Search Results: "ana"

17 February 2011

Clint Adams: Forward the foundation

I don't know how I feel about this.

Raphaël Hertzog: People behind Debian: Maximilian Attems, member of the kernel team

Maximilian, along with the other members of the Debian kernel team, has the overwhelming job of maintaining the Linux kernel in Debian. It s one of the largest package and certainly one where dealing with bug reports is really difficult as most of them are hardware-specific, and thus difficult to reproduce. He s very enthusiastic and energetic, and does not fear criticizing when something doesn t please him. You ll see. My questions are in bold, the rest is by Maximilian. Who are you? My name is Maximilian Attems. I am a theoretical physicist in my last year of PhD at the Technical University of Vienna. My main research area is the early phase of a Quark-Gluon Plasma as produced in heavy ion collisions at the LHC at CERN. I am developing simulations that take weeks on the Vienna Scientific Cluster (in the TOP 500 list). The rest of the lab is much less fancy and boils down to straight intel boxes without any binary blobs or external drivers (although lately we add radeon graphics for decent free 3D). Mathematica and Maple are the rare exceptions to the many dev tools of Debian (LaTeX, editors, git, IDE s, Open MPI, ..) found at the institute, as those are unfortunately yet unmatched in Free Software for symbolic computations. The lab mostly runs a combination of Debian stable (testing starting from freeze) for desktops and oldstable/stable for servers. Debian is in use for more than 10 years. So people in the institute know some ups and downs of the project. Newcomers like my room neighbors are always surprised how functional a free Debian Desktop is. :) What s your biggest achievement within Debian? Building lots and lots of kernels together with an growing uptake of the officially released linux images. I joined the Debian kernel team shortly after Herbert Xu departed. I had been upstream Maintainer of the linux-2.6 janitor project for almost a year brewing hundreds of small cleanups with quilt in a tree named kjt for early linux-2.6. In Debian we had lots of fun in sorting out the troubles that the long 2.5 freeze had imposed: Meaning we were sitting on a huge diverging monolithic semi-good patchset. It was great fun to prepare 2.6.8 for Sarge with a huge team enthusiastic in shipping something real close to mainline (You have to imagine that back then you had no stable or longterm release nor any useful free tools like git. This involved passing patches around, hand editing them and seeing what the result does.) From the Sarge install reports a common pattern emerged that the current Debian early userspace was causing lots of boot failures. This motivated me to develop an alternative using the new upstream initramfs features. So I got involved in early userspace. Thanks to large and active development team initramfs-tools got a nice ecosystem. It still tries to be as generic and flexible as possible and thus gains many nice features. Also H. Peter Anvin (hpa) gave me the official co-maintenance of klibc. klibc saw uptake and good patches from Google in the last 2 years. I am proud that the early userspace is working out fairly well these days, meaning you can shuffle discs around and see your box boot. Later on we focused on 2.6.18 for Etch, which turned out to a be good release and picked up by several other distributions. Only very much later we would see such a sync again. With 2.6.26 for Lenny we got somehow unlucky as we just missed the new longterm release by one release. We also pushed for another update very late (during freeze) in the release cycle, which turned out to semi-work as too much things depend on linux-2.6. For Squeeze 2.6.32 got picked thanks to discussions at Portland Linux Plumbers and it turned out to be a good release picked up by many distributions and external patchsets. The long-term support is going very well. Greg KH is doing a great job in collecting various needed fixes for it. Somehow we had hoped that the Squeeze freeze would start sooner and that the freeze duration would be shorter, since we were ready for a release starting from the actual freeze on. The only real big bastard on the cool 2.6.32 sync is Red Hat. Red Hat Enterprise 6.0 is shipping the linux-2.6 2.6.32 in obfuscated form. They released their linux-2.6 as one big tarball clashing with the spirit of the GPL. One can only mildly guess from the changelog which patches get applied. This is in sharp contrast to any previous Red Hat release and has not yet generated the sharp and snide comments in press it deserves. Red Hat should really step back and not make such stupid management moves. Next to them even the semi-maintained Oracle Unbreakable 2.6.32 branch looks better: It is git fetchable. What are your plans and those of the kernel team for Debian Wheezy? Since 2.6.32 many of the used patches landed upstream or are on the way (speakup, Kbuild Debian specific targets, ..). The proper vfs based unionfs is something we d be looking forward. We haven t yet picked the next upstream release we will base Wheezy on, so currently we can happily jump to the most recent ones. There are plans for better interaction with Debian Installer thanks to generating our udebs properly in linux-2.6 source itself. Also we are looking forward to using git as tool of maintenance. We d hope that this will also allow for even better cross distribution collaboration. Concerning early userspace I plan to release an initramfs-tools with more generic userspace for the default case and finally also a klibc only for embedded or tuning cases. What do you like most in Debian? For one thing I do like the 2 year release cycle. It is not too long to have completely outdated software and on the other hand it gives enough time to really see huge progress from release to release. Also at my institute the software is is recent enough without too much admin overhead. For servers the three years support are a bit short, but on the manageable side. I do enjoy a lot the testing distribution. For my personal use it is very stable and thus I mainly run testing on my desktop and work boxes. (Occasionally mixing in things from sid for unbreaking transition or newer security fixes). Debian is independent and not a commercial entity. I think this is its main force and even more important these days. I enjoy using the Debian platform a lot at work thus in return this motivates me to contribute to Debian itself. I also like the fact that we strive for technical correctness. Is there some recurrent problem that hinders the progress of Debian? The New Maintainer process is a strange way to discourage people to contribute to Debian. It is particularly bureaucratic and a huge waste of time both for the applicant and his manager. It should be completely thrown overboard. One needs a more scalable approach for trust and credibility that also enhances the technical knowledge for coding and packaging of the applicant. NM is currently set in stone as any outside critics is automatically rejected. Young and energetic people are crucial for Debian and the long-term viability of the project, this is the reason why I d consider the New Maintainer process as Debian s biggest problem. Note from Rapha l Hertzog: I must say I do not share this point of view on the New Maintainer process, I have witnessed lots of improvements lately thanks to the addition of the Debian Maintainer status, and to the fact that a good history of contribution can easily subsume the annoying Tasks & Skills questionnaire. Another thing I miss is professional graphics input both for the desktop theme and the website. I know that effort has been done there lately and it is good to see movement there, but the end result is still lacking. Another trouble of Debian is its marketing capabilities. It should learn to better sell itself. It is the distribution users want to run and use not the rebranded copies of itself with lock-in sugar . Debian is about choice and it offers plenty of it: it is a great default Desktop. Linus Torvalds doesn t find Debian (and/or Ubuntu) a good platform to hack on the kernel. Do you know why and what can we do about this? The Fedora linux-2.6 receives contributions from several Red Hat employed upstream sub-Maintainers. Thus it typically carries huge patches which are not yet upstream. As a consequence eventual userland troubles get revealed quite quickly and are often seen there first. The cutting edge nature of Fedora rawhide is appealing for many developers. The usual Debian package division of library development files and the library itself is traditionally an entry barrier for dev on Debian. Debian got pretty easily usable these days, although we could and should again improve a lot more in this sector. Personally I think that Linus hasn t tried Debian for years. I have the feeling that the implication of the Debian Kernel team in LKML has been on the rise. Is that true and how do you explain this? Ben Hutchings is the Nr.1 contributor for 2.6.33. He also is top listed as author of patches on stable 2.6.32. Debian is not listed as organization as many send their linux-2.6 patches from their corporate or personal email address and thus it won t be attributed to Debian. There is currently no means to see how many patches get forwarded for the stable tree, but I certainly forwarded more then fifty patches. I was very happy when Greg KH personally thanked me in the 2.6.32.12 release. In the Squeeze kernel, the firmwares have been stripped and moved into separate packages in the non-free section. What should a user do to ensure his system keeps working? There is a debconf warning on linux-2.6 installation. It is quite clear that the free linux-2.6 can t depend on the firmware of the non-free archive (also there is no strict dependency there technically). On the terminal you d also see warnings by update-initramfs on the initramfs generation for drivers included in the initramfs. The debconf warning lists the filename(s) of the missing firmware(s). One can then apt-cache search for the firmware package name and install it via the non-free repository. The check runs against the current loaded modules. The match is not 100% accurate for special cases as the one where the device might be handled well by this driver without firmware, but is accurate enough to warrant the warning. The set of virtualization technologies that the official Debian kernel supports seems to change regularly. Which of the currently available options would you recommend to users who want to build on something that will last? KVM has been a smooth ride from day zero. It almost got included instantly upstream. The uptake it has is great as it sees both dev from Intel and AMD. Together with libvirt it s management is easy. Also the performance of virtio is very good. The linux containers are the thing we are looking forward for enhanced chroots in the Wheezy schedule. They are also manageable by libvirt. Xen being the bad outside boy has an incredible shrinking patchset, thus is fair to expect to see it for Wheezy and beyond. For many it may come a bit late, but for old hardware without relevant CPU it is there. Many tend to overstate the importance of the virtualization tech. I d be much more looking forward to the better Desktop support in newer linux-2.6. The Desktop is important for linux and something that is in heavy use. The much better graphics support of the radeon and nouveau drivers: The performance optimizations thanks to dcache scalability work and the neat automatic task-grouping for the CPU scheduler are very promising features for the usability of the linux desktop. Another nice to have feature is the online defrag of ext4 and its faster mkfs. Even cooler would be better scalability in ext4 (This side seems to have seen not enough effort lately). Is there someone in Debian that you admire for their contributions? Hans Peter Anvin and Ted Tso are a huge source of deep linux-2.6 knowledge and personal wisdom. I do enjoy all sorts of interactions with them. Christoph Hellwig with Matthew Wilcox and also William Irwin for setting up the Debian kernel Team. Several Debian leaders including the previous and the current one for their engagement, which very often happens behind the scene. The Debian Gnome Team work is great, also the interactions have always been always easy and a pleasure. Martin Michlmayr and previously Thiemo Seufer do an incredible job in porting Debian on funny and interesting ARM and MIPS boxes. Debian has a lot of upcoming potential on this area. I m looking forward to other young enthusiastic people in that area. Colin Watson is bridging Debian and Ubuntu, which is an immense task. Michael Prokop bases on Debian an excellent recovery boot CD: http://www.grml.org. I d be happy if any Debian Developer would work as carefully coding and working.
Thank you to Maximilian for the time spent answering my questions. I hope you enjoyed reading his answers as I did. Subscribe to my newsletter to get my monthly summary of the Debian/Ubuntu news and to not miss further interviews. You can also follow along on Identi.ca, Twitter and Facebook.

