember, I haven't touched Windows systems in the last 5 years) but I found another workaround and decided it's good enough to share with other people that might hit the problem.

Just setup a delay rule following these steps.
1. Go to Tools....Rules Wizard
2. Click 'New' Rule
3. Select "Check messages after sending"
4. Click Next on "Which conditions you want to Check?" dialog.
5. Press yes to "This Rule will be applied to every message" message box
6. In the "What do you want to do with message?" dialog, Select "Defer delivery by a number of minutes"
7. Select your favourite number of minutes.... I usually select 2 mins.
8. Select Finish. and close the Rules Wizard.

Now everytime you send an email it will sit in your outbox
for specified number of minutes. If you ever wanted to change it, delete it etc, You have sufficient time to do it :)

I used 3 minutes for the delay. At least now I can prevent looking retarded in front of people... more than necessary :D .


Oh, and Windows' clock display is retarded. It shows, by default, the hour and minutes, but there's no way to change that in a sane way. If you want the date, you must hover over the clock and it shows it, but the day of week is missing. Great job! You can see that information, too, but you have to drag the toolbar to be 2 or even 3 rows high (here it requires 2, but I've seen people saying they needed 3) to get that information, too. Great! One has to choose between wasting desktop real estate and having access to useful information. Or you could install an independent application for the clock... retarded. I am not making this shit up.

I hope this helped.

When coming back from DebConf9, I wrote this pledge:

As a package maintainer, I will do my best to help the Debian project release a stable version of our operating system. In particular, I will work together with the release team and I will keep all packages associated to my name free of release critical bugs. To this effect, if I m not registered as being busy or in vacation, I will start working on my release critical bugs as soon as possible (in less than 1 week in common cases). If I can t deal with them in a timely fashion, I will state it clearly in the associated bug reports, tag them help and invite other contributors either to provide a patch or to do a non-maintainer upload. If I do not manage to handle release critical bugs in the above described way, or if I almost never deal with any of my RC bugs by myself, I will:

• not refuse help and even propose co-maintenance to good contributors
• recognize my failure and actively try to find a new maintainer and/or co-maintainers
• not complain if the quality assurance team decides to orphan the package

I recognize that my work is not limited to unstable. I will also work with the stable release team and the security team to provide updated packages for the stable and/or testing distribution when some issues deserve it. I am aware of the limits of my skills and my available time and I will avoid packaging software that I would not be able to maintain properly.

It tries to sum up the minimal expectations that Debian should have towards the package maintainers. I tried first to get this pledge integrated into the NM/DM process but the discussion concluded that it would be best to document this in the developers-reference. There s already a chapter called Debian Developer s Duties where this can nicely fit. I submitted this as a wishlist request for the developers-reference soon after and it s still open. Now I went to the next step and prepared a patch that restructures the chapter about developer duties. See #548867 for details.

Follow me on Identi.ca, Twitter and Facebook. Or subscribe to this blog by RSS or by email.

4 comments Liked this article? Click here. My blog is Flattr-enabled.

In my previous post, I was pointing out some of my frustrations with Chromium/Chrome. A very kind reader, Timo Juhani Lindfors, gave me answers to many of the problems that I pointed out and got me straight on some issues:

• I can disable full zoom in Iceweasel (i.e., I only want to zoom the text, not the images). According to Chromium's project BTS, it seems that this will be a WONTFIX bug, despite many people asking for it (and it having a lot of duplicates).

Timo told me that there is an extension called "Font Size Increase" (ID: ombpcpigmndepfckcifdblemkabaoihk) that adds a button on the side of the URL bar that you can click to increase the size of the text, without affecting the size of the images. Highly recommended. Not that I need this one as much as "Font Size Increase", but there is also a "Font Size Decrease" (ID: mpajngnpcmjjeoflljdjpnehcfaldcia) that, as the name implies, decreases the size of the text. It is nice to have this one when you clicked on the button to increase the size of the font one or two times too many.

• In Iceweasel, I have a way (without resorting to many extensions or hackish solutions) to use the equivalent of Firefox's "View > Page Style > No Style" (i.e., to ignore any CSS sheet that the document author may have specified on the page).

Timo also told me that there is a very cool extension called "Chrome Page Style" (ID: ddpkgkegfklikkmfmneldonhldahhacb) that allows you to alternate between stylesheets provided by the page (see Joey Hess's ikiwiki's CSS Market for an example of that). It also has the possibility of disabling all the CSS'es that a page may have, which, in many cases around the web actually improves the readability of the pages, for many "fancy" things detract from readability, especially if you have poor eyesight. Although I had said that I didn't want to resort to extensions, this was a simple solution enough that made me consider revisit my requirements. I do, though, wonder why some frequently used extensions are not built into the programs from stock.

• In Iceweasel, I can press Ctrl+Q and make the damn browser quit, instead of me having to use the mouse/trackpad/pointing device. This is probably a lack of my understanding on how to associate key bindings to Chromium, but the problem still stands.

Of course, Timo also set me straight and told me about Ctrl+Shift+Q for that purpose, which I had missed completely.

• Similarly, when there is only one tab open, pressing Ctrl+W in Chromium does not close the tab (say, presenting me a blank tab or the list of most visited sites), nor it closes the application.

As a poor writing of my part, Ctrl+W does close the tabs. But when there is only one tab present, it doesn't close the window. I'm OK with that, since I now know the way to close the window. Thanks again Timo. Oh, and one point that may not be known by many is that using about:flags in Chrome does something analogue to Firefox's about:config (even with the warning). And tweaking with it you can try to see if you can enable hardware acceleration of some parts of your pages, as present in newer releases of Chromium. So, there I am: way more satisfied than with earlier with Chromium, but still having Firefox/Iceweasel as my primary browser. Good to have two usable browsers now.

