Search Results: "reg"

16 March 2010

Debian News: DebConf Updates

Debconf 10

As previously announced, DebConf 10 will take place from August 1st to 7th, 2010, at Columbia University, in New York City, USA.

If you have an interesting proposal for an event, the Call for Contributions is already open. Submit your proposal before May 1st.

Also, if you want to request sponsorship for lodging and/or travel, you must submit your request in pentabarf before April 15th.

Debconf 11

The DebConf Team has decided to hold DebConf11 in Banja Luka, Bosnia & Herzegovina. DebConf 11 will take place in 2011 in a date to be defined.

15 March 2010

Gerfried Fuchs: stable RC Bug Squashing, Part 2

A while ago I blogged about squashing release-critical bugs in stable. Yesterday we have reached a big milestone on that area: The amount of release-critical bugs in stable dropped below 1000 (blue graph). This might sound like it's still pretty high but given that we were well over 1600 RC bugs in stable a while ago I consider this quite a success. This is though no time for rest. There is still way too many RC bugs in stable, there are definitely still a lot of bugs that just aren't affecting stable and thus can be marked as such meaning no upload needs to get done for them. I'm taking a close look at those with higher numbers and most of those seem to be validly affecting stable too so they might require a bit more work than just tagging them. Thanks to all people who helped on that area, I can just remember a few names and don't want to make anyone else also working on stable to feel singled out, though I want to thank Lucas for tagging his FTBFS rounds with squeeze sid right from the start because the packages obviously have built before due to his regular rebuilds. Thanks to all, but like said, not the time to rest. The green squeeze graph is still around 250 bugs away from us!

Gregor Herrmann: RC bugs 2010/09, 2010/10

not many closed bugs in the last two weeks, & not even one RC bug per day worked on. anyway, here's my recent list:

14 March 2010

DebConf team: DebConf10 call for contributions (Posted by DebConf10 Talks Team)

The Debconf team is excited to announce that we are now accepting proposals for contributions to this year s Debian conference! We invite you to submit proposals for how you would contribute until the deadline: May 1st, 2010, 23h59 UTC. There are many ways you can contribute, you could present a technical paper, host a panel discussion, put on a tutorial, do a performance, an art installation, a debate, host a meeting (BoFs, or Birds of a Feather Session), or other possibilities that you devise. This year we are also accepting proposals for tracks a thematic grouping around a particular subject, and people to coordinate those tracks. If you are looking for ideas of things that you could contribute, or have ideas for things that you would like to see happen at Debconf, have a look at the Contribution Brainstorm page. DebConf talks will be broadcast live on the Internet where possible, unless otherwise requested. Videos of the talks will be published on the web along with the presentation slides and papers. Step 1. Submit Proposal Proposals should provide an overview of your proposed contribution, similar to an abstract, and be no more than 600 words. Since contributions can cover a range of issues, please describe what your proposal covers, be it political (Free Software, law, advocacy, access, etc.), technical (d-i, OpenPGP, etc.), social (Debian structures and groups). It s okay to hit all three of these. Your proposal should also include some information on why you re qualified to present, or coordinate this topic. For example, you can include links to posts you have made to Debian mailing lists or other material that indicates your qualifications. Proposals and their abstracts will be accepted until May 1st, 2010, 23h59 UTC. To submit your proposal, go to http://debconf10.debconf.org/register.xhtml and register as an attendee. Once you are registered, there is a Submit a proposal link. You will see your proposal on the site. You can choose between different presentation types. If you are unsure what type you should use, please read our definitions first. If it s not there for some reason, or you have questions, please contact us immediately. Step 2. Committee Review The review committee for this year will make its decision by May 1st, 2010. All correspondence will be done by email. Step 3. Paper Submission Like last year, we are asking for papers to be submitted along with the presentations. A full paper is optional, however we strongly encourage you to submit one if possible as we intend to provide written information along with transcripts of the sessions for later viewing. Having written papers in advance will allow us to get translations done to help non-native-English speakers feel more comfortable with the topics presented. Papers are due by July 1st, 2010, and should cover the topic in reasonable depth (3 pages A4 text, plus pictures and diagrams). We will use LaTeX to typeset the proceedings. Please submit your paper formatted in LaTeX. Should you be unfamiliar with LaTeX earlier submission in plain text is also fine. Step 4. Live Presentation Longer presentations may have a break in the middle and should include workshop items that directly involve the participants. If using slides or any other presentation, please consider that your audience will consist of people who use free software, and your choice of application to prepare and display the slides should reflect this if at all possible. Fine Print Publication Rights Debconf requires non-exclusive publication rights to papers, presentations, and any additional handouts or audio/visual materials used in conjunction with the presentation. The authors have the freedom to pick a DFSG-free license for the papers themselves and retain all copyrights. The presentations will be recorded, and may be broadcast over the Internet. Any copies of the presentation will be made available under a license like the MIT/X11 license. Failure to Submit In the event that a deadline is missed we reserve the right to revoke any offer to present.

Biella Coleman: Training it up to Debconf

im_going_to_debconf10 That s right: I am taking the train uptown to my old romping ground, Columbia University, for Debconf10. I am supremely and superbly excited as I tend to really like these events, so much so, that I am also pretty involved with the organizing team. For those on the edge of a decision, here are a few thoughts that might push you toward the edge of f*ck yea, I am gonna go! So one important, one of the MOST important parts of the conf is the venue and Columbia University is a fantabulous venue. In fact, it is the only great venue, imho, in all of Manhattan so I was pretty thrilled (and relieved) to hear that it was secured. It is an oasis in an otherwise bustling city. And better, a compact oasis where everything is nestled and close to each other, within like 3 minutes walking distance of each other. Even better is that the grounds and architecture are quite beautiful and charming. There are these majestic stairs, the steps where you can soak in the sun, great lawns for tossing a Frisbee, wonderful and smaller patches of lawn behind old school red brick buildings, and statutes, one of which is great for climbing on to sit and contemplate the day or night or just life, as I used to love to do. It is a great campus for staying up late and watching the sun rise. My fondest times was when the campus was blanketed under a mountain of snow, but it is pretty nice over the summer as well. We have also secured an all night hack lab, which is a pretty essential touch. We are also thinking beyond the venue, concocting and expanding ideas for contributions, a great day trip (that will likely not entail a bus but a beach, lots of Russians, roller coasters, and even baseball, oh and lots of NY Kitsch), and there are many other ideas swirling around. We are about to release the call for contributions so you will learn more, including some information on how to brainstorm with us, so be on the look out and remember to register if you ve made your decision!

Biella Coleman: Training it up to Debconf

im_going_to_debconf10 That s right: I am taking the train uptown to my old romping ground, Columbia University, for Debconf10. I am supremely and superbly excited as I tend to really like these events, so much so, that I am also pretty involved with the organizing team. For those on the edge of a decision, here are a few thoughts that might push you toward the edge of f*ck yea, I am gonna go! So one important, one of the MOST important parts of the conf is the venue and Columbia University is a fantabulous venue. In fact, it is the only great venue, imho, in all of Manhattan so I was pretty thrilled (and relieved) to hear that it was secured. It is an oasis in an otherwise bustling city. And better, a compact oasis where everything is nestled and close to each other, within like 3 minutes walking distance of each other. Even better is that the grounds and architecture are quite beautiful and charming. There are these majestic stairs, the steps where you can soak in the sun, great lawns for tossing a Frisbee, wonderful and smaller patches of lawn behind old school red brick buildings, and statutes, one of which is great for climbing on to sit and contemplate the day or night or just life, as I used to love to do. It is a great campus for staying up late and watching the sun rise. My fondest times was when the campus was blanketed under a mountain of snow, but it is pretty nice over the summer as well. We have also secured an all night hack lab, which is a pretty essential touch. We are also thinking beyond the venue, concocting and expanding ideas for contributions, a great day trip (that will likely not entail a bus but a beach, lots of Russians, roller coasters, and even baseball, oh and lots of NY Kitsch), and there are many other ideas swirling around. We are about to release the call for contributions so you will learn more, including some information on how to brainstorm with us, so be on the look out and remember to register if you ve made your decision!