One comment Liked this article? Click here. My blog is Flattr-enabled.

Christoph Berg: Heartbeat and bind9

Using a virtual IP managed by heartbeat is a nice way to work around the slow fallback behavior with multiple nameservers in /etc/hosts. But unlike ntpd, bind9 doesn't automatically listen on new IPs on the system. Here's a cute hack to fix that:
# cat /etc/ha.d/haresources
server01 bind9release IPaddr::10.0.0.3 bind9takeover
# cat /etc/ha.d/resource.d/bind9release
#!/bin/sh
# when giving up resources, reload bind9
case $1 in
        stop) /etc/init.d/bind9 reload ;;
esac
exit 0
# cat /etc/ha.d/resource.d/bind9takeover
#!/bin/sh
# on takeover, reload bind9
case $1 in
        start) /etc/init.d/bind9 reload ;;
esac
exit 0

15 February 2011

Torsten Werner: Are we slaves?

We still have more than 300 new packages in Debian that needs manual checks and we have a lot of open bugs. I don t get paid for working on dak (the Debian Archive Kit) nor do I feel a deep passion on doing such work. I am contributing to Debian because it is a great project and because contributing is my way to say Thank you to all who made (and still make) it possible. BUT: are we slaves that are supposed to do any stuff for other people? Yesterday someone asked for an enhancement for dak via IRC. I ve kindly asked him: do you want to send a patch? (words are copied from the IRC session). Instead of answering no he sent a patch for 2 plain text files within 4 minutes after I told him the URL to dak s git repository. I could not do it faster by myself and I ve got many other open tasks. I ve applied the patch and activated it on ftp-master.debian.org. But today he ranted about my rudeness and he did not even managed to quote me correctly ( Please send a patch ).

Dirk Eddelbuettel: Rcpp 0.9.1

A new release 0.9.1 of Rcpp went to CRAN and Debian yesterday. This version contains mostly bug-fixes and rather few enhancements. The changes are mostly 'internal fixes' and not user-facing; they mostly address some issues in memory management which, while not tripping up the unit tests or common usage, caused trouble for advanced Rcpp modules use and repeated memory allocation / deallocation. This bit Doug Bates repeatedly, and he put his head down and debugged the issue. A number of changes fairly deep-down in Rcpp (as well as in R-devel) later, this looks much better and we owe him a hearfelt Thank You! A big Thanks! also goes to Luke Tierney who out some new memory debugging code into R-devel which the --enable-strict-barrier in R 2.13.0 (due in April) will enable. A related fix is also in R 2.12.2 due on the 25th. The NEWS entry is below; more detail is in the ChangeLog file in the package.
0.9.1   2011-02-14
    o   A number of internal changes to the memory allocation / protection of
        temporary objects were made---with a heartfelt "Thank You!" to both
        Doug Bates for very persistent debugging of Rcpp modules code, and to
        Luke Tierney who added additional memory allocation debugging tools
        to R-devel (which will be in R 2.13.0 and may also be in R 2.12.2)
        
    o   Removed another GNU Make-specific variable from src/Makevars in order
        to make the build more portable; this was noticed on FreeBSD
    o   On *BSD, do not try to compute a stack trace but provide file and
        line number (which is the same behaviour as implemented in Windows)
    o   Fixed an int conversion bug reported by Daniel Sabanes Bove on r-devel,
        added unit test as well
    
    o   Added unit tests for complex-typed vectors (thanks to Christian Gunning)
    
    o   Expanded the Rcpp-quickref vignette (with thanks to Christian Gunning)
    o   Additional examples were added to the Rcpp-FAQ vignette
Thanks to CRANberries, there is also a diff to the previous release 0.9.0. As always, even fuller details are on the Rcpp Changelog page and the Rcpp page which also leads to the downloads, the browseable doxygen docs and zip files of doxygen output for the standard formats. A local directory has source and documentation too. Questions, comments etc should go to the rcpp-devel mailing list off the R-Forge page

14 February 2011

John Goerzen: How do you hire programmers and sysadmins? How should employers evaluate you?