Those who followed the live stream or read our News already knew it: Debian has been honored with the Linux New Media Award in the Categories "Best Open Source Server Distribution" and Outstanding Contribution to Open Source/Linux/Free Software. Especially the second one, considered to be the "kings class" of the LNM awards, is a great honour. While it is called the Linux New Media award, the decision of whom to honor with them isn't done by the company themselves, but by a bigger jury, consisting of over 300 representative community members, developers, journalists and companies. Deciding in a secret vote¹. To the best of my knowledge, there's nothing similar. So one can truly say, we weren't awarded by a company, but by the entire Free Software community! Congratulations to everyone involved! For our Outstanding Contribution to Open Source/Linux/Free Software award, we also had the special pleasure, to receive our presentation speech from Karsten Gerloff, president of the Free Software Foundation Europe, who found words, I can hardly explain myself. As it might take some time for the video of the award ceremony to be published and several people already asked for it, you'll find the text of the speech below. Still, you might want to watch the video for a special surprise by Karsten:

I'm here to congratulate the Debian project. Debian has recently taken a nearly unprecedented step, one that many people thought would never come to pass: The project has updated its website design. Today, Debian receives the Linux New Media Award for its outstanding contribution to Free Software. I could hardly think of a more fitting recipient for such an award. Debian is coming of age, literally. In August, the distribution will turn 18. Debian offers great technology. It's stable. Really stable. It's highly flexible, and performs well in lots of different roles. IT supports more different architectures than almost anything else out there. It runs on pretty much anything. The package management is great. It makes a highly complex system of almost 30,000 packages extremely simple to configure and use. Debian started out as a true pioneer. When the project was created in 1993, the whole concept of a distribution wasn't too well established. Ian Murdock announced the project thus:

"Debian Linux is a brand-new kind of Linux distribution. Rather than being developed by one isolated individual or group, as other distributions of Linux have been developed in the past, Debian is being developed openly in the spirit of Linux and GNU. [...] Debian is being carefully and conscientiously put together and will be maintained and supported with similar care." At a recent conference, the current Debian project lead, Stefano Zacchiroli, gave a talk titled Who the bloody hell cares about Debian? Turns out that many people do indeed. Debian is the GNU/Linux distribution that has the most derivatives based on it currently 128, if Distrowatch.com is to be believed: Ubuntu, Knoppix, gNewSense, and many more. And those distributions again have their own derivatives. None of these could function without Debian. Lots of people rely on Debian. That makes it all the more important that Debian is so reliable. The Debian project gives us Free Software that is both rock-solid and exciting. But the greatest thing about Debian is not the fact that it delivers great software. Other distributions do that, too. The big thing about Debian is the *idea* of Debian: The idea that a massive Free Software project can be totally independent. Debian shows how it's possible to build a highly reliable operating system without a formal body. The project has created some pretty complex structures to run itself, as a do-ocracy, based on consensus and running code. This is important. We are currently debating how Free Software projects can best be governed in the long run. How do we make sure that a project's users can always enjoy the freedom they deserve? How can we structure a project in a way that makes it immune to a hostile takeover? Oracle's acquisition of Sun has shown that these are important question. A Free Software license, preferably one like the GPL that protects freedom in the long run, is an important first step. But a Free Software project consists of much more than code. While uncounted people and companies are earning good money with Debian, the Debian project itself can't be bought simply because there is noone you could buy it from. Debian has been doing vendor independence long before it was cool. What I love most about Debian is that like few other big projects, Debian has the idea of freedom at its core. Debian's Free Software guidelines are a central manifesto for software freedom. The Debian Social Contract does not mention a single package or program. But it is without a doubt one of Debian's most important pieces of documentation. In Debian, quality is the focus of everyone's attention. But those who work on the Debian system know that great software is worth nothing without Freedom. With the release of Squeeze, the latest stable version, in February, Debian has taken the important step of offering a completely free kernel, with no binary blobs. This is a first for a major distribution in recent times. Debian is giving its users Freedom by default. And this Freedom for users and developers on a massive scale truly is Debian's outstanding contribution, not just to Free Software, but to the information society. On behalf of the Free Software Foundation Europe, I would like to thank everyone in Debian for their work, and congratulate them on this award. It's well deserved. Keep up the good work!

1: I forgot to mention one small, but important detail: The voting period for the jury ended on December 23, 2010, so long before Squeeze was released. So we can be quite sure, that the Jury didn't followed the Squeeze-Hype with their decision, but really thinks, we did something great :)

I recently acquired a Pixma MP 250 printer, and as I had some difficulties with setting it up, I wanted to share this here. The printer isn't supported as such by CUPS, so I had to dig a little bit. After quite some time, I found debian packages on the Canon website there. Don't fear the mention of i386, amd64 packages are included too. This link is likely to break when the software is upgraded, you should try your luck in the drivers search page should that happen (or for other models). After installing that, CUPS find the connected printer and proposes the PPD for it. The scanner works out of the box with xsane As a side note, Canon also provides source for the debian packages (the packaged was ITPed ages ago). However, there are some binary-only blobs and I didn't manage to get it to compile from source.

I ve had a very courteous email from one of the founders of ALLOW, following my analysis of their password reset procedure.

Thank you for your feedback regarding the security of our platform. We are constantly reviewing these processes and regard our members security as paramount, whilst ensuring our processes are navigable to the majority of the UK. We have had the platform professionally penetration tested but your email demonstrates an excellent understanding of the challenges and we would welcome your suggestions on our options of improving the password reset process. We will be extending our SSL certificate to the publicly accessible website and please be assured that this is held on a different architecture to that of the Member application.

This is very promising!

---

Response from ALLOW Ltd. is a post from: jwiltshire.org.uk Flattr

I've been promoted - my job title will now be 'Software Architect'. This seems to mean I'll be writing documents rather than code - any higher-level, and I'd need Mark Shuttleworth's spacesuit. Is this a good thing? Anyway, I celebrated by opening my last bottle of Debian wine. <spam>Unfortunately, I can't take up my new role until we have hired a replacement. UK-based developers who know Perl and ideally PostgreSQL might want to look at the job description, although I'd recommend sending your CV and covering letter to me directly. I don't get a referral bonus, it's just that I don't like what that agency does with your carefully-crafted application.</spam> I'd like to thank everyone who maintains LaTeX for their assistance in this matter. In other news, I'm studying a couple of Open University courses part-time - one on software development (i.e. UML), and one on interaction design. They're going well so far - I've had a couple of tutorials, and the first part of an assignment came back with good marks. I've been reading the Lean Software Development books by Mary and Tom Poppendieck. They seem to put Agile development into a 'respectable' historical context of similar improvements in manufacturing, which might be useful for persuading project managers.