13 March 2010

Joerg Jaspert: Vacation fun

As some people know, I had a vacation in February. Only very few knew that I was heading down to Taiwan. I was leaving Germany at the 8th and back here on the 24th of February. Yes, that neatly fit this years Chinese New Years parties. Was at home for four days (and at work for one), after which I went off to this years Cebit. Until the day I arrived in Taiwan it looked like we do not have a booth there, but then everything changed while I was having a nice vacation. I really have to thank Alex here. Cebit was actually my task, but he jumped in and did all the preparatory work that was needed right in the time I started my vacation. Without that either my vacation would have been much different and less nice or we wouldn t have had a booth. I am back home since some days now, without any travel plans for the next few weeks/months to come. Though I wish I had a job (and private life) that would allow me to just go off again, ie. something I could do everywhere where there is net. Meh. Of course I did take some pictures (more than 2500) and also some notes during the trip. And having a blog that one or two people read, I think I should bore you all with it. But hey, you can skip it if you want. :) Yes, I should really take some time and work a bit on the pictures I took. Right now I only selected around seven hundred which I show off to people (and to link to from here), but they are basically just copies. While some are great in itself, many can need a bit of work here and there (cut out unimportant, blurry, colors, the usual stuff). And I also prepared multiple shots for HDR processing or to make a panorama view from, but thats something that takes time and has to wait. Just for the record, I think that this, this and this are very nice ones.
This is a public version of this text, so names and also various events and days have been cut out. Yes, people who know those in my pictures will know names, but thats no reason to feed the evil $searchengine caches more with hits for their names. Flight down, 8 Feb. Flight down from Frankfurt, using KLM so it went via Amsterdam and Bangkok (short Transit stop) to Taipei. The days before we had lots of snow and cold and all that stuff which tends to get flights cancelled, but I was lucky, none of that for me. The only slightly annoying thing was in Taipei, where KLM demonstrated how much a Business class Priority luggage sign is worth for them sometimes. We came in half an hour before schedule, but then had to wait an hour for our luggage (while all of economy luggage passed by). I think the business class Priority sign actually meant Priority to wait . The food on the flight from AMS to BGK was good, having a No Lactose Meal actually tasting well. Can t remember what it was, but better than the fish I got from BGK to TPE. Catering from Thai Airways, they do not know anything besides Fish when preparing No lactose meal and then they also manage to prepare it in the most boring way possible. Sad thing, but happened four times now, all the times I had catering prepared by them. Other than those points, no trouble at all. Immigration was done in about 20 seconds, customs didn t want to look at me, just the asians in front and behind me, all fine. Met my Travel Companion outside and off we got. First to the Taipei Main Station, where we got some food. Some rice (with a bit of meat) and red sauce, together with a soup. And a glass of tea, but that had an oily surface. Umm. Guess the cup wasn t all that clean, we both skipped that. Then I tried to get money from an ATM. First had to find one that actually wants my european credit card. And then, as usual when I travel offroad, I managed to forget my pin. Bah. Well, found an HSBC somewhere that actually takes my Maestro card, so at some point I got money (a pretty helpful thing, that is).
Wednesday, 10 Feb. First night in a new Timezone which is 7 hours before my normal one. Makes my body think I should not be allowed to sleep much. So it only allowed me some two hours before I woke up again. It didn t listen to any argument and didn t care that it was all dark and night, so I couldn t sleep more. Wellwell, got up at the same time as $TC then, we got some breakfast, egg/ham sandwich and tea. From there I set off and juggled my way through Taipei MRT over to YuanShan Station.
Confucius Temple
It is good for a visit of the Confucius Temple and also the Dalongdong Baoan Temple which is right beside it. Later on I got told there are much more impressive Confucius temples elsewhere, but it is still a good place to start off. And it just means I have one more reason for another visit. After those two temples I moved over to the Taipei Fine Arts Museum. Took about an hour to go through that museum, which again made it pretty clear to me: Some people just have too much time and money. I do not even get the setup in the entry hall, even though it looks nice, and let s not start about the rest they show there. Definitely not my thing, Fine Arts , nothing worth to waste money on, at least for me.
Having fun
So I left there after just about an hour and fought the MRT again. This time it spit me out at the Taipei Zoo station and I went through that. Appearently the nice sunny weather let some animals have fun, and that all in public. Tssk. Won t someone please think of the children?! :) Otherwise it is a pretty big area with lots of animals. Not all of them seem to be in areas that (I think) are big enough for them, though I m no expert in that. But it looked small for them. Also, while I thought it pretty well visited, many people there, I bet for Taiwanese standards the zoo was nearly empty. At least looking at their preparations for queues, like in front of the koala house, they are used to deal with like 20 times the amount of people. I count me lucky that there haven t been that many, else I would have needed to wait everywhere, which I hate. Queues are bad, mmmmmkay? As I already mentioned, the weather that day was pretty nice. Mostly sunny, only few clouds and some 25 til 29 degrees. No rain. Now that s a nice winter day.
HotPot
Dinner was scheduled for 1800h, a Hot Pot session. 5 people in total. Appears you order the meat for the hot pots from the waiter and let them bring it, but all the additional stuff you get yourself. They have a big selection of vegetables, seafood, bread/cake like stuff and whatnot you can take. I first also went there and got a small dish with stuff. But stopped right then and let the Taiwanese do the rest. Better that way, they know it. And hey, we had been 5 and they got stuff for like 35 people. :) It was a nice 2 hour session, in which we had lots of different kinds of additions to the hotpot (two pots actually, one spicy and one not spicy). I know of some meats, some vegetables, but then there also was said to be duck bladder and some other organs which they couldn t (or didn t want to? :) ) name in english. Now, db sounds worse than it is, it doesn t have a special taste and is mostly boring, I think. Of course, not liking seafood, I skipped on that, but about all the rest was nice. I like Hot Pot :) After this session the other 3 left for various reasons and $TC and me had a nice walk around/through the University, before going back to $TCs place.
Thursday, 11 Feb Had another short night as I only got to bed around 2AM, just to get up around 9AM. Additional fun that my body again insisted in being elsewhere, not accustomed to the timezone in Taiwan yet, waking me up a few times during the night.
Fishermans Wharf
Got an easypass for the MRT as that is a little better than buying a chip for every single trip and battled with MRT again, finally emerging at Danshui station. Sat a bit at the beach eating breakfast before finally starting a walk out to the Fisherman s Wharf . It is some 4 kilometers to it, made out as a bicycle path, but I just walked. Visited Fort San Domingo on the way and then went all the way up in that Wharf area, another kilometer. Got me a nice peppermint ice tea, though it was a funny process to it. The salesperson didn t speak english and my chinese is - well, limited is a too soft word to describe it. But it worked pretty well, with us pointing around on the menu and then the salesman showing me various additions, if I would want them. Like showing a milk bottle Want milk in tea? , showing sugar,
Spongebob
At the bridge in that Wharf I was approached by some Asian people, asking me to take a picture of them in front of the bridge. Fine, did it, did it again in another setting and then, when done, they asked me where I am from. When I said Germany they thanked me in German which surprised me a little. :) That is something funny anyways. Wherever I go, people look. They aren t much used to someone my size. Kids are usually more direct with pointing, grinning and sometimes crossing my way on purpose, just saying hi (some kind of test of courage, I bet). Every now and then I also get asked if they can take a picture with me. Right now there are like 20 pictures of me (that I know of) all over Taiwan that I didn t take, nor have. :) Now, who here loves Spongebob? This is the country for you! The picture only shows one small table, you can find much much more. Same goes for Hello Kitty and other such stuff.
Food!
Dinner this day was initially planned to be at some place called Maokong, but then plans changed, as $TC and others that we should meet there needed to pack for the next day. So $TC and me just went to the Shilin Night Market. Right beside it is a big food plaza. Like a thousand square meters (or probably a few more, what do I know, I haven t measured it, but it wasn t all too big) having some hundred or more little kitchens where you can get a very broad mix of things. We had cold noodles with some slightly spicy sauce and then some fresh guava juice. Tasty tasty. Though noodles with chopsticks was something new, but it worked out well enough. Later I had a noodle soup, that was something more tricky, but in the end you just need to find the right trick.
Little crowded
After food we went through the night market. Well. Parts of it. It s big. And its crowded. About the most crowded place I ve been to. Heck, half of Taiwan was in that street area. :) Didn t buy anything. The only stuff I thought interesting was a T-Shirt with a Taiwan map on it, but do try getting some in my size. Ha. Small asians. They say they have big sizes, but then its XL only (or a totally ugly color, brrr). We finished early here, as the packing for the trip starting Friday right in the middle of the night still needed to be done, and getting up at 6AM you do not want to stay up too late. But it was nice there anyways.
Friday, 12 Feb Got up early. I mean, early. 6 AM. ARGS. Not really my favorite thing to do, but as our plan said we have to get the HighSpeedRail to Kaohsiung at 7:42AM there wasn t much else to do. Pretty nice train, lots of room to sit, even in second class. Don t know business, but probably even more. And it looks fast, if I can trust the display it had we where going near 300km/h. After arrival in Kaohsiung we went out to $TC s place to get our luggage away, as it is annoying to move around with all the stuff. I got another easypass here, this time a lent one from $TC s Mother. It s fun, there are two MRT systems in Taiwan using the same technics, basically the one in Kaohsiung is built like the one in Taipei, using the same style of RFID cards (and chips for single trips). But they made them incompatible. One can not use a pass from Taipei in Kaohsiung and vice versa, for whatever reason. It s not like the two cities are very far away from each other, it would actually make sense to be compatible, but that is probably what stops them doing it. We took this Friday and also the Saturday to get around Kaohsiung, visiting several places. As the MRT in Kaohsiung has a different station design at every of its stations we did look at some of those too. Especially Formosa Boulevard , a station that has two points describing it best:
one part of the dome of light
Right outside one of the exits is a funny little cosmetic surgery. I only remember it thanks to the english name of the Doc, but somehow I don t think it was chosen wisely: Dr. Luck . . Aiik, you need be lucky to get out there looking better? Dr. Unlucky might not be good for you taking a wrong cut? :) (Yes, I know, I m crazy, don t tell me. Ok, if you really want, queue up, you aren t the first.) At one point we went out to Sizihwan, where we walked to a ferry. Actually we tried renting bikes, but this little bike shop wasn t prepared for a small german like me, not having bikes my size. (And no safe way to get the saddle of the smaller ones into a height I could start using the bike). So walk it was, not nice bike trip. Still ok, got to the ferry, got over to the other side and had a nice walk there to the/along the coast.
one more temple
We bypassed multiple temples there, at one of which a great cite came up: Temples in Taiwan are something like 7-eleven. They are everywhere. I love it. And somehow it s true, you can find one around each other corner, a little like those churches in Puebla, Mexico. In the evening we had been out for a night market. The first one was pretty boring. While having been announced in the MRT station near it to be a night market for New Years things, we found it to be about empty and very boring, so we went over to another one nearby. Wasn t as crowded as the Shilin one, and not as large, but nice. At the end of it had been a small game stand, where one could shoot balloons to get some price. I ended up getting the biggest available, as this isn t really a challenge. How anyone can miss hitting a balloon there I don t know. They are only like 3m away, not moving, you have clear view, and if you really need it even get a laser pointer on your gun. Anyways, was fun enough, I repeated shooting enough times to get the biggest available Patrick doll they had (a meter). Hrhr. Who likes Spongebob, eh? Speak up! :) I got a few nice shots of the night skyline of Kaohsiung late one of those evenings, where we went to the Dream Mall and up into the big wheel . Also had some game spots there, but turns out I m not as good throwing things at a target than I am shooting at them. We also went out to a historical sugar refinery, looking around. Of course, this being Chinese New Years eve, there haven t been that much people moving around, it was pretty empty. And the people working there all just waiting for their shift to end. But still got some pretty nice pictures from and around it. Also tasted a new kind of icecream (new for me that is), which actually has a kind of sand like feel. I like it. Like I actually liked most of the food, pretty much all the time. Of course everyone has things one does not like, but in general the food is great. Especially the largely different style compared to the european way of cooking. I ate lots of things I won t ever touch here in Germany.
Sunday, 14 Feb; Monday 15 Feb A nice two days some way out of Kaohsiung. Found out I am pretty good at losing various things: I got a bag full of (Li n w ; Syzygium samarangense; wax apple, love apple, java apple, bellfruit, see the wikipedia page for more on it) and about an hour later I totally had lost track where it ended up. The same happened with a big bag of tissues I had bought. Somehow both of the bags got feet and ended up elsewhere without telling me.
ocean place