Reading job listings for any sort of IT job is depressing. It s been quite some time since I ve had to do that, but how many times have you seen something like this: I could go on and on. As a job seeker, that sort of thing is fundamentally devaluing to someone who has strengths in being adaptable and quickly learning new tools, languages, or even entire environments. As an employer, it sends a message that you re not interested in more than a surface look at someone s strengths, and probably don t care to hire the best and the brightest. After all, would you turn away a rockstar programmer simply because he or she had been writing filesystem code in C the last 3 years instead of the latest whizbang Java web widget that will probably be obsolete in a year and unsupported in two? I am quite certain that there are plenty of managers that do. Even if you are a company large enough to have an entire team of people that do nothing but work on that whizbang app, don t you still want the best you can find, realizing that some of the best people to work on that app may not have even heard of it yet? (And that when the app goes obsolete in 5 years, you d rather not have to lay off a large team of single-skill people) Some of you may know that I work in IT at a manufacturing company. We have a small IT team here, about seven people, and are a heavy Debian shop. And we have a vacancy open up in our development/Linux admin group. I m the manager of that group, which is why I m thinking about this right now. We re too small for single-subject specialists to make sense, yet we re big enough to appreciate skill, experience, flexibility, and rigor. Consequently, when the occasion arises for me to look for new employees, I don t prepare a laundry list of things we use in-house and would like experience with. The list of almost-required things generally begins with Linux and ends with experienced , and has nothing else in between. In other words, I d like it if I don t have to explain to you what a symlink or a hardlink is, but I d be willing to do so if I think you d internalize it quickly. On the experienced side, it would be nice if you already have a well-developed sense of fear at running rm when you re root, or have designed a storage infrastructure for a network before, or are paranoid about security. But again, if people can pick up those traits on the job, we are usually still interested. If learning how to package up software for Debian, fix bugs in software you ve never seen in a language you ve never heard of, raise good questions about things you may not have lots of experience with, and write documentation for it all on a wiki sounds like fun, then that s probably the kind of person I want, even if you ve never used our particular tools before. If I were to judge based on the stuff I normally see in job postings, I guess you might conclude I m nuts. I don t think I am, but then again I m also the only person I know that formats his own resume in hand-crafted LaTeX. What do you all think? The next question is: how should one evaluate candidates given this sort of philosophy? I m not a fan of canned tests, or even whiteboard tests that tend to be some sort of canned topic that may test the applicant s specific knowledge base more than overall skill and flexibility. Similarly, as an applicant in years past, I ve struggled with how to present the I ve never used $LANGUAGE, but I know I could pick it up quickly and do it very well vibe. To certain people, that might sound like BS. To the more geeky managers, perhaps it sounds like what they want. We ve built a fairly diverse team on the back of this approach, and it s worked out well for us so far. I m interested to hear your thoughts. Oh, and if you d like to work for us, you should probably be sending me an email. No, I m not going to list the address here on this blog post. If you can t figure it out, I don t want to hear from you <grin>

Rapha&#235;l Hertzog: Debian Cleanup Tip #3: get rid of third-party packages

Last week, we learned how to get rid of obsolete packages. This time, we re going to learn how to bring back your computer to a state close to a pure Ubuntu/Debian installation. Thanks to the power of APT, it s easy to add new external repositories and install supplementary software. Unfortunately some of those are not very well maintained. They might contain crappy packages or they might simply not be updated. An external package which was initially working well, can become a burden on system maintenance because it will be interfering with regular updates (for example by requiring a package that should be removed in newer versions of the system). So my goal for today is to teach you how to identify the packages on your system that are not coming from Debian or Ubuntu. So that you can go through them from time to time and keep only those that you really need. Obsolete packages are a subset of those, but I ll leave them alone. We took care of them last week. Each (well-formed) APT repository comes with a Release file describing it (example). They provide some values that can be used by APT to identify packages contained in the repository. All official Debian repositories are documented with Origin=Debian (and Origin=Ubuntu for Ubuntu). You can verify the origin value associated to each repository (if any) in the output of apt-cache policy:
[...]
 500 http://ftp.debian.org/debian/ lenny/main i386 Packages
     release v=5.0.8,o=Debian,a=stable,n=lenny,l=Debian,c=main
     origin ftp.debian.org
[...]
From there on, we can simply ask aptitude to compute a list of packages which are both installed and not available in an official Debian repository:
$ aptitude search '?narrow(?installed, !?origin(Debian))!?obsolete'
or
$ aptitude search '~S ~i !~ODebian !~o'
You can replace search with purge or remove if you want to get rid of all the packages listed. But you re more likely to want to remove only a subset of carefully chosen packages you re probably still using some of the software that you installed from external repositories. With synaptic, you can also browse the content of each repository. Click on the Origin button and you have a list of repositories. You can go through the non-Debian repositories and look which packages are installed and up-to-date. But you can do better, you can create a custom view. Click on the menu entry Settings > Filter . Click on New to create a new filter and name it External packages . Unselect everything in the Status tab and keep only Installed . Go in the Properties tab and here add a new entry Origin Excludes ftp.debian.org . In fact you must replace ftp.debian.org with the hostname of your Debian/Ubuntu mirror. The one that appears on the origin line in the output of apt-cache policy (see the excerpt quoted above in this article). Note that the term Origin is used to refer to two different things, a field in the release file but also the name of the host for an APT repository. It s a bit confusing if you don t pay attention. Close the filters window with OK. You now have a new listing of External packages under the Custom Filters screen. You can see which packages are installed and up-to-date and decide whether you really want to keep it. If the package is also provided by Debian/Ubuntu and you want to go back to the version provided by your distribution, you can use the Package > Force version menu entry.
Click here to subscribe to my free newsletter and get my monthly analysis on what s going on in Debian and Ubuntu. Or just follow along via the RSS feed, Identi.ca, Twitter or Facebook.

8 comments Liked this article? Click here. My blog is Flattr-enabled.

Clint Adams: Itamae, itamae

C: Heyward's - Johnson C. C: Rosedale's - downtown O: Gates - 3205 Main
Servicio mesa (21.00) $8.00
Bebidas (21.00) $8.00
Copa salentein (21.00) $27.00
Provoleta (21.00) $24.00
Asado de tira (21.00) $45.00

13 February 2011

Christian Perrier: Fonts week-end

I spent most of the week-end working in the pkg-fonts team SVN repository and uploading font packages. The main goal was implementing "Build-Depends:fontforge-nox fontforge" to make the build of fonts easier and faster when they're built from FontForge source files. While doing this, I updated a few of these fonts. I also completely revamped the linux-libertine package which was left pending for quite some time in our SVN (after initial work by Rog rio Brito). I also definitely adopted the ttf-sinhala-lklug font package (the only fonts we have for Sinhala language, so far). Finally, I started going through the list of packages that still depend on defoma. I prodded maintainers for several of these, the most outdated ones....to propose adopting the package under the team's umbrella. We'll see what happens. Quite productive week-end, indeed (and I even managed to watch the three 6 nations rugby games, plus running around 30 kilometers...doh).