Counting derivatives In the news, there's an article by Bruce Byfield discussing the influence of Debian and its (transitive) derivatives on the ecosystem of GNU/Linux distributions: Linux Leaders: Debian and Ubuntu Derivative Distros. The article is a sort of review of what you can find in the vast ecosystem of distributions rooted at Debian: from embedded to supercomputer distro, from netbook to scientific computing distros. The articles cites the Debian derivatives front desk and is a study similar to what we might tackle with the derivatives census by Paul Wise. (By the way: did you check if your favorite Debian derivative is already in? No? Do it!) With this article, Bruce has made me quite a favor in harvesting distrowatch to refresh the figures about the number of derivatives that I often use in speeches. The need of doing that has been polluting my LaTeX "% TODO" comments for a while now Here they are:

• 324 active distributions
• 129 of them are (directly or transitively) based on Debian
• 75 of the latter class are (directly) based on Ubuntu, i.e. transitively based on Debian

Update: update figures that Bruce misinterpreted; live data are available, thanks to Loris (see comments) for noticing

I've been nagged for a while (by Wookey mainly) about the unhelpfulness of dpkg-checkbuilddeps when it outputs the versions and alternatives alongside the package names which are missing, making it harder to pass the list to the package manager. apt-get build-dep isn't particular helpful either - it doesn't look at the modified package at all.

Of course, once the output is in a suitable format, a new script might as well make it possible to simply pass that output to said package manager. Once it can do that, it can then pass the output to the cross-dependency tools, like xapt.

So, I've refactored the embuilddeps script in the xapt package to do just this.

It's gained a few features in the process:

1. Support for Build-Conflicts resolution


2. Support for virtual packages, swapping the virtual for the first package to provide it (borrowed some code from Dpkg::Deps for that one).


3. Support for Build-Depends alternatives (currently using the buildd default of "first alternative gets first chance")


4. Reads data from debian/control, not the apt cache - to help with the package you're building instead of the one you've already uploaded.


5. Handles cross dependencies (which are always assumed to not currently be installed) and native dependencies. This support is transitory until such time as enough packages are Multi-Arch compatible that Cross-Multi-Arch becomes trivial.


6. Support for being used as a build-dependency resolver in pbuilder, including cross-architecture dependencies with pdebuild-cross.


7. Can locate a debian/control file in a specified directory without needing to be called from that directory


8. Checks your apt-cache policy to see if the required version of a package is available from your current apt sources. Fails completely if not. (The pdebuild-cross usage will need that to be extended a touch to look at the apt-cache policy from within the chroot.)


9. Hector Oron has also been asking me to get embuilddeps working with sbuild, so I'm working on that feature too.


10. verbose and quiet support (so use -q inside other scripts)


11. most output is already translated - more translations are welcome, especially for the documentation, but hold on until this version has actually been uploaded.

More testing is needed, particularly that the extensive refactoring hasn't broken the pbuilder resolution support and then looking at what still needs to be done for sbuild support. The new script is in Emdebian SVN.

The first-choice method for virtuals and alternatives may well bear extension to explicit management via command-line options. I'm unsure yet whether it needs to be a configuration file setting. It could simply be a recursive - try one, move on - model.

Since the last post, few things did happen. Basically, it's still not the right time for Debian users to upgrade to Xfce 4.8. We eventually managed to upload the whole desktop part (except the xfce metapackage) to experimental and we did upload some of the goodies too. Licensing issues have been solved so the concerned packages have been uploaded, and we're right now waiting on the three packages sitting in NEW.

• garcon is really mandatory for Xfce 4.8 since it implements the menu library, used by xfce4-panel, xfdesktop and xfce4-appfinder;
• thunar-vfs is needed if you want to keep the goodies not yet ported to the new thunar gio-based API (right now that means squeeze, the archiver, not the distribution);
• tumbler is a replacement for thunar-thumbnailers, implementing a standard thumbnailing interface, so it's possible to skip it for now.

So you'll need to be a little more patient and kindly wait for our ftp-masters to process the (quite huge) NEW backlog. After that we'll need a bit more time in experimental to test upgrade cases, then we'll do an upload to unstable of the whole desktop part and the whole goodies. Upgrading to xfce4-panel 4.8 means *all* plugins need to be rebuilt too, so that means a huge upgrade and a quite large transition to handle for the release team, so we'll have to schedule the unstable upload with them in order not to break all their plans (yes, we try to be good Debian citizens) So please be patient, but you'll see Xfce 4.8 in unstable in a not too distant future. I'll put an update here when we'll need brave volunteers willing to break their systems by doing upgrade tests. [UPDATE]: garcon, thunar-vfs and tumbler were just accepted into experimental, thanks to our ftp-masters. Now we'll synchronize with release team and upload to unstable when possible.

Warning: this is a rant against BSD (specifically FreeBSD , but don t let me get started on DragonFly, who think it s wise to drop all shells except ash from the base system and rely on pkgsrc yay let s compile a dozen packages just to get a shell with tab completion, not to mention boxen with no network access for the task although others seem to go into that direction too ; you know, there s BSD, and then there s FreeBSD ) don t like, don t read. If you want to change something in the BSD world, you gotta fork your own BSD no other way around the thickheads. Ok, back then, I ran into a particularily thick one, but others tend to not be much better. Users share the thickness. If you want to change something in the GNU/Linux world, just make a package, have someone upload it, prod (or pay, Hanno got a Radler) people to do it, or just upload it yourself. At the BSD booth at FOSDEM, despite me bringing the Windows Mobile 6 Professional devive, strictly for Geocaching mind you, Macintosh boxen had a share of more than 50% I didn t manage to tip the scale. At the Debian booth, almost everyone had a I want to buy a new laptop some day, but it just keeps on working and doesn t break pre-Lenovo IBM laptop. No hyping of Google either. (Last year s CLT saw BSD people advocating pro-Schily the guy with the broken encoding in his name shockingly.) Honestly, tcsh, FreeBSD people? Sorry. While I agree that there is merit on having the same script and interactive shell, as someone has pointed out (copy-paste examples into the command line), there s those zsh users who use mksh or GNU bash for scripting. Or just POSIX shell. And that s with an interactive shell which can be used for scripting. On the other hand, the C shell (both csh and tcsh) cannot. And what s with pretending the accent gravis is non-combining, called backtick (such a thing does not exist); and advocating it? Sorry, if your csh/tcsh doesn t handle the POSIX $( ) you should just drop it. (By the way, there is a convention that example command lines are prefixed with % for csh and $ for sh (or # but we write $ sudo instead, these days). Use it. Or leave it. If you have examples that substitute another process output, be specific.) It s funny to see how one person tries to defuse my arguments against csh by telling me it s just an interactive shell , while the other argues that people copy-paste between them, to which that was my response. Read the thread! And please, get your facts right. I would prefer that the standard shell be at least Bourne-compatible. You don t want Bourne ( ^ instead of for pipes), you want POSIX. That GNU bash is called the Bourne-Again Shell in one of their usual semi-bad puns doesn t help the global perception of such things any. Also, the root shell and /bin/sh are disjunct. (Plus, why change the root shell, use sudo(8), plain and simple.) ObNote: in jupp (should I package that for Debian, btw? rather upload, packages are ready ) the key is used as pr fix for Ctrl-X ( X) or to directly enter numerical (decimal, octal, sedecimal/hexadecadic) ASCII, 8-bit or Unicode codepoints. Yay!
And even the FSF has seen the light; for a few releases already, GCC uses ' ' instead of ' for quoting in messages, even without locales. Great job there! (LC_MESSAGES=en_GB.UTF-8 usually works, too, though.) ObDisclaimer: I have an (yes, Google ) Alert on the word mksh , so I know when it s being discussed. This obviously includes certain fora. Also, I m a shell implementer and bound to know a certain amount of details. Plus, mksh s build script runs with pretty much any Bourne/POSIX/Z Shell which has functions and not too many bugs. I wrote it. Go figure. No lowly trolling. FWIW, mksh(1) has the cat(1) builtin both because Android has no cat(1), and as speed hack. Almost all other shells have worse speed hacks, like a printf(1) builtin. And recently, builtins have become direct-callable, so this actually reduces the overall system footprint. (Its inclusion also provides for some other possibilities, internally.) And as two final side notes, if you haven t seen this: determine which shell we are run under (CVS) and I still offer a prompt conversion service (send me any GNU bash or oksh $PS1 and I ll send that to you in mksh(1) syntax optionally with adjustments/improvements, like cwd uses only up to 1/3 of screen width).