That one evening we went out for Dinner, a big party of people. Was a place right beside the ocean, so yes, seafood. Oh yay, I don t like that too much. Happy enough there must have been a conversation going on like Hey people, this silly german doesn t like seafood much, lets get one other option too . So we had a plate with some cold chicken on. But I tried various of the seafood dishes too and liked some of them. Actually some I had tried in Germany at some point where I learned to hate them and now I liked them as I got them in Taiwan. People also seemed to think I am good at using chopsticks, though I think I am just fiddling around and be lucky when I get my stuff. But maybe it just means Hey, it looks funny what you are doing. Keep going, we like to laugh. :) ). We actually had been around this place a little earlier that day, taking a walk around it, drinking some tea, that type of thing. And got a set of nice bottles of fresh coconut juice. My first time i got it fresh, I think. But I also managed to lose track of it. I bet somewhere there is a party consisting of tissues, (Li n w ) and a bottle of coconut juice, singing classic songs like Strike, we escaped the german Lunch the other day happened to be a big family meetup. Lots of people, lots of chatting, lots of fun (I think :) ). When we arrived it started out by about all of them trying to get me to sit down somewhere. And me bad impolite german not wanting to. But there was no way to escape, so finally they won and I sat, with a number of people around me, trying to chat with me. Which is actually hard work for both sides, but every now and then gets a good laugh. But my chinese is far far away from being useful for even a small meaningful sentence, so they had to activate their english knowledge, especially for the times $TC had been elsewhere and couldn t help out translating. Somehow the job got done, they asked their questions and I hope they mostly understood my replies. Bad me, speaking too fast english sometimes. We had a nice lunch there, with the most notable part being the way I got called to it. It s interesting how much you can say by just using body language and pointing. (Oh, of course food was very good too, but that fact is one you can take as a given, even if I don t mention it again). Later on a dice game started, and after a short explanation of the rules I joined in. Took only a little, but then I got the rules, its easy. I didn t get any of the chatting that happened during the whole game, but it was very much fun and really insane (so would also fit DebConf very well) and nearly no times you do need words to understand what is going on. I like this game and they gave me a set of dices, so I can train it and come back to play again. Ha. A bit after that dice game people unpacked some of the sweets I brought from Germany. One of them being spicy. Really nicely spicy, at least for the average Taiwanese. If you happen to have been at DebConf9 and also had the luck to be one of those I offered some chocolate or wine gum to, you know what I write about. The stuff here was slightly less spicy, but still more than enough to leave a nice impression. They had lots of - well - fun trying them out, gave a good set of laughter. And ordered more for next time. Uhoh, I already know which I will take with me, but then there have to be special preparations before testing. :) I ve also got invited to come back next year. Might be I haven t made the worst impression. Well, lets see if I can take this up and if they still want me in a years time. At least my chinese should be much better by then, given another year of training. (Even if I find it actually hard to learn. For some reason its not easy for me to memorize language things, at least not chinese. Oh my, one year, I should have some 3 words more, I hope :) ). In the evening, back in Kaohsiung, $TC also told me rules of a second dice game that I had seen some people playing. Also seems like fun if played with enough people.
Tuesday, 16th Feb
35mins delay
We started the trip by taking the train from Kaohsiung to Taitung. We had been a little late for it, had to run from the MRT to the train station. Silly me took that as an opportunity to fall down a set of stairs. Only to discover, when getting to the platform, that the Taiwan Railway wanted to give me a feeling of home, delaying the train. First by 31 minutes, later it got up to 43 minutes. Somehow felt like Deutsche Bahn, being late is also their best quality. When the train finally got in we saw that we had been lucky to have seats reserved, this train was full, lots of people moving around within Taiwan that day. We got to Taitung all fine and had the Hotel send someone to pick us up at the train station, as it is a long way from the train station over to the Hotel. Got our room and left it pretty soon again to look around.
Hello Kitty
Spotted a funny little Hello Kitty car and got some food for lunch followed by a walk along the beach. Found some sculptures made of wood, where one of it seems to have some bad stomach problems
Wooden figure with stomach problems
Later on we had a nice and long walk through Taitung Forest Park. Took some time, got some nice pictures. It was getting dark when we got back into town, time for Dinner already. Yay, food. Next day a train trip to Hualien was set, but only for the afternoon, so we had time to look around. We first went through the Peinan Cultural Park, but unfortunately
Park your dog
we had no dog to park there. After that we rented a scooter to get a little farther away from the train station. After getting some fuel for it we headed to National Museum of Prehistory (which was much more interesting than the Fine Arts one earlier) and later on just drove around some time. Just looking around, without a clear direction, simply for the look around. Was fun, but too short actually. But we had to head back at some point to catch our train over to Hualien. In Hualien we again got a Taxi to the Hotel. We left that soon after arriving, Hotel rooms are boring, and it was food time again anyways. Only a little annoying, one of the few days we had rain and I can imagine something nicer than rain when I am outside. But somehow this damn weather doesn t bother to stop raining when I go out.
Thursday, 18th Feb A full day stay in Hualien, no Hotel change. Just a trip over to the Taroko Gorge.
Taroko Gorge
Which is a very nice and impressive place to visit, sure too much for a single day, I definitely have to come back here. (Well, I have to come back for multiple other reasons, but this sure is one). We took the bus to the first stop in that park, somewhere around the Leader Village Taroko. Probably a nice place for a night or ten.
Nice place?
There was a short trail we followed, getting some more pictures and impressions, but it didn t take us long until we where back in a queue for a bus, this one going all the way up to the furthest away spot a bus goes to. There we had some lunch before we wanted to start walking around. Unfortunately (for my nose) we then passed by a place selling Stinking Tofu . Other customers there said that this is not the best available, but I got a taste of it. Don t really need that version more often, even though its not as bad as it smells or the name suggests. We walked a little there and I got some more pictures before we set off to climb the stairs to the Hsiang-Te Temple of Taroko .
Hsiang-Te Temple of Taroko
Looking down from there we saw a lot of buses which was our sign to get back to the bus station, as the last bus was scheduled to get off somewhere at 3 in the afternoon. And as we didn t have a Hotel place here it is pretty helpful to catch the bus. So we queued up once more and had a bus ride back to the train station. Next time there should definitely be a night or more in some Hotel somewhere there. On the way back we took a slight detour, having another time at the beach, not enjoying the weather which insisted on a little rain and lots of wind.
Friday, 19th Feb This day saw us moving to Luodong, another place with a day of rain. Still, my gps log tells me we where moving around a lot, even though I do not have a single picture from the whole day. And as pictures are the main source of my memory ups. Well, I remember the rain, of course. I also remember that I got a steak at some place and that we bought various kinds of food (and tea and juice! :) ) on one of those markets, eating it in our Hotel room. (Rain is bad, mmmmmmmkay?!). And there was some kind of park too, in which I got a funny little game. Oh well.
Saturday, 20th Feb
Way to go
There is nothing nicer than starting a day with a fun bus trip in the morning. Going high up into the mountains. On a day where the clouds reach down to some level underground, more or less. Using very narrow streets and the usual mountain like narrow curves. While not being able to see far. We got up to Taipingshan all fine but once there we had to wait for our room to be ready. So we took a walk around. Actually not a walk. More a climb. Being a mountain place, and those mountains never having heard of those nice invention called elevator or that other named escalator, people setup stairs. Millions of them.
atmosphere
Besides the stairs it is a very nice place to walk around. We took various of the trails through the area and besides me sometimes nearly falling down (damn slippery grounds) it was great. At some point in the afternoon we got our room and also ate some instant noodles before taking another trail, one that took us some 2 hours. You should really take a look at all the pictures I took, as the few I link directly sure do not present this area right. Taipingshan starts at Picture 434 and continues up to Picture 634, but a good number of them is from the second day too.
Sunday, 21st Feb Contrary to the day before there wasn t a single cloud to spot. Ok, ok, there have been some, pictures proof it, but it was a nice sunny day. Nice start of the end of the trip through Taiwan (still one and a half day in Taipei to follow, but the trip around country is over). Of course that meant taking a lot of pictures again,
a sunny morning
and soon after breakfast we took the BongBong Train over over to the Maosing station. There are again a few prepared trails, most of which we took. We only skipped on the one going to the waterfalls, as it wouldn t have fit into our schedule. Got compensated with a pretty adventurous track with lots of nice sights following the old train tracks. Thanks to a number of landslides there is no train going anymore and thus it is a nice way to walk.
rails
It is a 1500m long walk and sometimes you really have to be careful, but it provides many great views and is a really nice trail. Got a few hundred pictures, yay. Including a proof I ve really been there. I hate pictures with me, really, they are just shit by default (maybe I shouldn t be in them?), but in total I got 11 pictures that proof I was really there and not only sent a camera (four of those are included in that gallery I always link to). We got back to the main place around noon and after Lunch we took the Bus back down to Ylan. The bus was scheduled to go at 15:30h, so we went to it fifteen minutes earlier. While we had a sunny day, clouds had started coming in at 15:00h, and at the time the bus started it was all white and there wasn t much too see for the driver again.
me was there
But it turned out that this makes no difference. The driver must have a very prominent wish to die while taking his passengers with him. Or he is insane. Or has a very important appointment somewhere else. Whatever it is, he drove down, on narrow streets, very tight curves, not too much sight and all that with a speed thats incredible. Several times a part of our bus was out over the abyss. I found it pretty fun and all that, especially as it made for a set of very nice views all over the area, and appearently another passenger thought similar, but $TC did have quite the opposite of thoughts and did not feel all that great. We arrived in Ylan one hour before schedule, which, on a 70km trip through mountain area should give a hint how it was. Took a minute off to regenerate and then we wanted to look around a bit. Having our luggage with us that is annoying so we tried to leave that at the train stations baggage service counter. Turns out the personell there is a bunch of crackmonkeys not following their own advertised opening times. Probably wanted to go home early, those lazy dolts. Fortunately the people at the ticket counter were better and exchanged our tickets and we took the Train back to Taipei a little earlier than initially planned.
Monday, 22nd Feb Bad day for all those people who had a nice vacation during Chinese New Year, they had to get back to work. I didn t have that problem and so went around Taipei a bit. Initially I had plans of going to some tourist spots, like the National Palace Museum or others, but then just skipped them all and just took a walk through various spots of Taipei. Basically just Get out of MRT station XY, walk around . The GPS track later told me that I actually covered about 15 km that way, and my feet agreed to that. At some point I did bypass a German Cuisine restaurant, called Zum Fass . Don t ask me how the food is there, I wasn t in, but still had to grin a little when reading the menu. In the evening we went out to get me some Tea to bring back to Germany. Well, some is some kind of understatement, it was lots, as much as I could pack. But good stuff, some of it is steaming right now right besides the keyboard here. Yummy.
Tuesday, 23rd Feb
lantern
As always, the worst day of any vacation. The day you have to leave and go back home. My flight was scheduled for 20:00h, so I took another half a day just looking around Taipei. Which made me even more jealous of those not having to get away, as I happened to pass by some preparations for the Lantern festival. Which happened only a few days after I got away. Next year I have to plan better and stay longer, what I saw on preparations, and that only at the Sun Yat-sen Memorial Hall definitely makes it worth it. Timing in the afternoon was very tight, I actually got the last bus that was in time for my flight. Just one later would have created some trouble, my total time on the airport was something around 30 minutes before boarding started. Just enough to get the minimum needed amount of postcards written and off to boarding. The flight back was boring. Food from TPE to BGK was a pretty good variation on No lactose , some noodles with stuff. Of course from BGK over to AMS it was fish again, same boring Thai Catering as usual. I was unable to sleep well on the flight. Somehow I woke up very often despite earplugs and eye mask. With all that I turned out to be half asleep when we arrived in Amsterdam and so I accidently took an opened half litre bottle of water with me through security. Funny, they didn t spot it. Instead they decided to make a big fuss about my camera bag, asking me in detail what I have in there, supposedly trying to check if I know what I carry. And made an even bigger show of scanning it again. And that bad liquid that those idiotic stupid laws written by brainless monkeys from our governments forbid got no notice at all. Imagine what I could have done to air safety with it! Oh my. Back in Germany my luggage got out first, so no waiting at all. I passed by work to leave some weight there (Hello boss, want some tea?) and went back home. This was also my first trip where I had a noticable jetlag after coming back. For nearly a week my damn body insisted on being in Taiwans timezone, waking me up at times I should sleep, feeling tired when I should be awake. Tssk. Conclusion of this trip: I will be back in Taiwan for sure. I don t care if you take this as a promise or threat, but I will be back! :)