Andrew Pollock: [life] Zoe at nine months

(The requisite "I have no time any more, it's 10 days late") It certainly feels like 3 months has passed since I last reflected on her development. It feels like forever. As usual, we've managed to do a fair bit in 3 months. She's doing very well. Growing nicely. Still around the 25th percentile for weight, but now up to the 50th percentile for height. We just had to upgrade her from an infant car seat to a "big kid" car seat, because she was maxing it out on height, not weight. She seems to have handled the transition okay, but we haven't done any long car trips since making the change. She's now sitting really well, and pulling herself up into a standing position. She's cruising around on furniture a bit (and sporting various bruises to show for it). She started crawling at six and a half months, and now there's no stopping her. She's into everything. No more teeth have appeared yet. Her top teeth have been looking like they want to do something for ages. I think, given a recent uptick in fussiness, their appearance may be imminent. On the food front, she's eating all sorts of things. We've got a few infant/toddler cookbooks, so we still are predominantly feeding her either a combination of pureed fruits and vegetables, or a few pureed dishes that I've prepared (mainly vegetable stews or risotto). She also enjoys bread, toast and has taken to Vegemite on toast, like a good little Aussie. The other night we ate out at our local Italian restaurant, and she had some garlic bread and some penne pasta with marinara sauce. She's definitely enjoying finger food. We went back to Australia for a couple of weeks recently, and she handled the flights extremely well, and had an absolute ball back in Australia. She'd just started sleeping through the night a few times before we left for the trip, and didn't sleep as well while we were in Australia, but got back into the swing of things in under a week of getting back to the US. She's so much fun at this age. She laughs, she plays. She gets so excited when I get home from work in the evenings. I love her and being a Dad so much. Zoe at 9 months

Thorsten Glaser: FOSDEM was a blast!

I just need to work more on bilocality. While I did find two geocaches, one at the South/Noon Train Station (taalverwarringen ), one in the buurt of the University, I did manage to miss the AW building completely and utterly. Wow. Except, that Haiku guy came over to talk for a bit (nice). And I drew. An Atari logo with swirl, for that weird stuff I recently have been found doing. More mksh-current news coming soon, stay tuned. In the meanwhile, I met bonsaikitten IRL (at FOSDEM, yes, too) who kindly made a live ebuild , i.e. a source package building -current. Finally let s say a big thank you to the person mostly manning our booth, gecko2, and to Benny for talking to people, getting That Other Packaging Thingy working, and pimping the website a bit.

12 February 2011

Tim Retout: Gnash and cookies

A new release of Gnash, version 0.8.9, is due in the near future. Plenty of bugs have been fixed, but some users are still going to have problems playing YouTube videos. Here's a short explanation. At some point last year, YouTube started setting HTTP cookies in your web browser, to keep track of which of their video servers is nearest to your machine. This lets them provide a better experience for you (I guess). Here's a diagram of what goes on in your browser: Diagram showing browser fetching HTML and SWF files, and Gnash core fetching FLV video independently. As of Gnash 0.8.8, a workaround was added, calling an NPAPI function NPN_GetValueForURL to ask the web browser for the relevant cookies. New diagram: Diagram showing Gnash core asking browser for cookies, and still fetching FLV video independently. The downside is that this function was only added in NPAPI version 1.9. This means: What does Adobe's plugin do? I imagine it's something like the following: Diagram showing browser making all HTTP requests, and Gnash core requesting data through the Gnash plugin So, the good news is, this problem should almost certainly get fixed over the coming Debian release cycle, if only because all the browsers will get updated. In the meantime, disabling cookies (and removing stale ones from YouTube) is a workaround.

David Welton: Book Review: Start Small, Stay Small, A Developer's Guide to Launching a Startup

<iframe frameborder="0" marginheight="0" marginwidth="0" scrolling="no" src="http://rcm.amazon.com/e/cm?lt1=_blank&amp;bc1=000000&amp;IS2=1&amp;bg1=FFFFFF&amp;fc1=000000&amp;lc1=0000FF&amp;t=dedasys-20&amp;o=1&amp;p=8&amp;l=as4&amp;m=amazon&amp;f=ifr&amp;asins=B003YH9MMI" style="width: 120px; height: 240px; float: left; margin-right: 10px;"></iframe> I tend to be a sucker for business books, to the point where I created (and later sold) a site to discuss them. Part of the motivation for creating that site was that a lot of them tend to contain one good idea, and an inordinate amount of fluff. This book does not - it's good material that could not easily be summarized because it's full of information. I think it's actually one of the more relevant books I've ever read in that, for my situation, the idea behind it really speaks to me. I work as a consultant during the days, and I like it a lot. Rather than working on the same old thing year after year, I get to meet new people, new clients, new situations, and help them out, which is motivating. However, consulting has its downsides too, in that it doesn't create a great deal of long-term value. Once you've finished up a project, it's on to the next one, or no money comes in. I'm also a bit older and more set in my ways: I did my time in the California Bay Area, and I don't relish going back and working like mad on a "Real Startup" with VC backing, crazy hours, and having the thing consume my life. The idea behind "Start Small, Stay Small" is to find and create really niche products: stuff that will earn you some extra money as a developer, but also niches that are small enough to not really be interesting to larger companies that need a lot of income to justify a forray into a particular market segment. This, then, becomes your 'competitive advantage': Microsoft, or even 37 Signals, simply isn't going to chase after a market that is worth 20,000 dollars a year. And yet for someone working on their own, if you manage to set up something that brings in that money, and mostly automate it so that it's not a second job, it's a tidy extra bit of money. Several projects like that might even be enough to live on, depending on your lifestyle. With that in mind, the authors, Rob Walling and Mike Taper, delve into the details of how to go about doing so. The whole thing is done under the assumption that you don't have a lot of time or money to throw at things that don't bring in concrete results in relatively short order. Various subjects discussed in detail include how to find a niche, how to create a sales web site, how to measure market demand, conversion rates, how to productively outsource less critical portions of your business, and much more. They also discuss what sorts of numbers to look at for various aspects of the business, and anchor the discussion with real numbers for many things, rather than just giving you a hand-wavy phrase that's not that useful in the real world. It's not a 'timeless' book as all the concrete numbers and techniques reference technologies, sites, and the market dynamics of 2011, but after all, that's part of what makes it good. Other things I didn't like so much were being sold on their for-pay "micropreneur community", and the relatively high price of the book but I think it's worth it given the real advice you get. If you don't like marketing, and think that products succeed or fail on their merits alone, of course the book will leave you cold, but of course you're wrong about that anyway!