Christian is a figure of Debian, not only because of the tremendous coordination work that he does within the translation project, but also because he s very involved at the social level. He s probably in the top 5 of the persons who attended most often the Debian conference. Christian is a friend (thanks for hosting me so many times when I come to Paris for Debian related events) and I m glad that he accepted to be interviewed. He likes to speak and that shows in the length of his answers but you ll be traveling the world while reading him. My questions are in bold, the rest is by Christian. Who are you? I am a French citizen (which is easy to guess unless you correct my usual mistakes in what follows). I m immensely proud of being married for nearly 26 years with Elizabeth (who deserves a statue from Debian for being so patient with my passion and my dedication to the project). I m also the proud father of 3 wonderful kids , aged 19 to 23. I work as team manager in the Networks and Computers Division of Onera the French Aerospace lab , a public research institute about Aeronautics, Space and Defense. My team provides computer management services for research divisions of Onera, with a specific focus put on individual computing. I entered the world of free software as one of the very first users of Linux in France. Back in the early 1990 s, I happened (though the BBS users communities) to be a friend of several early adopters of Linux and/or BSD386/FreeBSD/NetBSD in France. More specifically, I discovered Linux thanks with my friend Ren Cougnenc (all my free software talks are dedicated to Ren , who passed away in 1996). You re not a programmer, not even a packager. How did you come to Debian? I m definitely not a programmer and I never studied computing (I graduated in Materials Science and worked in that area for a few years after my PhD). However, my daily work always involved computing (I redesigned the creep testing laboratory and its acquisition system all by myself during my thesis research work). An my hobbies often involved playing with home computers, always trying to learn about something new. So, first learning about a new operating system then trying to figure out how to become involved in its development was quite a logical choice. Debian is my distro of choice since it exists. I used Slackware on work machines for a while, but my home server, kheops, first ran Debian 1.1 when I stopped running a BBS on an MS-DOS machine to host a news server. That was back in October 1996. I then happened to be a user, and more specifically a user of genealogy software, also participating very actively in Usenet from this home computer and server, that was running this Debian thing. So, progressively, I joined mailing lists and, being a passionate person, I tried to figure out how I could bring my own little contribution to all this. This is why I became a packager (yes, I am one!) by taking over the geneweb package, which I was using to publish my genealogy research. I applied as DD in January 2001, then got my account in July 2001. My first upload to the Debian archive occurred on August 22nd 2001: that was of course geneweb, which I still maintain. Quite quickly, I became involved in the work on French localization. I have always been a strong supporter of localized software (I even translated a few BBS software back in the early 90 s) as one of the way to bring the power and richness of free software to more users. Localization work lead me to work on the early version of Debian Installer, during those 2003-2005 years where the development of D-I was an incredibly motivating and challenging task, lead by Joey Hess and his inspiring ideas. From user to contributor to leader, I suddenly discovered, around 2004, that I became the coordinator of D-I i18n (internationalization) without even noticing You re the main translation coordinator in Debian. What plans and goals have you set for Debian Wheezy? As always: paint the world in red. Indeed, this is my goal for years. I would like our favorite distro to be able to be used by anyone in the world, whether she speaks English, Northern Sami, Wolof, Uyghur or Secwepemcts n. As a matter of symbol, I use the installer for this. My stance is that one should be able to even install Debian in one s own language. So, for about 7 years, I use D-I as a way to attract new localization contributors. This progress is represented on this page where the world is gradually painted in red as long as the installer supports more languages release after release. The map above tries to illustrate this by painting in red countries when the most spoken language in the country is supported in Debian Installer. However, that map does not give enough reward to many great efforts made to support very different kind of languages. Not only various national languages, but also very different ones: all regional languages of Spain, many of the most spoken languages in India, minority languages such as Uyghur for which an effort is starting, Northern Sami because it is taught in a few schools in Norway, etc., etc. Still, the map gives a good idea of what I would like to see better supported: languages from Africa, several languages in Central Asia. And, as a very very personal goal, I m eagerly waiting for support of Tibetan in Debian Installer, the same way we support its sister language, Dzongkha from Bhutan. For this to happen, we have to make contribution to localization as easy as possible. The very distributed nature of Debian development makes this a challenge, as material to translate (D-I components, debconf screens, native packages, packages descriptions, website, documentation) is very widely spread. A goal, for years, is to set a centralized place where translators could work easily without even knowing about SVN/GIT/BZR or having to report bugs to send their work. The point, however, would be to have this without making compromises on translation quality. So, with peer review, use of thesaurus and translation memory and all such techniques. Tools for this exist: we, for instance, worked with the developers of Pootle to help making it able to cope with the huge amount of material in Debian (think about packages descriptions translations). However, as of now, the glue between such tools and the raw material (that often lies in packages) didn t come. So, currently, translation work in Debian requires a great knowledge of how things are organized, where is the material, how it can be possible to make contribution reach packages, etc. And, as I m technically unable to fulfill the goal of building the infrastructure, I m fulfilling that role of spreading out the knowledge. This is how I can define my coordinator role. Ubuntu uses a web-based tool to make it easy to contribute translations directly in Launchpad. At some point you asked Canonical to make it free software. Launchpad has been freed in the mean time. Have you (re)considered using it? Why not? After all, it more or less fills in the needs I just described. I still don t really figure out how we could have all Debian material gathered in Rosetta/Launchpad .and also how Debian packagers could easily get localized material back from the framework without changing their development processes. I have always tried to stay neutral wrt Ubuntu. As many people now in Debian, I feel like we have reached a good way to achieve our mutual development. When it comes at localization work, the early days where the everything in Rosetta and translates who wants stanza did a lot of harm to several upstream localization projects is, I think, way over. Many people who currently contribute to D-I localization were indeed sent to me by Ubuntu contributors .and by localizing D-I, apt, debconf, package descriptions, etc., they re doing translation work for Ubuntu as well as for Debian. Let s say I m a Debian user and I want to help translate Debian in my language. I can spend 1 hour per week on this activity. What should I do to start? Several language teams use Debian mailing lists to coordinate their work. If you re lucky enough to be a speaker of one of these