12 March 2010

Dirk Eddelbuettel: RcppArmadillo 0.1.0

Besides the new RcppExamples, another new package RcppArmadillo got spun out of Rcpp with the recent release 0.7.8 of Rcpp. Romain and I already had an example of a simple but fast linear model fit using the (very clever) Armadillo C++ library by Conrad Sanderson. In fact, I had used this as a motivational example of why Rcpp rocks in a recent talk to the ACM chapter at U of Chicago which, thanks to David Smith at REvo, got some further exposure. Now this example is more refined as further glue got added. Given that both Armadillo and Rcpp make use of C++ templates, the actual amount of code in RcppArmadillo is not that large: just over 200 lines in a header file, and a little less for some testing accessor and example functions in a source file. And this makes for some really nice example code: the 'fast regression' example becomes this (where I simply removed two blocks with conditional on the Armadillo version):
#include <RcppArmadillo.h>
extern "C" SEXP fastLm(SEXP ys, SEXP Xs)  
    Rcpp::NumericVector yr(ys);			// creates Rcpp vector from SEXP
    Rcpp::NumericMatrix Xr(Xs);			// creates Rcpp matrix from SEXP
    int n = Xr.nrow(), k = Xr.ncol();
    arma::mat X(Xr.begin(), n, k, false);   	// reuses memory and avoids extra copy
    arma::colvec y(yr.begin(), yr.size(), false);
    arma::colvec coef = solve(X, y);            // fit model y ~ X
    arma::colvec resid = y - X*coef; 		// residuals
    double sig2 = arma::as_scalar( trans(resid)*resid/(n-k) );
    						// std.error of estimate
    arma::colvec stderrest = sqrt( sig2 * diagvec( arma::inv(arma::trans(X)*X)) );
    Rcpp::Pairlist res(Rcpp::Named( "coefficients", coef),
                       Rcpp::Named( "stderr", stderrest));
    return res;
 
No extra copies! Armadillo instantiates directly from the underlying R objects for the vector and matrix, solves the regression equations, computes the standard error of the estimates and returns the two vectors. Leaving us to write about eleven lines of code. Moreover, as Armadillo is well designed and uses template meta-programming to avoid extra copies (see these lecture notes for details), it is about as efficient as it can be (and will use Atlas or other BLAS where available). And, this is just one example. Rcpp should be suitable for other C++ libraries, and provides an easy to use seamless interface between C++ and R. However, we should note that (at about the last minute) we found out about some unit test failures in OS X as well as some issues in a Debian chroot -- cran2deb ran into some build issues on i386 and amd64 in the testing chroot even this 'it all works' swimmingly on our Debian, Ubuntu and Fedora build environments. A follow-up with fixes for either Rcpp and/or RcppArmadillo appears likely.