Wouter Verhelst: Ten years of Debian

My first ever Linux installation was done in the late nineties 1998 or thereabouts but was a RedHat 4.5 installation rather than a Debian one. The reason for that was fairly simple: the Infomagick sixpack CD set that I'd bought contained RedHat, Debian, and Slackware, but the RedHat installation was the only one that could be installed directly from CD the other two required me to write floppies and boot from those to start the installation, and I wasn't very fond of that idea. It was only a few years and a few broken RedHat upgrades later that I saw the light and considered trying out this Debian thing that some of my classmates were talking about. The fact that I'd just bought my own computer (rather than having to compete for time with my siblings on my parents' computer) was a good reason to do a fresh Linux installation. I'd been planning to install Linux From Scratch, but as what was still known as the LFS HOWTO told me you'd need a working Linux installation to do that, I considered my options. Since I'd developed a strong dislike of RedHat, I wasn't interested in doing another RedHat anymore. So, I downloaded the most recent version of Debian at the time (Potato Test Cycle III), wrote it to a CD, and installed. I've probably still got the CD lying around somewhere. A few months later, I found these "Linux Gazette" packages in the archive, with the latest packaged issue being 47, but the latest upstream version being much higher. Trying to figure out what was going on, I mailed the maintainer, Adrian Bridgett, who encouraged me to take over maintenance. Thus began my life of actively contributing to Open Source software. In November 2000, I applied to become a Debian Developer. In January 2001, Martin Michlmayr was assigned to be my AM. And in early February 2001, now just over ten years ago, I'd become a Debian Developer. Yes, that was fast, and no, I probably wasn't really ready yet, at the time. Originally, I only cared much about these Linux Gazette packages. But, as time went on, I started looking around, too. A friend passed me an old Macintosh Centris 610. As I tried to install Debian on it, I found that it didn't actually run very well. This turned out to be due to it having a broken 68LC040 processor, so I bought me another m68k-based mac, one with a full 68040 processor (a Centris 650). Thus I became involved in the m68k port and buildd maintenance. As these old machines came with 80MB or 250MB SCSI hard disks of which I had none laying around, and a then-recent Debian installation had minimum requirements of about 200MB, I was in need of network storage to be able to do anything useful with the mac. NFS didn't work as expected; the RTC implementation on m68k mac hardware was reverse engineered and didn't work too well at the time, which meant that the clock would run slower if the machine was under load, and that in turn would mean that make would get confused about timestamps, since they would suddenly appear to originate from the future (in NFS, it's the server that assigns time stamps, not the client). There was a simple solution, however; Pavel Macheck had written this neat 'Network Block Device', which would let the client do its own filesystem on network storage. Only it wasn't packaged; but then, that was easy to fix. Thus I started maintaining the single piece of software that I've worked the most on, to date. A few years later, Pavel lost interest in maintaining NBD, and handed over upstream maintenance to me and maintenance of the kernel side to Paul Clements. Thus began my life in upstream work. And while I originally joined Debian with the intent of using it as a learning experience and stepping stone on my way to more "important" free software, I found that it wasn't as satisfying as was my work for Debian. Over the years, there's been this duality where I've felt like I was doing too much and not enough at the same time. Too much, because the things I was doing would eat up much of my spare time, leaving little time left for other hobbies. Not enough, because I witnessed other people doing much more for Debian than I did, and I wanted to make a difference. As the years passed by, many things have changed. Not only in Debian, but also besides it. I became an independent contractor, focusing mostly on supporting people in using Debian (although I support them with other distributions, too). The importance of a port went from 'something which these weird porter people are doing, and that we should probably help them with if it doesn't work, but is their problem really' to 'something that I really really really have to make sure works for my packages', and back for the port that I cared about most. After several years of trying, I finally managed to explain to my parents what this Debian thing is, why it matters, and what my role in the whole thing is. We did a few releases, some taking longer than I would've liked. People joined the project, and left again. Some of my friends died. My fame in the project rose, even though I wasn't aware of it initially; and thus I was rather surprised when someone asked me whether I was "the Wouter Verhelst" at a key signing party. Recently, I've started looking back, and considered the things which Debian has meant to me. Ten years ago, I was 22, still in college, and had way too much spare time on my hands. I'd recently gotten my first Internet installation, and all these online communities were very new to me. Yes, that was all probably rather late. Debian has changed my life in many ways; it has allowed me to meet various kinds of people, both online and in meatspace. I've been to Helsinki, Edinburgh, Mar del Plata, C ceres, and New York City, places that I might otherwise not have visited. Each of these trips was an incredible experience that I have fond memories of; and while the most fond ones originate from Helsinki, I cherish the memories of each of these trips as some of the best trips I've ever done. Working on Debian has forced me to learn about the inner workings of a Linux-based system, which is knowledge that has helped me tremendously professionally, too. And finally, working on Debian has given me a unique perspective on this whole FOSS community, which has helped shape my ethics and my view of the world. While I believe that I would've subscribed to most of that ideology at any rate, I'm not sure that the details of my beliefs and understanding would've been exactly the same. And while I don't agree on every position that the project subscribes to as a whole, I do believe that the philosophies that lie at the core of this project contain just the right mix of pragmatism and ideology that makes it possible for our project to thrive in a changing world of not only a growing group of people who subscribe unconditionally to the free software ideals, but also business people who care mostly about money. Over the years, somehow I moved from "one of the recent batch of new Debian Developers" to "someone who's been with the project longer than most". It still feels weird to see people shut up because you've built up a reputation in some area, and you give your gut opinion on some subject without researching it too much. I try not to let that happen too often. Today, ten years and just over a week ago, my life as a Debian Developer started, and it would change the way I looked at the world, the things I would do in my spare time, and the people I would meet. I wouldn't have it any other way. Thanks, Debian, for what's been a blast; may the next ten years be as inspiring to me and everyone as the past ten!

Erich Schubert: Joerg Schilling stilly spreading FUD

J rg Schilling is still spreading FUD (currently on an openSuSE list):
There is a social issue with Debian that attacks OSS projects _because_ they use the GPL. Please do not follow these attacks without asking a lawyer.
The removal of cdrecord has been the best reaction to these issues, since apparently working with him is impossible. In this thread, he again manages to accuse everybody else of lying and being incompetent. This clearly shows that you cannot work with him, and the only viable way is ignoring him as far as possible.
It also speaks of a hurt ego in a probably narcisstic person (after all, he seems to think everybody else is incompetent and lying - but I am not a psychologist, so this is not a diagnosis!).
Let me just point out one fact:
By not shipping his current cdrecord, we can obviously not violate any even just potentially invalid license. The way Debian is dealing with this issue is legally undoubtedly correct: obviously, we are not oblieged to include his software.
On the long run, I assume that Debian will also get rid of cdrkit/wodim. In my opinion, this is just a legacy code until we can switch to libburnia entirely, and we should now try to drop cdrkit/wodim as well in order to ship "wheezy" without it.
Since we cannot work with J rg, the only sane way is to try to completely remove any code he wrote from our systems so we have no reason whatsoever to communicate with him.
cdrecord is dead, long live libburnia.
I expect to see lots of FUD from him in the post comments any time soon ... but I do not care: I don't use his software. My current laptop doesn't even have a CD drive ... and despite his claims, the Debian versions of cdrecord and wodim worked perfectly for me when I was still burning CDs.
My only advice to you is to ignore him as far as possible. It will not get you anywhere, it is just a waste of time. In fact, I shouldn't have wasted the time it took me to write this blog post.