languages, try joining debian-l10n-<yourlanguage> and follow what s happening there. Don t try to immediately jump in some translation work. First, participate to peer reviews: comment on others translations. Learn about the team s processes, jargon and habits. Then, progressively, start working on a few translations: you may want to start with translations of debconf templates: they are short, often easy to do. That s perfect if you have few time. If no language team exists for your language, try joining debian-i18n and ask about existing effort for your language. I may be able to point you to individuals working on Debian translations (very often along with other free software translation efforts). If I am not, then you have just been named coordinator for your language I may even ask you if you want to work on translating the Debian Installer. What s the biggest problem of Debian? We have no problems, we only have solutions We are maybe facing a growth problem for a few years. Despite the increased welcoming aspects of our processes (Debian Maintainers), Debian is having hard times in growing. The overall number of active contributors is probably stagnating for quite a while. I m still amazed, however, to see how we can cope with that and still be able to release over the years. So, after all, this is maybe not a problem Many people would point communication problems here. I don t. I think that communication inside the Debian project is working fairly well now. Our famous flame wars do of course still happen from time to time, but what large free software project doesn t have flame wars? In many areas, we indeed improved communication very significantly. I want to take as an example the way the release of squeeze has been managed. I think that the release team did, even more this time, a very significant and visible effort to communicate with the entire project. And the release of squeeze has been a great success in that matter. So, there s nearly nothing that frustrates me in Debian. Even when a random developer breaks my beloved 100% completeness of French translations, I m not frustrated for more than 2 minutes. You re known in the Debian community as the organizer of the Cheese & Wine Party during DebConf. Can you tell us what this is about? This is an interesting story about how things build themselves in Debian. It all started in July 2005, before DebConf 5 in Helsinki. Denis Barbier, Nicolas Fran ois and myself agreed to bring at Debconf a few pieces of French cheese as well as 1 or 2 bottles of French wine and share them with some friends. Thus, we settled an informal meeting in the French room where we invited some fellows: from memory, Benjamin Mako Hill, Hannah Wallach, Matt Zimmermann and Moray Allan. All of us fond of smelly cheese, great wine plus some extra p t home-made by Denis in Toulouse. It finally happened that, by word of mouth, a few dozens of other people slowly joined in that French room and turned the whole thing into an improvized party that more or less lasted for the entire night. The tradition was later firmly settled in 2006, first in Debconf 6 in Mexico where I challenged the French DDs to bring as many great cheese as possible, then during the Debian i18n meeting in Extremadura (Sept 2006) where we reached the highest amount of cheese per participant ever. I think that the Creofonte building in Casar de C ceres hasn t fully recovered from it and is still smelling cheese 5 years after. This party later became a real tradition for DebConf, growing over and over each year. I see it as a wonderful way to illustrate the diversity we have in Debian, as well as the mutual enrichment we always felt during DebConfs. My only regret about it is that it became so big over the years that organizing it is always a challenge and I more and more feel pressure to make it successful. However, over the years, I always found incredible help by DebConf participants (including my own son, last year a moment of sharing which we will both remember for years, i think). And, really, in 2010, standing up on a chair, shouting (because the microphone wasn t working) to thank everybody, was the most emotional moment I had at Debconf 10. Is there someone in Debian that you admire for their contributions? So many people. So, just like it happens in many awards ceremonies, I will be very verbose to thank people, sorry in advance for this. The name that comes first is Joey Hess. Joey is someone who has a unique way to perceive what improvements are good for Debian and a very precise and meticulous way to design these improvements. Think about debconf. It is designed for so long now and still reaching its very specific goal. So well designed that it is the entire basis for Joey s other achievement: designing D-I. Moreover, I not only admire Joey for his technical work, but also for his interaction with others. He is not he loudest person around, he doesn t have to .just giving his point in discussion and, guess what? Most of the time, he s right. Someone I would like to name here, also, is Colin Watson. Colin is also someone I worked with for years (the D-I effect, again ) and, here again, the very clever way he works on technical improvements as well as his very friendly way to interact with others just make it. And, how about you, Rapha l? I m really admirative of the way you work on promoting technical work on Debian. Your natural ability to explain things (as good in English as it is in French) and your motivation to share your knowledge are a great benefit for the project. Not to mention the technical achievements you made with Guillem on dpkg of course! Another person I d like to name here is Steve Langasek. We both maintain samba packages for years and collaboration with him has always been a pleasure. Just like Colin, Steve is IMHO a model to follow when it comes at people who work for Canonical while continuing their involvment in Debian. And, indeed, Steve is so patient with my mistakes and stupid questions in samba packaging that he deserves a statue. We re now reaching the end of the year where Stefano Zacchiroli was the Debian Project Leader. And, no offense intended to people who were DPL before him (all of them being people I consider to be friends of mine), I think he did the best term ever. Zack is wonderful in sharing his enthusiasm about Debian and has a unique way to do it. Up to the very end of his term, he has always been working on various aspects of the project and my only hope is that he ll run again (however, I would very well understand that he wants to go back to his hacking activities!). Hat off, Zack!I again have several other people to name in this Bubulle hall of Fame : Don Armstrong, for his constant work on improving Debian BTS, Margarita Manterola as one of the best successes of Debian Women (and the most geeky honeymoon ever), Denis Barbier and Nicolas Fran ois because i18n need really skilled people, Cyril Brulebois and Julien Cristau who kept X.org packaging alive in lenny and squeeze, Otavio Salvador who never gave up on D-I even when we were so few to care about it. I would like to make a special mention for Frans Pop. His loss in 2010 has been a shock for many of us, and particularly me. Frans and I had a similar history in Debian, both mostly working on so-called non technical duties. Frans has been the best release manager for D-I (no offense intended, at all, to Joey or Otavio .I know that both of them share this feeling with me). His very high involvment in his work and the very meticulous way he was doing it lead to great achievements in the installer. The Installation Guide work was also a model and indeed a great example of non technical work that requires as many skills as more classical technical work. So, and even though he was sometimes so picky and, I have to admit, annoying, that explains why I m still feeling sad and, in some way, guilty about Frans loss. One of my goals for wheezy is indeed to complete some things Frans left unachieved. I just found one in bug #564441: I will make this work reach the archive, benefit our users and I know that Frans would have liked that.