Update: The build issues seems to be with 64-bit systems and everything appears cool in 32-bit.

11 March 2010

Sam Hartman: Kerberos 1.8: Anonymous and the Cloud

The Kerberos team recently released Kerberos 5 1.8. This is the first of a couple of posts talking about features in the new release and how they significantly enhance what you can do with Kerberos. Before I get to that though, I d like to wax excited for a moment on the development process. There is much more of a community actively involved in the development process. As with the last release, MIT, Painless Security and PADL Software made contributions along with a number of others.. However the biggest change is the number of parties actively working with each other on designs, design reviews, testing and debugging. There was also a lot more real-time collaboration. It was great to see people from Sun, Debian and Redhat all actively bringing their prospectives to the discussion. My thanks to the Kerberos Consortium for pulling everyone together and for livening up the development process. Kerberos 1.8 testing releases are already available in Debian Squeeze and Ubuntu Lucid. I will be updating Debian to the final release soon, but everything discussed here should already work in both Debian and Ubuntu. I don t know about the state of other distributions, although given how heavily Redhat was involved in the process, I m sure they have 1.8 internally. One of the frustrating problems with previous versions of Kerberos was the need to key hosts before they could run Kerberized services. An administrator needed to set up a keytab and securely get it on the machine. That creates problems for automated installs of services, virtual services in the cloud, and environments where people installing servers are not the same as those running the Kerberos realm. Kerberos 1.8 still requires servers be keyed, but the need for the administrator is removed. Anonymous Kerberos provides a way for a machine to authenticate to Kerberos without an existing account. That page shows how the Kerberos administration server can be configured to permit machines to create their own keytabs. Anonymous Kerberos does require pkinit be configured and that the client know the public key of the KDC. However it is easy to build the KDC public key into an auto installer image or place it onto a USB key. I think it would be really neat to build a Debian image for Amazon EC2 that would show how easy it is to boot a virtual machine, have it register itself with a Kerberos realm, use something like remctl to request a work load and then begin serving that work load. The work load could include both clients for distributed computation or even services provided to the world, all secured by Kerberos with automatic bootstrapping. I don t know if I ll have time to put this together, but if someone were interested in helping or paying for the work it would be much more likely to happen. I believe the links above are enough that you should be able to get Anonymous Kerberos working and minimally configured. If not, feel free to send questions; I ll focus more on updating the public instructions than on providing individual help, but I m definitely interested in making this easy to use.

9 March 2010

Steve Kemp: He's so mean he wouldn't light your pipe if his house was on fire.

By the time this blog entry goes live I'll be running upon my new machine. The migration process was mostly straightfoward and followed my plan: Of course it wasn't that simple in practise, as previously mentioned the whole reason I was looking for a new machine was because the software RAID upon my old desktop was failing - One of the two drives was completely dead. As I'd feared the second drive failed partway through my migration. But thankfully I'd copied off the important stuff before then, and the backups I have off-site mostly covered everything else. (The things I lost were things I can find again such as ~/Music, ~/Videos. On the one hand they're too large to backup, on the other hand I should probably do it next time as they never change.) Unfortunately the version of X in Lenny refused to work with the GeForce G210 video card I had. To be more correct using the Vesa driver I could get a picture and a smooth desktop, but when watching videos with xine I got maybe two frames a second. Both the open nv driver and the closed nvidia driver failed to support the card - so I swapped hardware, and I'm now running with the GeForce 7300 GS card from my previous desktop. This allows me to watch videos at full-screen with no issues. (Desktop size is 1600x1200 FWIW). So now it's just a matter of tweaking the system. I've installed enough to be useful: I've still got to setup pbuilder, but that'll be done shortly, and I've installed backported packages such that I can watch youtube videos. I'm currently running firefox from lenny but I expect that will change soon enough - not least because that version fails to support "adblockplus", only "adblock". Two partitions md0 for /boot and md1 used as LVM, from which I've taken /, /home, etc:
Filesystem                      Size    Used    Avail Use% Mounted on
/dev/mapper/birthday--vol-root   9.9G     2.8G   6.6G  30% /
/dev/mapper/birthday--vol-home   22G      4.3G  16G    22% /home
/dev/mapper/birthday--vol-music  127G    43G    78G    36% /mnt/music
/dev/md0                         988M    38M    901M    4% /boot
/dev/mapper/birthday--vol-kvm    22G      8.8G  12G    44% /mnt/kvm
/dev/sdg1                        163G    143G   12G    93% /media/disk
skx@birthday:~/hg/blog/data$
skx@birthday:~/hg/blog/data$ sudo pvs
[sudo] password for skx:
  PV         VG           Fmt  Attr PSize   PFree
  /dev/md1   birthday-vol lvm2 a-   464.82G 274.51G
Update: Three irritations with this machine:
  1. As supplied the BIOS was set with "USB Mouse" and "USB Keyboard" set to "disabled". I had to beg the loan of a keyboard from a neighbour.
  2. As supplied the BIOS had virtualisation set to "disabled". Not a huge shock, but it caught me out regardless.
  3. As supplied the system had only a single SATA power connector. Annoying given that the motherboard is advertised as having "onboard RAID" and I'd purchased it with two hard drives. Happily I had a spare adaptor to hand.
I'd still recommend Novatech, but the last point had me swearing for a few minutes until I realised I did have a spare adaptor in the house. ObFilm: Chitty Chitty Bang Bang