10 February 2011

Marco Silva: Using Horizontal Sharding in SQLAlchemy to display multiple DBs

My problem was: I had a number of databases generated in different machines and I wanted to query them as if they were one, using the database the data came from as a field while querying and while showing results. The databases are SQLite3 files, generated using SQLAlchemy in a Python program. I solved this by using SQLAlchemy, which was good because I could use the same ORM mapping that the program used. I noticed that the Horizontal Sharding SQLAlchemy extension would fit well the problem, although not perfectly. I had to make some changes in some classes of this extension, and now it works fine. It was possible to filter the data using database as a criteria, but I couldn't get the database information from each line of a query result. I made a simple patch to SQLAlchemy, which wasn't likely to be introduced in the distribution, but worked for me, and sent it to its bug tracker. The change was included in SQLAlchemy in a very different fashion, as expected, but since I'm using the released version from SQLAlchemy, I kept on using my version of the patch. I don't want to do direct changes in SQLAlchemy source code, so I made the change in my program:
class ShardedSessionShardId(ShardedSession):
    def __init__(self, *args, **kwargs):
        super(ShardedSessionShardId, self).__init__(*args, **kwargs)
        self._query_cls = ShardedQueryShardId
class ShardedQueryShardId(ShardedQuery):
    def _execute_and_instances(self, context):
        if self._shard_id is not None:
            result = self.session.connection(
                            mapper=self._mapper_zero(),
                            shard_id=self._shard_id).execute(context.statement, self._params)
            news = list(self.instances(result, context))
            for new in news:
                new.shard_id = self._shard_id
            return iter(news)
        else:
            partial = []
            for shard_id in self.query_chooser(self):
                result = self.session.connection(
                            mapper=self._mapper_zero(),
                            shard_id=shard_id).execute(context.statement, self._params)
                news = list(self.instances(result, context))
                for new in news:
                    new.shard_id = shard_id
                partial = partial + news
            # if some kind of in memory 'sorting'
            # were done, this is where it would happen
            return iter(partial)
create_session = sessionmaker(class_=ShardedSessionShardId)
Another problem is that I had to make each result be included in the query, even if two results from different DBs have the same primary key. I achieved this by changing two classes: WeakInstanceDict, and Mapper. For using the new WeakInstanceDict, I had again to change the ShardedSession variation:
class WeakInstanceDictNoIdentity(WeakInstanceDict):
    def add(self, state):
        # if state.key in self:
        #     if dict.__getitem__(self, state.key) is not state:
        #         raise AssertionError("A conflicting state is already "
        #                             "present in the identity map for key %r"
        #                             % (state.key, ))
        # else:
            dict.__setitem__(self, state.key, state)
            self._manage_incoming_state(state)
class ShardedSessionShardId(ShardedSession):
    def __init__(self, *args, **kwargs):
        super(ShardedSessionShardId, self).__init__(*args, **kwargs)
        self._query_cls = ShardedQueryShardId
        self._identity_cls = WeakInstanceDictNoIdentity
        self.identity_map = self._identity_cls()
To start using the new Mapper, I simply replaced each call to mapper with MapperNoIdentity:
class MapperNoIdentity(Mapper):
    def _instance_processor(self, context, path, adapter,
                                polymorphic_from=None, extension=None,
                                only_load_props=None, refresh_state=None,
                                polymorphic_discriminator=None):
        """Produce a mapper level row processor callable
           which processes rows into mapped instances."""
        pk_cols = self.primary_key
        if polymorphic_from or refresh_state:
            polymorphic_on = None
        else:
            if polymorphic_discriminator is not None:
                polymorphic_on = polymorphic_discriminator
            else:
                polymorphic_on = self.polymorphic_on
            polymorphic_instances = util.PopulateDict(
                                        self._configure_subclass_mapper(
                                                context, path, adapter)
                                        )
        version_id_col = self.version_id_col
        if adapter:
            pk_cols = [adapter.columns[c] for c in pk_cols]
            if polymorphic_on is not None:
                polymorphic_on = adapter.columns[polymorphic_on]
            if version_id_col is not None:
                version_id_col = adapter.columns[version_id_col]
        identity_class = self._identity_class
        def identity_key(row):
            return identity_class, tuple([row[column] for column in pk_cols])
        new_populators = []
        existing_populators = []
        load_path = context.query._current_path + path
        def populate_state(state, dict_, row, isnew, only_load_props):
            if isnew:
                if context.propagate_options:
                    state.load_options = context.propagate_options
                if state.load_options:
                    state.load_path = load_path
            if not new_populators:
                new_populators[:], existing_populators[:] = \
                                    self._populators(context, path, row,
                                                        adapter)
            if isnew:
                populators = new_populators
            else:
                populators = existing_populators
            if only_load_props:
                populators = [p for p in populators
                                if p[0] in only_load_props]
            for key, populator in populators:
                populator(state, dict_, row)
        session_identity_map = context.session.identity_map
        if not extension:
            extension = self.extension
        translate_row = extension.get('translate_row', None)
        create_instance = extension.get('create_instance', None)
        populate_instance = extension.get('populate_instance', None)
        append_result = extension.get('append_result', None)
        populate_existing = context.populate_existing or self.always_refresh
        if self.allow_partial_pks:
            is_not_primary_key = _none_set.issuperset
        else:
            is_not_primary_key = _none_set.issubset
        def _instance(row, result):
            if translate_row:
                ret = translate_row(self, context, row)
                if ret is not EXT_CONTINUE:
                    row = ret
            if polymorphic_on is not None:
                discriminator = row[polymorphic_on]
                if discriminator is not None:
                    _instance = polymorphic_instances[discriminator]
                    if _instance:
                        return _instance(row, result)
            # determine identity key
            if refresh_state:
                identitykey = refresh_state.key
                if identitykey is None:
                    # super-rare condition; a refresh is being called
                    # on a non-instance-key instance; this is meant to only
                    # occur within a flush()
                    identitykey = self._identity_key_from_state(refresh_state)
            else:
                identitykey = identity_key(row)
            # instance = session_identity_map.get(identitykey)
            # if instance is not None:
            #     state = attributes.instance_state(instance)
            #     dict_ = attributes.instance_dict(instance)
            #     isnew = state.runid != context.runid
            #     currentload = not isnew
            #     loaded_instance = False
            #     if not currentload and \
            #             version_id_col is not None and \
            #             context.version_check and \
            #             self._get_state_attr_by_column(
            #                     state,
            #                     dict_,
            #                     self.version_id_col) != \
            #                             row[version_id_col]:
            #         raise orm_exc.ConcurrentModificationError(
            #                 "Instance '%s' version of %s does not match %s"
            #                 % (state_str(state),
            #                     self._get_state_attr_by_column(
            #                                 state, dict_,
            #                                 self.version_id_col),
            #                         row[version_id_col]))
            # elif refresh_state:
            if refresh_state:
                # out of band refresh_state detected (i.e. its not in the
                # session.identity_map) honor it anyway.  this can happen
                # if a _get() occurs within save_obj(), such as
                # when eager_defaults is True.
                state = refresh_state
                instance = state.obj()
                dict_ = attributes.instance_dict(instance)
                isnew = state.runid != context.runid
                currentload = True
                loaded_instance = False
            else:
                # check for non-NULL values in the primary key columns,
                # else no entity is returned for the row
                if is_not_primary_key(identitykey[1]):
                    return None
                isnew = True
                currentload = True
                loaded_instance = True
                if create_instance:
                    instance = create_instance(self,
                                                context,
                                                row, self.class_)
                    if instance is EXT_CONTINUE:
                        instance = self.class_manager.new_instance()
                    else:
                        manager = attributes.manager_of_class(
                                                instance.__class__)
                        # TODO: if manager is None, raise a friendly error
                        # about returning instances of unmapped types
                        manager.setup_instance(instance)
                else:
                    instance = self.class_manager.new_instance()
                dict_ = attributes.instance_dict(instance)
                state = attributes.instance_state(instance)
                state.key = identitykey
                # manually adding instance to session.  for a complete add,
                # session._finalize_loaded() must be called.
                state.session_id = context.session.hash_key
                session_identity_map.add(state)
            if currentload or populate_existing:
                if isnew:
                    state.runid = context.runid
                    context.progress[state] = dict_
                if not populate_instance or \
                        populate_instance(self, context, row, instance,
                            only_load_props=only_load_props,
                            instancekey=identitykey, isnew=isnew) is \
                            EXT_CONTINUE:
                    populate_state(state, dict_, row, isnew, only_load_props)
            else:
                # populate attributes on non-loading instances which have
                # been expired
                # TODO: apply eager loads to un-lazy loaded collections ?
                if state in context.partials or state.unloaded:
                    if state in context.partials:
                        isnew = False
                        (d_, attrs) = context.partials[state]
                    else:
                        isnew = True
                        attrs = state.unloaded
                        # allow query.instances to commit the subset of attrs
                        context.partials[state] = (dict_, attrs)
                    if not populate_instance or \
                            populate_instance(self, context, row, instance,
                                only_load_props=attrs,
                                instancekey=identitykey, isnew=isnew) is \
                                EXT_CONTINUE:
                        populate_state(state, dict_, row, isnew, attrs)
            if loaded_instance:
                state._run_on_load(instance)
            if result is not None and \
                        (not append_result or
                            append_result(self, context, row, instance,
                                    result, instancekey=identitykey,
                                    isnew=isnew)
                                    is EXT_CONTINUE):
                result.append(instance)
            return instance
        return _instance
I had to include some auxiliary definitions to make the rewrites work:
_none_set = frozenset([None])
_runid = 1L
_id_lock = util.threading.Lock()
def _new_runid():
    global _runid
    _id_lock.acquire()
    try:
        _runid += 1
        return _runid
    finally:
        _id_lock.release()
It would be good to be able to set these identity requirements as a parameter. My last problem was selecting more than one database to search. setshard only worked for one, so I created a new field in query, called shards, and checked for it on querychooser:
def query_chooser(query):
    try:
        return query.shards
    except AttributeError:
        pass
    return tcs.keys()
So, when I want to look only in a list of shards, I set this field. I'm aware that this is not a recommended python idiom, but, well, it works fine.