---

Thank you to Christian for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

7 comments Liked this article? Click here. My blog is Flattr-enabled.

I was interested to hear about a company here in the UK called ALLOW Ltd., offering marketing database management under a we ll get you off lists, then pay you to go back on at your pleasure basis. That sounds a fair deal to me, so I decided to sign up for it.

Our technology is built using some of the best and most secure tools in the industry. We have partnered with infrastructure providers who handle some of the most sensitive data in the UK (such as medical and financial records). Both the digital and physical security measures we have implemented are amongst the strongest available anywhere. This includes full encryption of all data at all times, full implementation of secure socket layers, security certificates and physical restriction of access to the data, our servers and our offices. Our systems have been fully penetration tested (that means we ve asked people to try and break in).

(There are other suitable assertions in various places they even have a set of principles about safeguarding data.) Unfortunately, this promise is rather undermined in several ways after noticing the first couple, I did a little digging to see what else was exploitable. Here s the final part of the joining process, where you choose a username and password combination: The text I ve cropped too eagerly says Choosing a secure password is an essential part of protecting your personal information , or thereabouts. I duly chose a complex password that fitted the requirements, and to my surprise it was rejected. I tried another, and it was rejected; then a third and a fourth. By trial and error I worked out what was going on: 1. The password must contain only the listed special characters, not just include one of them. That s a bit of a problem, because even assuming a basic ASCII set, 15 characters are unavailable to users; 80 are left, so that s about a 15% fall in the available combinations*. Not a good start. More concerning is the presence of a security question field. It s used for resetting the password in the event losing it, but this technique for recovery has long been ridiculed the shared secret is often common knowledge amongst friends, and sometimes (as in this case) the available questions are fairly easy for an attacker to find the answer to in public records or solicit from the victim without arousing much suspicion: 2. The security questions available include First pet s name and worse, First school name . It s pretty pointless enforcing stringent password requirements, and then bypassing them with something so susceptible to a dictionary attack. I was pleased to find that failing to log in to an account more than a few times results in a temporary lockout, which should deter casual brute force attacks. But I wanted to know how that security question would be used, so I forgot my password and followed the links to reset it. Here s the form: Actually the first form, not shown here, initially just asks for a username, giving an error message if it isn t registered, and here s another problem: 3. The password reset process confirms the existence, or non-existence, of a given username half the credentials required to log in to any visitor. I d be prepared to take a bet that most users will choose What was the name of your first school? as a security question. The first pet you have is often at such a young age you can t remember it clearly; the name of the street you grew up on might change a couple of times if you moved house. But first school I attended? I ll never forget that, so it makes most sense to use as a backup password . It s also the best one for an attacker to try and find out from public sources. But that aside, as you can see the password is not generated at random and communicated to the real account holder out-of-band, in the manner of many other sites. Instead: 4. A new password is immediately set to a value already known by the attacker. Once inside, an attacker can also change the security question or answer, or both, so you can t even regain your account by telephoning the company unless you can convince them you re genuine, in which case the security question was a total waste of time anyway. I awarded some marks for notifying the user by email that the password has been changed, but immediately docked them again because bingo! You re now a victim of identity theft! Let s assume you ve been locked out, the security question has been changed and you want your account back. ALLOW don t let you telephone them; you either have to dig around and find an address to send an email, which we all know can be intercepted, or (and you re encouraged to) contact them through a form on the site. You ll probably include some personal details, because you want to convince them of your real identity; indeed, two of the options on the form are I ve got a question and Something doesn t work . I sent my findings through this very form, under the latter heading, and to my surprise: 5. Despite promises of full encryption of all data at all times, full implementation of secure socket layers , the contact form is transmitted to ALLOW in the clear, with no protection whatsoever. So now anyone listening in your connection knows all about you too: your ISP, any of the peers along the route, the deep packet inspection advertisers if your ISP is less than reputable, and the neighbour who connects to your wireless and slips you a fiver every month for the privilege. Nice work, privacy specialists. (For the record:

• I have sent these findings to ALLOW and await a response have a response.
• Yes, this scenario is unlikely, but it doesn t fill me with confidence about the rest of their business activities.)

* please feel free to correct my maths. It was never my strongest subject.

---

Privacy specialists should hire security specialists is a post from: jwiltshire.org.uk Flattr

As mentioned earlier this week, I changed the server for my hoster from server4you to Hetzner. Because the contract for my old server is still running until the 14th of April, I thought I can make some good use of it by running an Tor exit node on it. Tor, The onion router is a world-wide network of server to anonymize network connections, and used for example by freedom-loving people in repressive countries, or by Facebook users in repressively proxied university networks Naturally, such a system is also used by people with lesser motives, and after nearly one week of running the server, some complaints were reaching server4you a honeynet supposedly detected botnet activity from my IP address, another company hired by Paramount Pictures claimed that someone downloaded Iron Man 2 over BitTorrent via my server. These were forwarded to my by server4you, demanding an explanation. I explained that I am running a Tor node, that such things are unavailable, and that neither I nor server4you is going to be held responsible. Nevertheless, they insist that I should stop whatever I am doing (I am not sure if they really understood what tor is), and when I said that I won t, they decided to unilaterally and immediately end my contract by tomorrow. Thus a powerful exit node that might have made life better for Tor users is doing to disappear again. They will not reimburse the advance fee that I had paid in advance and made a non-specific threat about further claims they might have. So server4you was, at least in my case, not only an unreliable and inflexible provider, they also prefer to cut off their customer s server just because of two complaints by third parties. I conclude that this is not a hoster that you should trust important services to. And I am not a unique case: There are reports of similar server shut-downs by server4you (in German).