John Goerzen: Review: The Future of Faith by Harvey Cox

I know I ve been on something of a religion streak on the blog of late, and this will be the last such post for awhile. I first hear of Harvey Cox s book The Future of Faith during an excellent hour-long interview with NPR s Diane Rehm. It was intriguing enough that I bought the Kindle edition of the book and read it. The title of the book is both very accurate and rather misleading. A lot of the book and, to me, the most fascinating parts of it focus on the history of faith. Cox s repeated point is that we are only now regaining a notion of faith that the earliest Christians had, and it is a notion that happens to be compatible with modern science and incompatible with fundamentalism and intolerance in all its stripes. Throughout this post, it should be understood that quotes or passages are from the book. Cox is so quotable that a good chunk of this review will be showing you some of his quotes, with a bit of discussion around them. I very much enjoyed this book, and highly recommend it. Faith vs. Belief
It is true that for many people faith and belief are just two words for the same thing. But they are not the same and it is important to clarify the difference. Faith is about deep-seated confidence. In everyday speech we usually apply it to people we trust or the values we treasure a matter of what the Hebrews spoke of as the heart. Belief, on the other hand, is more like opinion. We often use the term to express a degree of uncertainty We can believe something to be true without it making much difference to us, but we place our faith only in something that is vital for the way we live.
This is an important distinction, and if you stop and think about it, Cox is arguing with a common notion about faith almost from page 1. Faith isn t about intellectual assent to a set of propositions. It s about what we hold dear, what we think works for us in life. Creeds
Creeds are clusters of beliefs. But Christianity is not a history of creeds. It is the story of a people of faith who sometimes cobbled together creeds out of beliefs. It is also the history of equally faithful people who questioned, altered, and discarded those same creeds But both the doctrinal canons and the architectural constructions are means to an end. Making either the defining element warps the underlying reality of faith.
Cox here reinforces the point that Christianity isn t about believing certain statements, and it isn t even about a literal (or not) reading of the Bible. It s what C. S. Lewis talked about as the inward transformation in onesself. Creeds, such as the Nicene Creed, are rather irrelevant to him. Cox separates the history of Christianity into three periods: the age of faith, stretching from the time of Jesus only a few centuries until Constantine; the age of belief, stretching from Constantine until the 20th century; and the age of the spirit, now dawning. During the age of faith, their sharing in the living Spirit of Christ united Christians with each other, and faith meant hope and assurance in the dawning of a new era of freedom, healing, and compassion that Jesus had demonstrated. Cox makes the point that doctrinal questions just weren t all that important back then, and though differences existed, they weren t considered to be fundamental to the religion. Confidence in Christ was their primary orientation, and hope for his [earthly] Kingdom their motivating drive. Further, he argues that the age of the spirit is a return to this earlier age, albeit with modern twists.
Christianity is growing faster than it ever has before, but mainly outside the West and in movements that accent spiritual experience, discipleship, and hope; pay scant attention to creeds; and flourish without hierarchies. We are now witnessing the beginning of a post-Constantinian era.
Cox describes a person that described himself as a practicing Christian, not always a believing one. He suggests that the belief/non-believer statement is a disservice to Christianity and to other religions. He then quoted a Catholic bishop as saying: The line between belief and unbelief runs through the middle of each one of us, including myself, a bishop of the church. In other words, The experience of the divine is displacing theories about it. Faith and Belief in Bible reading
Creation myths such as the first chapters of Genesis were not primarily composed to answer the how or when questions. They are not scientific accounts, even though their poetical language, when read literally (which is always a mistake), may sound that way. Rather, they grapple with the linked mysteries of both why there is a universe and what our place in it is They are more like lyrical cantatas, symphonies of symbols through which humans have tried to make sense of their place in the world This is where the distinction between faith and belief is vital. These stories are literally not to be believed. They are, rather, artifacts human beings have crafted to try to wring some meaning from the mystery. They are not themselves the mystery.
I liken this to Michael Crichton s novel Jurassic Park. If you were to read it 1000 years in the future, it might not have been conveniently shelved above the word fiction. Would a reader in the future know that it was not meant to be a literal description of facts? I think sometimes we make this mistake when we read the Bible. Note, though, that although we all understand that Jurassic Park wasn t meant to be a literal description of facts, it seems to have been valued by quite a large part of society. And it didn t even address big mysteries. Cox argues against ridding ourselves of the creation myths, suggesting that they are an important reminder that we are similar to humans who grappled with the same big questions centuries ago as we do today.
The ill-advised transmuting of symbols into a curious kind of facts has created an immense obstacle to faith for many thoughtful people. Instead of helping them confront the great mystery, it has effectively prevented them from doing so the objective knowledge science rightly insists on is not the only kind of knowledge human beings need Faith, although it is evoked by the mystery that surrounds us, is not the mystery itself.
Constantine and the Age of Belief
One of the most devastating blunders made by the church, especially as the Age of Belief began, was to insist that the Spirit is present only in believers.
Cox spends a lot of time covering the very interesting topic of how and why the church moved to the Age of Belief. His central thesis is that money, power, and prestige were primarily responsible, and that an unrighteous collusion between bishops and Constantine, each using Christianity for their own purposes, finally made it happen. This is very interesting stuff, but this post is too long already, so I will not spend a lot of time on it. I found the Council of Nicea to be particularly interesting, considering that the Nicean Creed came about partially by exile or execution of those Christians that disagreed with it. Cox also points out that there never was a single early Christianity ; there were many, and the idea of heresy was unknown.
The time is ripe to retrieve the term Way for Christianity and followers of the Way for Christians. It is at once more accurate, more original, and more contemporary than believers.
To the future Cox describes attending a meeting of the church in Hong Kong in 2003, and uses it as a metaphor for the future of faith:
Their idea of interfaith dialogue was to work with their fellow Asians of whatever religion to advance the Kingdom that Jesus had inspired them, as Christians, to strive for, regardless of what the others called it. They were neither fundamentalist nor modernist. They seemed more attuned to the element of mystery at the core of Christianity and to its vision of justice. They were also clearly impatient with many of the disputes that preoccupy the different wings of the American churches.
Conclusion I found this book to be both enlightening and informative. I highly recommend it, even if you disagree with some of Cox s conclusions. It is a fascinating view into how the world s largest religion evolved over the years, and a candid look at the mistakes it has made in that time.

8 March 2010

Nicolas Valc rcel: Ubuntu awesome tools

Last week I was having a conversation with a friend, and while we were discussing some things I mentioned some Ubuntu tools that were completely natural for me since I use them every day in Ubuntu development and for my work, but he was completely amazed by them, so I decided to blog on the subject so more people can know about them. I m going to start with the one that impressed him the most: qa-regression-testing branch The QA and security team maintain a test suite to check for regressions in packages they are updating. These tests are written with python unittest. Most of this test suite can be a little harmful for a production system, so it s recommended to run it using a chroot environment or a virtual machine and to help with that there is a make-test-tarball script. From the script:
export HOSTS= sec-intrepid-amd64 sec-hardy-amd64 sec-dapper-amd64
export TEST=test-glibc-security
./make-test-tarball $TEST.py
for i in $HOSTS; do
scp /tmp/qrt-$TEST.tar.gz $i.local:
done
for i in $HOSTS; do
ssh -t $i.local hostname; rm -rf qrt-$TEST; tar zxf qrt-$TEST.tar.gz; cd qrt-$TEST && ./$TEST.py -v
done
As you can imagine HOSTS are the hostnames of the virtual machines where the tests are going to run. Writing those test isn t rocket science, you just need a little knowledge of the package and the functionality you want to test and python unittesting, there is even a skeleton script that can help you start writing your test. Hope this information is useful for you! And as usual, patches are welcome!

Russell Coker: Designing a Secure Linux System

The Threat Bruce Schneier s blog post about the Mariposa Botnet has an interesting discussion in the comments about how to make a secure system [1]. Note that the threat is considered to be remote attackers, that means viruses and trojan horses which includes infected files run from USB devices (IE you aren t safe just because you aren t on the Internet). The threat we are considering is not people who can replace hardware in the computer (people who have physical access to it which includes people who have access to where it is located or who are employed to repair it). This is the most common case, the risk involved in stealing a typical PC is far greater than the whatever benefit might be obtained from the data on it a typical computer user is at risk of theft only for the resale value of a second-hand computer. So the question is, how do can we most effectively use free software to protect against such threats? The first restriction is that the hardware in common use is cheap and has little special functionality for security. Systems that have a TPM seem unlikely to provide a useful benefit due to the TPM being designed more for Digital Restrictions Management than for protecting the user and due to TPM not being widely enough used. The BIOS and the Bootloader It seems that the first thing that is needed is a BIOS that is reliable. If an attacker manages to replace the BIOS then it could do exciting things like modifying the code of the kernel at boot time. It seems quite plausible for the real-mode boot loader code to be run in a VM86 session and to then have it s memory modified before it starts switches to protected mode. Every BIOS update is a potential attack. Coreboot replaces the default PC BIOS, it initialises the basic hardware and then executes an OS kernel or boot loader [2] (the Coreboot Wikipedia page has a good summary). The hardest part of the system startup process is initialising the hardware, Coreboot has that solved for 213 different motherboards. If engineers were allowed to freely design hardware without interference then probably a significant portion of the computers in the market would have a little switch to disable the write line for the flash BIOS. I heard a rumor that in the days of 286 systems a vendor of a secure OS shipped a scalpel to disable the hardware ability to leave protected mode, cutting a track on the motherboard is probably still an option. Usually once a system is working you don t want to upgrade the BIOS. One of the payloads for Coreboot is GRUB. The Grub Feature Requests page has as it s first entry Option to check signatures of the bootchain up to the cryptsetup/luksOpen: MBR, grub partition, kernel, initramfs [3]. Presumably this would allow a GPG signature to be checked so that a kernel and initrd would only be used if they came from a known good source. With this feature we could only boot a known good kernel. How to run User Space The next issue is how to run the user-space. There has been no shortage of Linux kernel exploits and I think it s reasonable to assume that there will continue to be a large number of exploits. Some of the kernel flaws will be known by the bad guys for some time before there are patches, some of them will have patches which don t get applied as quickly as desired. I think we have to assume that the Linux kernel will be compromised. Therefore the regular user applications can t be run against a kernel that has direct hardware access. It seems to me that the best way to go is to have the Linux kernel run in a virtual environment such as Xen or KVM. That means you have a hypervisor (Xen+Linux or Linux+KVM+QEMU) that controls the hardware and creates the environment for the OS image that the user interacts with. The hypervisor could create multiple virtual machines for different levels of data in a similar manner to the NSA NetTop project, not that this is really a required part of solving the general secure Internet terminal problem but as it would be a tiny bit of extra work you might as well do it. One problem with using a hypervisor is that the video hardware tends to want to use features such as bus-mastering to give best performance. Apparently KVM has IOMMU support so it should be possible to grant a virtual machine enough hardware access to run 3D graphics at full speed without allowing it to break free. Maintaining the Virtual Machine Image Google has a good design for the ChromiumOS in terms of security [4]. They are using CGroups [5] to control access to device nodes in jails, RAM, CPU time, and other resources. They also have some intrusion detection which can prompt a user to perform a hardware reset. Some of the features would need to be implemented in a different manner for a full desktop system but most of the Google design features would work well. For an OS running in a virtual machine when an intrusion is detected it would be best to have the hypervisor receive a message by some defined interface (maybe a line of text printed on the console ) and then terminate and restart the virtual machine. Dumping the entire address space of the virtual machine would be a good idea too, with typical RAM sizes at around 4G for laptops and desktops and typical storage sizes at around 200G for laptops and 2T for new desktops it should be easy to store a few dumps in case they are needed. The amount of data received by a typical ADSL link is not that great. Apart from the occasional big thing (like downloading a movie or listening to Internet radio for a long time) most data transfers are from casual web browsing which doesn t involve that much data. A hypervisor could potentially store the last few gigabytes of data that were received which would then permit forensic analysis if the virtual machine was believed to be compromised. With cheap SATA disks in excess of 1TB it would be conceivable to store the last few years of data transfer (with downloaded movies excluded) but such long-term storage would probably involve risks that would outweigh the rewards, probably storing no more than 24 hours of data would be best. Finally in terms of applying updates and installing new software the only way to do this would be via the hypervisor as you don t want any part of the virtual machine to be able to write to it s data files or programs. So if the user selects to install a new application then the request please install application X would have to be passed to the hypervisor. After the application is installed a reboot of the virtual machine would be needed to apply the change. This is a common experience for mobile phones (where you even have to reboot if the telco changes some of their network settings) and it s something that MS-Windows users have become used to but it would get a negative reaction from the more skilled Linux users. Would this be Accepted? The question is, if we built this would people want to use it? The NetTop functionality of having two OSs interchangeable on the one desktop would attract some people. But most users don t desire greater security and would find some reason to avoid this. They would claim that it lowered the performance (even for aspects of performance where benchmarks revealed no difference) and claim that they don t need it. At this time it seems that computer security isn t regarded as a big enough problem for users. It seems that the same people who will avoid catching a train because one mugging made it to the TV news will happily keep using insecure computers in spite of the huge number of cases of fraud that are reported all the time.