Rapha&#235;l Hertzog: Best practices when sponsoring Debian packages

Sponsoring a package means uploading a package for someone else (usually a new contributor starting out as package maintainer). This is an activity reserved to Debian Developer who are supposed to be knowledgeable about packaging. This article tries to document the process to ensure the sponsor is doing a reasonably good job according to Debian s standards. Sponsoring a package in the Debian archive is not a trivial matter. It means that you verified the packaging and that it is of the level of quality that Debian strives to have. Let s have a look to what you can and should do when you re sponsoring a package. Sponsoring the initial upload Sponsoring a brand new package into Debian requires a thorough review of the Debian packaging. Building the package and testing the software is definitely not enough! You should open every file in the debian directory and look out for potential problems. Here s a checklist that you can use to perform the audit: If the audit did not reveal any problem, you can upload the package. But remember that even if you re not the maintainer, the sponsor is still responsible of what he uploaded to Debian. That s why you re encouraged to keep up with the package through the Package Tracking System. Sponsoring an update of an existing package You will usually assume that the package has already gone through a full review. So instead of doing it again, you will carefully analyze the difference between the current version and the new version prepared by the maintainer. If you have not done the initial review yourself, you might still want to have a more deeper look just in case the initial reviewer was sloppy. To be able to analyze the difference you need both versions. Download the current version of the source package (with apt-get source) and rebuild it (or download the current binary packages with aptitude download). Download the source package to sponsor (usually with dget). Read the new changelog entry, it should tell you what to expect during the review. The main tool you will use is debdiff, you can run it with two source packages (.dsc files), or two binary packages, or two .changes files (it will then compare all the binary packages listed in the .changes). If you compare the source packages (excluding upstream files in the case of a new upstream version, for example by filtering the output of debdiff with filterdiff -i '*/debian/*'), you must understand all the changes you see and they should be properly documented in the Debian changelog. If everything is fine, build the package and compare the binary packages to verify that the changes on the source package have no unexpected consequences (like some files dropped by mistake, missing dependencies, etc.). You might want to check out the Package Tracking System to verify if the maintainer has not missed something important. Maybe there are translations updates sitting in the BTS that could have been integrated. Maybe the package has been NMUed and the maintainer forgot to integrate the changes from the NMU in his package. Maybe there s a release critical bug that he has left unhandled and that s blocking migration to testing. Whatever. If you find something that she could have done (better), it s time to tell her so that she can improve for next time. And so that she has a better understanding of her responsibilities. If you have found no problem, upload the new version. Otherwise ask the maintainer to provide you a fixed version.
This article will be repurposed to enhance the Debian Developers Reference, hopefully leading to a fix for the wishlist bug #453313. Click here and help me fix more of those. You re also welcome to suggest improvements in the comments. Are there other checks that you re always doing? Do you have some handy tip to make it easier to review a package?

7 comments Liked this article? Click here. My blog is Flattr-enabled.

Adrian von Bidder: Freedom

LWN Coverage of Eben Moglen's FOSDEM keynote. A very thoughtful article on freedom and how to get there. While we can, technically, build these free systems that Eben Moglen talks about, history has shown that we won't. People don't care until it's too late until the police is on their doorstep with an arrest warrant (if the regime cares about such details at all.) So it's up to the small minority of people who actually cares and is prepared to pay the price (in money or in being isolated by not being on Facebook or whatever) to create systems that are both Free and also appealing to the uneducated masses. People will move to Free systems only when they're much cheaper and also offer more value as perceived by them, in terms of features, or coolness or whatever. Bling. We're almost there in terms of software (Firefox managed to get noticeable market share, and people at least talk about OpenOffice / LibreOffice.) We're nowhere close in terms of networks and content, though. Wikipedia and Openstreetmap are the rare exceptions, but there's not much in terms of social networking, searching, messaging, collaboration platforms etc.: all firmly in corporate hands. I'm not sure that Moglen's Freedom Box idea will succeed either: so far, I can't see the must have element for people who don't care about these things that might change the game.