[ If you haven't heard of this debate yet, you probably want to read Vincent Untz's and Mark Shuttleworth's blog posts. ] Last year, I gave a talk at FOSDEM about Debian and Ubuntu (slides of a slightly updated version). One of my points was that Debian has better values, being a volunteer-driven project where decisions are taken in the open. In contrast, Ubuntu is a project managed and controlled by Canonical, and recent history has shown that Canonical had no problem imposing some decisions to the developers community: first with the inclusion of UbuntuOne, then the switch from Google to Yahoo! to Google as the default search engine, both to increase revenue streams. So one should not be surprised by the Banshee story. I find Mark s justification quite difficult to buy, and similar to Apple s model where 30% of the revenues from the App Store go to Apple, and 70% to the seller of the application. For those wondering how much work was done by Canonical directly on the Banshee package: the banshee package in Ubuntu natty is based on the package currently in Debian experimental. The package is mainly maintained in Debian by an Ubuntu developer not paid by Canonical AFAIK, Chow Loong Jin. There are some differences between the Debian package and the Ubuntu package, which are fairly limited (full diff here) and mainly about enabling UbuntuOne and disabling the other music stores. That patch itself apparently was provided by Jo Shields, who doesn t seem to be a canonical employee. (Feel free to correct me) I think that one of the conclusions to draw from this story is that we now have several proofs that Ubuntu isn t a volunteer-driven project, and that volunteer contributors should really decide whether they are OK with working for free for Canonical, or if their free time would be better spent on other projects where they actually have a chance to influence decisions. From the Debian POV, I m still convinced that we should take the feedback that we receive from Ubuntu in consideration to improve our Debian packages (by looking at patches made by Ubuntu, or at bugs reported in Launchpad). But my motivation for contributing to Ubuntu directly has just diminished a bit more (not that it was very high before).

Once again, there will be another round of the Summer School Advanced Scientific Programming in Python . This year in St. Andrews, UK. Quoting from the official announcement:

Scientists spend more and more time writing, maintaining, and debugging software. While techniques for doing this efficiently have evolved, only few scientists actually use them. As a result, instead of doing their research, they spend far too much time writing deficient code and reinventing the wheel. In this course we will present a selection of advanced programming techniques, incorporating theoretical lectures and practical exercises tailored to the needs of a programming scientist. New skills will be tested in a real programming project: we will team up to develop an entertaining scientific computer game. We use the Python programming language for the entire course. Python works as a simple programming language for beginners, but more importantly, it also works great in scientific simulations and data analysis. We show how clean language design, ease of extensibility, and the great wealth of open source libraries for scientific computing and data visualization are driving Python to become a standard tool for the programming scientist. This school is targeted at PhD students and Post-docs from all areas of science. Competence in Python or in another language such as Java, C/C++, MATLAB, or Mathematica is absolutely required. Basic knowledge of Python is assumed. Participants without any prior experience with Python should work through the proposed introductory
materials before the course.

You can apply on-line at http://python.g-node.org Applications must be submitted before May 29, 2011. Notifications of acceptance will be sent by June 19, 2011. No fee is charged but participants should take care of travel, living, and accommodation expenses. Candidates will be selected on the basis of their profile. Places are limited: acceptance rate in past editions was around 30%. Prerequisites: You are supposed to know the basics of Python to participate in the lectures. Please consult the website for a list of introductory material. If your re a scientist and interested in Python, I cannot recommend this summer school highly enough. The Summer School is always fun, the faculty members are very nice and always willing to help and answer questions. The balance between lectures and exercises is in my opinion very good, and you ll learn a lot about Python during the week. The highlight of every Python School is always the Pac Man tournament, where groups of students will implement their own Pac Man agent (in Python) and compete against the other agents in a tournament till the bitter end! The students of the previous editions were usually very happy during and after the School. Speaking of happiness, since no fee is charged for the Summer School, you ll have more money left over to invest into the excellent Scottish pubs!

I spend too much time writing Emacs Lisp code these days. Unfortunately, the more I do the more I find new useful tools to improve my work-flow and save time for doing more Lisp. D'oh. I did not work on any big thing these last weeks, so I'm thinking it's a good time to talk about the various code and patches I sent to multiple Emacs packages. el-get el-get, a fabulous tool that installs and handles all the external Emacs packages I use. A friendly war started on the development list about autoloads handling. The discussion was overall pointless, since we had a very hard time to communicate our ideas, and we did not understand each others several times. In the end, el-get now supports autoload correctly and do not load automatically all your packages, improving the startup time, and using the Emacs way to do things. Which is always better, obviously. git-commit-mode

I've started to use git-commit-mode some times ago. I usually use git-commit with the -v option to see what I'm committing. I though it would be useful to color the diff with diff-mode, so I wrote a patch just to do that, which was merged today by Florian. magit

Some weeks ago, I decided to give a try to magit, and loved it. I am not always using it, but for basic operations it is very useful. But I really soon found some things I did not like and therefore send patches to enhance it. First, I've added a patch to honor status.showUntrackedFiles which I use in my home directory. In the mean time, I've also added a patch to allow adding an arbitrary file. Yesterday, I sent another pull request, not closed for now, which adds the possibility to visit files in another window from a diff file, and the support for add-change-log-entry directly from the displayed diff. Useful for these old projects still using ChangeLog files but accessible through git (hi Emacs & Gnus!). Gnus

Nothing remarkable, but I write a couple of fixes and enhancements to the Sieve manage mode, to the Gravatar code and cleaned-up some very very old code. Also added the possibility to set list-identifier as a group parameter. Org-mode

I spent most of my time working on my jd/agenda-format branch, which is soon to be merged. I've also just got developer access to the Org-mode patch work and repository, so I'll be able to break things even more! ;-) ERC

I fixed the bug that annoyed me for a long time. Now erc-track does not reset the last channel status on window visibility changes not made by the user.