Russell Coker: Storage vs RAM Size

In a comment on my post Shared Objects and Big Applications about memlockd [1] mic said that they use memlockd to lock the entire root filesystem in RAM. Here is a table showing my history of desktop computers with the amounts of RAM, disk capacity, and CPU power available. All systems better than a 386-33 are laptops a laptop has been my primary desktop system for the last 12 years. The columns for the maximum RAM and disk are the amounts that I could reasonably afford if I used a desktop PC instead of a laptop and used the best available technology of the day I m basing disk capacity on having four hard drives (the maximum that can be installed in a typical PC without extra power cables and drive controller cards) and running RAID-5. For the machines before 2000 I base the maximum disk capacity on not using RAID as Linux software RAID used to not be that good (lack of online rebuild for starters) and hardware RAID options have always been too expensive or too lame for my use.
Year CPU RAM Disk Maximum RAM Maximum Disk
1988 286-12 4M 70M 4M 70M
1993 386-33 16M 200M 16M 200M
1998 Pentium-M 233 96M 3G 128M 6G
1999 Pentium-2 400 256M 6G 512M 40G
2000 Pentium-2 600 384M 10G 512M 150G
2003 Pentium-M 1700 768M 60G 2048M 400G
2009 Pentium-M 1700 1536M 100G 8192M 4500G
2010 Core 2 Duo T7500 2200 5120M 100G 8192M 6000G
graph of RAM/disk sizes from the above table The above graph shows how the modern RAM capacities have overtaken older disk capacities. So it seems that a viable option on modern systems is to load everything that you need to run into RAM. Locking it there will save spinning up the hard drive on a laptop. With a modern laptop it should be possible to lock most of the hard drive contents that are regularly used (IE the applications) into RAM and run with /home on a SD flash storage device. Then the hard drive would only need to be used if something uncommon was accessed or if something large (like a movie) was needed. It also shows that there is potential to run diskless workstations that copy the entire contents of their root filesystem when they boot so that they can run independently of the server and only access the server for /home. Note that the size of the RAM doesn t need to be larger than the disk capacity of older machines (some of the disk was used for swap, /home, etc). But when it is larger it makes it clear that the disk doesn t need to be accessed for routine storage needs. I generated the graph with GnuPlot [2], the configuration files I used are in the directory that contains the images and the command used was gnuplot command.txt . I find the GnuPlot documentation to be difficult to use so I hope that this example will be useful for other people who need to produce basic graphs I m not using 1% of the GnuPlot functionality.

7 March 2010

Gunnar Wolf: Authoral rights in the editorial world seminar

I must confess I don't remember who I got this invitation from. Anyway, if you are in the right geographic area, you might be interested. I will try to participate: This is a year-long seminar that will be held the second Thursday every month at Fonoteca Nacional (a place I have wanted to visit for a long time!), in Barrio de Santa Catarina, Coyoac n. Among the organizers they have Creative Commons Mexico. Free entrance (but limited space - so they ask interested people to confirm their presence by mail to bvallarta@conaculta.gob.mx). [update] I went with Pooka to the first session. We arrived almost 1hr late (due to me mistaking the schedule :-/ ) but it was interesting. Of course, quite biased towards the Google viewpoints, but interesting. We got the program for the next sessions So, mostly for myself to keep handy, here it goes:
Date Title Speakers
2010-03-11 Google and copyright Manuel Tamez, Hugo Contreras, Mar a Fernanda Mendoza
2010-04-08 Generalities about rights on intelectual property Jes s Parets, Guillermo Sol rzano, Jorge Mier y Concha
2010-05-13 Copyright's nature and competent authorites Carmen Arteaga, Luis Schmidt, C sar Callejas
2010-06-10 Moral and patrimonial rights Guillermo Pous, Eduardo de la Parra, Ram n Ob n
2010-07-08 Reproduction rights for audible material lvaro Hegewisch, scar Javier Solorio, Marco Antonio Morales, Jos Ram n C rdeno
2010-08-12 Licenses and patrimonial right transmission. Works for hire, works done under laboral relationship, or carried out in official service Dolores Franco, Jes s Mej a, Ra l Pastor
2010-09-09 Limits to explotation rights and literary plagiarism Carmen Arteaga, Juan Ram n Ob n, Jorge Mier y Concha, C sar Callejas
2010-10-14 Copyright in a digital setting Jes s Parets, Gast n Esquivel
2010-11-11 Law-regulated intelectual property rights Rosalba Elizalde, Salvador Ortega, Gast n Esquivel, Manrique Moheno
2010-12-09 International protection and collective gestive societies Horacio Rangel, Luis Schmidt, Jes s Mej a

Aurelien Jarno: Squeeze will be released with eglibc 2.11

Contrary to what lucas announced (I don t know where he got this info), we plan to release Squeeze with eglibc 2.11. It is already packaged in experimental and is ready on all architectures except hppa where there are a few major regressions in the testsuite to fix. This is what prevent us to upload it to unstable.

Brice Goglin: Debian/X.org notes - Bug triaging while waiting for DRM 2.6.33

Almost nothing interesting happened recently in X.org in Debian. But interesting things are coming soon.
First, radeon KMS and DRI2 will enter unstable soon. xserver-xorg-video-radeon 1:6.12.191-1 is currently in experimental. People seem to be happy with it so far, and upstream is taking very good care of bug reports as usual. The next 2.6.32 kernel will contain DRM from 2.6.33. It first means that the radeon KMS driver not in staging anymore. Once this new kernel is uploaded, I'll put the new xserver-xorg-video-radeon in unstable (6.13.0 is expected soon, but 6.12.191 already looks good so far). DRM from 2.6.33 will also brings nouveau support. It means that we will build libdrm-nouveau and upload a new xserver-xorg-video-nouveau. However, it also means that we need somebody to maintain this. And nobody in the team has a nvidia board to test packages so... If you want nouveau in Debian, please help.
While waiting for all these, we have been triaging the BTS a bit. Kibi is helping a lot by triaging recent intel bugs (many regressions fixed in recent kernels). I spent some time during the week-end triaging some old bugs. I closed more than a hundred of them, and pinged another hundred. We still have more than 1100 bugs open. It is not so bad compared to 1500-2000 when nobody maintains X (aka often), but still way too much. Some of my bug closing might look a bit rude. But we had so many bug reports a couple years ago that are irrelevant today. Keeping them open would be meaningless. For instance, many input problems are obsolete since a lot of the input code was rewritten, we switched to input-hotplug, and then hal to udev. Another example is intel lockups (we had a lot of them after driver 2.2 arrived). But XAA and EXA were dropped in favor of UXA, DRI1 was dropped for DRI2, and KMS arrived. So it's useless to keep these obsolete and irrelevant bugs that cannot be debugged nowadays.
As usual, the Debian X team needs a lot of help. Again, if you want nouveau in Debian, please help.
(Permanent link)