Russell Coker: LCA2011, Harassment, etc

The conference LCA 2011 had an anti-harassment policy [1] which was violated by a keynote speech. The speaker and the conference organisers apologised, but of course the matter didn t end there.Discussion continued on the lca-chat list (for conference delegates) [2], on the Linux-aus list (for members of Linux Australia the parent body of the LCA conference) [3], and in some blog posts.There is also some discussion on an LWN article that is linked from an ITWire article [4].I think that the policy was reasonable and from all the descriptions it seems to have worked reasonably well. With such things there are always possibilities to tweak things, so probably there will be future policies which are better in some ways, but it seemed to do the job. The way that the LCA organisers handled the situation was appropriate. In the discussion there were some comments with logical failures that I think need further analysis, I ll summarise them one per paragraph with the heading being a para-phrase of the claim.Is it Offensive?A particularly relevant blog post is Skud s post about avoiding the use of the word offense [5]. In the various discussions about the speech in question most of the people who disapprove of the erotic images don t use the word offense , this is presumably due in part to the influence of Skud s post. This hasn t stopped people claiming that the debate is about whether the images are offensive, I m not sure if this is a deliberate straw-man attack or just cluelessness.The anti-harassment policy does use the word offensive in two places, I think that this was a mistake but it doesn t detract from the overall meaning of the document.Is it Harassment?There was some discussion about whether the actions in question were harassment. Wordnet s definition of harassment includes the act of tormenting by continued persistent attacks and criticism . It seems unlikely that any of the people in the audience who objected to the erotic content in the lecture slides had never seen unwanted erotic material before. So I think that it s worth considering this incident as just another entry in a list of similar incidents that some of the delegates have experienced, and thus as a continuation of persistent attacks IE harassment. Melissa McEwan s post about the variety of harassment that she has received from men is worth reading in this regard [6].I think that a reasonable analogy here is the school bullying campaigns that were experienced by many members of the Linux community when they were younger. School bullying in most cases is not about a small number of extreme incidents, but about a large number of small incidents each of which when considered independently can be rationalised as something that isn t significant (excusing such incidents independently is what allows bullying to be rife in most schools). In many cases of high school bullying the victim is blamed for supposedly over-reacting after a reaction is compared to some small incident at the end of a long harassment campaign, some of the criticism of the Geek Feminists seems to echo this pattern.It seems to me that some of the more dismissive comments which demonstrated a lack of regard for the experiences of other people can reasonably be considered as harassment too (which is also something that Melissa McEwan mentions). Note that I am specifically not advocating that the discussion be shut down, merely that the people who claim that it s only the (supposed) opinion of the majority that matters are part of the problem. However the fact that the apology for the talk received applause from the majority of the audience seems to indicate that the majority is in fact in favor of the anti-harassment policy.Derald Wing Sue, Ph.D. and David P. Rivera (a doctoral candidate in counseling psychology) have written a couple of interesting short articles about this for Psychology Today. Bullying and Microaggressions describes bullying as more than physical violence and also discusses adult bullies [7]. The Power to Define Reality describes the way that the experiences of people who lack power can have the reality of their experiences denied [8] this one really relates to some of the discussions about harassment.But it s Legal!It has been claimed that the legal system works well in Australia and that Australian law should be the only necessary guide to content. A trivial counter-case that was noted in the discussion is the fact that pure sales presentations are not accepted at LCA and such presentations are certainly legal! There is a good precedent for prohibiting things that are legal as part of the conference speaker agreement.More generally the legal system changes slowly and still infringes on what many people in our community regard as basic human rights. There is no reason why an Australian conference should have as it s standards the bare minimum that is required by Australian law.It was pointed out that workplace social norms translate well between cultures, they are usually more stringent than Australian law requires and Australian workplace law is a lot more stringent than the laws relating to conferences and other public events. It seems to me that a presentation which would result in a visit from HR if given at the office shouldn t be regarded as suitable for a conference such as LCA.But there is a Balance of Men and Women in Erotic Pictures!The complaints are not about a lack of balance in the erotic material, but it s presence there at all. Defending the slides on the basis that there was a supposed balance of male and female misses the point that most people just want no erotic material in presentations at conferences.Also it seems to me that if there are pictures which aren t offensive then the way to demonstrate this would be to publish them and say look, they aren t offensive . If it takes 600 words in a blog post to justify the use of some images then that alone seems to be evidence that the images were poorly chosen.But the talk was EffectiveSome of the people who have commented on this issue mentioned that they couldn t remember what was said when the images in question were displayed. When images from the talk are remembered and the main content of the talk isn t that seems to be a failure of the talk.When a major sponsor of the conference complains and requests that the talk video never be published that also seems like a major failure of the talk.I think that the effective talks are ones that educate people and inspire them to do something positive and useful. A talk that inspires a discussion about whether the speaker deserves censure doesn t seem effective.There are claims that there is no way the talk could have made the point as well if it wasn t for the images in question. But I can t believe that someone who is capable enough to get awarded a keynote speaking position at a conference such as LCA is incapable of finding other images to make the same point.But Similar Images are on MTVWhen people want MTV content they can watch MTV.Why Can t we just try Educating Men?It was claimed that education works in dealing with such issues in corporate environments and sporting clubs. My observation of the corporate environment is that such training must be extremely rare in Australia, the Netherlands, and probably the UK due to the fact that none of my employers have done it. I have heard first-hand reports of diversity training from people who work in the US. I expect that the fact that people who fail diversity training in a corporate environment get a meeting with HR is a major factor in it s effectiveness.The long email discussions and blog comment threads when these incidents happen could theoretically be used as training. But when you have some men using multiple mailing lists and dozens of posts arguing without appearing to learn it seems clear that they are not about to learn anything no matter what education is offered. It seems to me that you could broadly divide the free software community into two groups, those who want to learn how to do things better (but who are unlikely to make gross errors anyway), and those who won t learn.Besides, having a keynote speaker at a major conference apologise should be educational.But Clueless Nerds Hit on GirlsI don t know why every discussion about the treatment of women ends up getting a mention of this supposed issue.But Women Could make False AccusationsIn any classification system you have to make some sort of balance between false-positives and false-negatives. If the aim is to get zero false-positives then the incidence of false-negatives will increase. So if the aim was to never ever have a false accusation brought against a man for sexual harassment then the vast majority of real harassment cases would result in no action at all.I don t think it s reasonable to expect that most women who are mistreated should suffer in silence just to reduce the possibility that men might be falsely accused.The Rape Statistics cited in the discussion may be InaccurateThere is no possible way of interpreting rape statistics to make it not be a serious problem, now matter how you analyse the available information it happens far too often and has a significant impact on the victim. Also the suggested reinterpretation of the statistics didn t contradict the claim that it is likely that there are multiple rape victims attending LCA. So interpreting the statistics in a different way to get different numbers doesn t change anything. Trying to diminish the significance of rape generally doesn t support any other arguments that you might make.There are things that you can just discuss for the heck of it and things which should be discussed with care (if at all) to avoid needlessly hurting people. In these sorts of discussions the right thing to do is to avoid debating the numbers as much as possible.I think that the numbers produced by RAINN [9] are as good as we can get.But I am very supportive of women in our communityIf you spend all your time arguing with women and don t listen to what they have to say then you really aren t supporting them.ConclusionAfter publishing this post I ll email the URL to a few of the men who helped inspire it, I will explain how disappointed I am and how I expect better from them. I encourage others to do the same.Also when such discussions happen I encourage men to vote in favor of the positions advocated by women. Writing a message that addresses points in the debate can be difficult and if the debate is rapid then you may find that every point that you might make has been made by someone else. But in that case just posting to agree with the women can really mean a lot.

9 February 2011

Jonathan Wiltshire: Point Release Security Co-ordinator

In Bits from the Security Team a few weeks ago, Thijs Kinkhorst wrote:
Since a couple of years we ve been handing off security issues of minor or
theoretical impact but for which a fix would be desirable at some point, like
certain classes of denial-of-service attacks, off to stable point updates.
We re looking for a person that wants to coordinate this: monitor the Security
Tracker for issues classified as such by the Security Team, converse with
maintainers to get such updates done and coordinate with the stable release
managers on this.
I m happy to confirm, now that it s been announced, that I am that person: point release security co-ordinator. Affected packages If your package fulfils these criteria: it is a candidate for updating in stable or oldstable, and you ll probably receive a mail from me at some point asking you to do so. You can pre-empt this mail of course, by backporting your fix to the affected versions and contacting the release team to get your fix into stable, without waiting for me. In such a case, please drop me a note with the details so I can tick your off on my hit^W candidate list. Making a stable/oldstable upload This is documented in the Developer s Reference, but to summarise:
  1. Prepare your fix, targetting stable or oldstable, and build it in an up-to-date chroot for that release
  2. Send a diff of the new package to the release team, asking for permission to upload
  3. Upload as normal, and wait for it to be included in the next point release. Meanwhile, notify the security team of your upload, if it fixes a CVE.
Tracking candidate packages I m going to start off tracking filed bugs for SPU candidates and OSPU candidates with usertags in the BTS, under my own address. In time that might be merged into an address used by the security team, but for now I m still finding a good workflow so it s much easier this way.
Comments
Point Release Security Co-ordinator is a post from: jwiltshire.org.uk Flattr

Next.

Previous.