Wow, it's the last day of February and this is the first journal post I've made for the whole month. Needless to say, this month isn't working out quite the way that I'd intended at the start of year, although this is due to external forces that I hadn't been able to predict. The work project that I've been working on since last September or so (and in some sense since last June) hit the crunch, and I was pulled off of nearly everything else I was doing to work on that full time. I've been working 45-50 hours a week for the whole month, and probably will for a bit of March as well. The good part is that we're hitting our deadlines. We're going to push back by two weeks due to a design problem we missed until integration testing, but it looks like only two weeks. And given that we're picking up the entire complex account management system, teasing it apart from another major system that it's part of, and bringing it up in my group, along with reimplementing some bits around the edges and working on very old and fragile code, I'm very impressed. Unfortunately, that's also eaten my life. I'm trying to keep up with occasional things here and there, but projects like Debian got put almost entirely on hold. When I'm working this much during the week, I basically collapse on the weekends, rather than work on other projects like I normally do. I've been playing video games or just watching TV, and doing a bit of reading, but not working on free software or writing book reviews. I'm going to get a bit of time off at the end of this project, and hopefully will be able to rebalance my life again. This sort of huge push is quite unusual for work, which I like. I don't like working this way, and I've been occasionally rather unhappy with how little life outside of work I feel like I have (I can't imagine what working 60 hours a week regularly would be like). But there's only about a month or a month and a half left and then we'll be done and can go back to a more relaxed pace. I'm going to see if I can get a review finished tonight just because I hate going through a month without posting a book review. I've read five books (and three magazines) that I've not reviewed yet; sadly, the reviewing brain requires quite a bit more energy than the reading brain. Or perhaps not sadly, since it means I'm still reading. Expect posting to be minimal for the next month or so, and then it will hopefully pick up again.

I've been building unofficial wine-unstable packages for some time now and the amount of people apparently using them has become noticable (not only traffic-wise). Thus the amount of questions send to me has also risen quite a bit. In this post I try to address most of the questions in the hope it'll help people understand my motives for building these packages and potential pit falls for users. First of all: I'll stop building those packages as soon as Debian has a for my purposes recent enough version in the archives. This is expected to happen soon as most/all of the blocking issues should be sorted out now/soon. See e.g. #557783 for some insight into the problems. It might happen after updated packages are in Debian, that I'll build one version or the other occasionally to test a certain patch or version. The bottom line of this is: don't rely on me to provide always the latest packages. (This, by the way, is also explanation enough to the question, whether I'm going to build the "official" (I consider only those entering Debian's archives official) Debian packages for upstream (WineHQ).) Another question, which is seen every now and then in my inbox, is, whether I could add patch xyz to the packages. The answer is no. I maintain those packages for myself and if you want to use them, you're welcome. If you need another patch applied, just download the source package and add the patch with quilt to the series. When a certain version/build doesn't work for you, you can ask me for help, but please don't expect me to handle "doesn't work" reports like I would handle bug reports for my packages. The wine-unstable packages are for myself and if they work for me, that's all I aim for. Before spreading the word about my packages, make sure, you and those who read your post/message/whatever about my packages understand, that it is generally a very bad idea to install third-party packages, even though I'm a Debian Developer. Make also sure everybody understands that only the source package is signed with my key. Please don't download all packages (binary and source), unless you really need all of them. Please pick the ones, you need and just download them. Even though this might sound like begging, which I'm not, it'd be nice, if you could consider donating (via PayPal) something, to help cover the traffic costs. The traffic for just the wine-unstable packages has risen dramatically in the last few months. Thanks! Now, I hope I've answered most questions, if not, feel free to contact me.

I've been out here for 6 months now. At the point in time I was coming out I was pointed at Andrew Pollock's On bootstrapping oneself in the US. I figure some extra data may be useful for anyone considering the same. I moved from the UK rather than Australia. Banking I sorted out my US banking long before I ever moved here; in fact I kicked the process off shortly after I accepted the move offer. Matthew had recommended the HSBC approach, so I did that. This meant when I arrived I had a credit card, debit card and check book. They also allow me to do really easy online transfers between my US and UK accounts. Mobile phone My mobile phone was something else that was dealt with before the move. I bought a Simple Mobile SIM off eBay. I thought I'd end up moving to a contract once I had a credit record here, but actually the $60/month unlimited tariff seems to be fairly reasonable. Their customer service leaves a lot to be desired, but I've sadly come to expect that from phone companies. I've got a Google Voice account which is the number I've been giving out, so it's easily for me to switch providers (or redirect things to a VOIP setup for when I'm back in the UK, but I've got a writeup to do for that at a later point in time). Finding somewhere to live One of my concerns was that it would be hard to find somewhere to live at short notice without any credit history or SSN. This turned out to be ill founded. Both of the managed apartment complexes I looked at were ok with the fact I'd just moved to the country and seemed used to such a setup. The place I went with is privately leased and was a bit more wary, but after a conversation with my US manager (who'd managed me even when I was in the UK) it was fine. Social Security Number AKA existing as an entity as far as the US is concern. I was told to wait at least 10 working days after entry before even applying for this, or I wouldn't be in the system and it could cause delays. I did so and the card turned up within about a week (I had been told up to 2 weeks). Which was good, because work were having problems figuring out how to pay me without one. You do seem to need the SSN for everything. The only times I can remember needing my National Insurance number in the UK is for new jobs and my E111 application. Driving licence I haven't ended up buying a car here; I pretty much don't need one most of the time and I've signed up to ZipCar for easy short term rentals - they're happy to take a UK licence for sign up. However I figured getting a licence here was a good idea in case I did decide to get a car, and even just for ID (I kept having to point people at the DOB on my UK licence - everywhere here seems to card). Applying for a licence ideally relies an SSN, so I did so a few days after I'd got that. I did the car + motorbike written tests and got my learner's permit. I applied for the car theory test the same day, but the first available slot was about 6 weeks later. During this period I did the CMSP basic RiderCourse, which meant that when I passed the car test I was also fully entitled to ride a motorbike here. Other useful notes As I live in the Bay Area I got myself a ClipperCard - it's like Oyster except without the clever discounts. Works on more agencies though and helps avoid having to sort out change. For broadband I went with Sonic.net - I'm in their ADSL2 coverage area so I'm getting a reasonable 17Mb/s connection. The other options were AT&T ADSL (slower) or Comcast cable (evil). I've had zero problems with Sonic; It Just Works. Also I sort of ended up with a trial run thanks to DebConf10 being in New York. Due to the way timings worked out this took place only a few weeks before my move to SF was scheduled. My banking and phone were already in place by this point, so it allowed me to check both were working ok. They were, and I didn't really expect them not to be, but it was a nice safety net to have for the move proper. Overall the main issue I had was that a lot of things were dependant on other things; get the SSN, get a learner's permit, apply for the practical test, wait for the licence to actually turn up etc. It probably took over 3 months for everything to actually happen and come through in the post. I can tell when I actually started to exist in the system because Capital One being junk mailing me about whether I want a credit card with them...