5 March 2010

Enrico Zini: Global trends

Global trends For some time I have been trying to pinpoint what it is that is brewing in Italy and risks spreading elsewhere, like it happened in the past. I don't need to be decent to stay in power While following a train of thought during a political/philosophical lecture I figured that a current growing trend is to have public figures that are more and more indecent. In Italy it is very hard to find a public figure you can look up to. It is hard to name a politician that is not involved in some shady exchange of favours or some abues of their powers, and we got used to seeing people in power implicated in major corruption scandals, perverted prostitution affairs, or dealings with international criminal organisations. They do not normally end up in jail, and in fact they keep being very firmly in power, because they manage to stretch or change the laws to get away, or at least to delay trials in order to trigger some statute of limitations. Is there a pattern here that, although maybe not as clearly defined as in Italy, can be found more or less globally? Yesterday I thought that this could be such a pattern:
I don't need to be decent to stay in power
If I think of it like that, then it is most definitely not just an Italian phenomenon. If you tell "one doesn't need to be decent to stay in power" to a British, or to a French, I would not expect them to see anything strange with it. We all find it depressing, but we are all used to it. It is a pattern with repercussions, though: once that becomes normal in a society, it means that people who get to be in power are free to abuse their power much as they want, as long as they are careful enough not to end up in jail. Because, well, nowadays one doesn't need to be decent to stay in power. I don't need to follow the law to stay in power That first pattern is already quite well accepted in Italy. So much well accepted, that I think we are starting to see what comes next. At the end of March we are going to have elections for some regional governors. Funnily enough, in Lazio, the very important region around Rome, the centre-right coalition failed to submit the paperwork on time, and is out of the elections. It is not just red tape: at some point someone will have to print out the ballots and dispatch them to the voting booths, so one expects to have the coalition logos and the names of the candidates submitted in time, together with signatures supporting the candidates and whatever else the election process needs. Well, they missed the deadline, they got there after closing time and the building was, well, closed. It was a fantastic opportunity for a laugh. Memes blossomed on the Italian intarwebs and we now have 2 or 3 new expressions to mean "stupid". However, now it's hard to tell what is going to happen. On one hand, you can't exclude one of the two major coalitions because of some bureaucratic detail like an office closing time. But on the other hand, several minor coalitions have been excluded in all sorts of past elections because of similar things, and it really would not be fair to start making exceptions now. But Lombardia, the region around Milan and Emilia Romagna, the one around Bologna, both very, very important, are having similar kinds of problems. In both regions the previous governors are running again, for the 3rd time in a row, and most likely they legally can't do it, and if elected one can sue and force them to resign, because they have been in power long enough. Lots of paper is being shuffled at the moment to figure if they can get away with it or not. Oh, and the lawyers of the candidate for the Milan region also managed to get to the tribunal after closing time, but apparently there was still someone inside and they managed to shout loud enough, or somesuch. Anyway, the situation is getting hot. The Lazio coalition that has been excluded because of their incompetence is now hard at work pushing their potential voters to mount a fracas. Chances are that eventually they'll get away with it, and manage to take part to the election. If that happens, they will likely get close to winning it. So this seems to be a new pattern that is emerging:
I don't need to follow the law to stay in power
Which, again, is a pattern with quite some repercussions. It is something much more radical than just an issue with morality: it means feudalism, it means we are culturally ready to accept dictatorship. So, please do me a favour: do not think for a moment that Italy is just a funny place with lemons and tomatoes, and watch out for these patterns emerging around you.

4 March 2010

Russell Coker: Opera and Trusting Applications vs Trusting Servers

The Opera-Mini Dispute I have just read an interesting article about the Opera browser [1]. The article is very critical of Opera-Mini on the iPhone for many reasons most of which don t interest me greatly. There are lots of technical trade-offs that you can make when designing an application for a constrained environment (EG a phone with low resolution and low bandwidth). What does interest me is the criticism of the Opera Mini browser for proxying all Internet access (including HTTPS) through their own servers, this has been getting some traction around the Internet. Now it is obvious that if you have one server sitting on the net that proxies connections to lots of banks then there will be potential for abuse. What apparently isn t obvious to as many people is the fact that you have to trust the application. Causes of Software Security Problems When people think about computer security they usually think about worms and viruses that exploit existing bugs in software and about Trojan horse software that the user has to be tricked into running. These are both significant problems. But another problem is that of malicious software releases. I think that this is significantly different from Trojan horses because instead of having an application which was written for the sole purpose of tricking people (as is most similar to Greek history) you have an application that was written by many people who genuinely want to make a good product but you have a single person or small group that hijacks it. Rumor has it that rates well in excess of $10,000 are sometimes paid for previously unknown security vulnerabilities in widely used software. It seems likely that a programmer who was in a desperate financial situation could bolster their salary by deliberately putting bugs in software and then selling the exploits, this would not be a trivial task (making such bugs appear to be genuine mistakes would take some skill) but there are lots of people who could do it and plausibly deny any accusation other than carelessness. There have been many examples of gambling addicts who have done more foolish things to fund their habit. I don t think it s plausible to believe that every security flaw which has been discovered in widely used software was there purely as the result of a mistake. Given the huge number of programmers who have the skill needed to deliberately introduce a security flaw into the source of a program and conceal it from their colleagues I think it s quite likely that someone has done so and attempted to profit from it. Note that even if it could be proven that it was impossible to profit from creating a security flaw in a program that would not be sufficient to prove that it never happened. There is plenty of evidence of people committing crimes in the mistaken belief that it would be profitable for them. Should We Trust a Proprietary Application or an Internet Server? I agree with the people who don t like the Opera proxy idea, I would rather run a web browser on my phone that directly accesses the Internet. But I don t think that the web browser that is built in to my current smart-phone is particularly secure. It seems usual for a PC to need a security update for the base OS or the web browser at least once a year while mobile phones have a standard service life of two years without any updates. I suspect that there is a lot of flawed code running on smart phones that never get updated. It seems to me that the risks with Opera are the single point of failure of the proxy server in addition to the issues of code quality while the risks with the browser that is on my smart-phone is just the quality of the code. I suspect that Opera may do a better job of updating their software to fix security issues so this may mitigate the risk from using their proxy. At the moment China is producing a significant portion of the world s smart-phones. Some brands like LG are designed and manufactured in China, others are manufactured in China for marketing/engineering companies based in Europe and the US. A casual browse of information regarding Falun Gong makes the character of the Chinese leadership quite clear [2], I think that everything that comes out of China should be considered to be less trustworthy than equivalent products from Europe and the US. So I think that anyone who owns a Chinese mobile phone and rails against the Opera Mini hasn t considered the issue enough. I don t think it s possible to prove that an Opera Mini with it s proxy is more or less of a risk than a Chinese smart-phone. I m quite happy with my LG Viewty [3] but I wouldn t use it for Internet banking or checking my main email account. Also we have to keep in mind that mobile phones are really owned by telephone companies. You might pay for your phone or even get it unlocked so you can run it on a different network, but you won t get the custom menus of your telco removed. Most phones are designed to meet the needs of telcos not users and I doubt that secure Internet banking is a priority for a telco. Update: You can buy unlocked mobile phones. But AFAIK the Android is the only phone which might be described as not being designed for the needs of the telcos over the needs of the users. So while you can get a phone without custom menus for a telco, you probably can t get a phone that was specifically designed for what you want to do. The Scope of the Problem Mobile phones are not the extent of the problem, I think that anyone who buys a PC from a Chinese manufacturer and doesn t immediately wipe the hard drive and do a fresh OS install is taking an unreasonable risk. The same thing goes for anyone who buys a PC from a store where it s handled by low wage employees, I can imagine someone on a minimum income accepting a cash payment to run some special software on every PC before it goes out the door that wouldn t be any more difficult or risky than the employees who copy customer credit card numbers (a reasonably common crime). It s also quite conceivable that any major commercial software company could have a rogue employee who is deliberately introducing bugs into it s software. That includes Apple. If the iPhone OS was compromised before it shipped then the issue of browser security wouldn t matter much. I agree that having the minimum possible number of potential security weak points is a good idea. They should allow Opera Mini users to select that HTTPS traffic should not be proxied. But I don t think that merely not using a proxy would create a safe platform for Internet banking. In terms of mobile phones most things are done in the wrong way to try and get more money out of the users. Choose whichever phone or browser you want and it will probably still be a huge security risk. Harald Welte is doing some really good work on developing free software for running a GSM network [4]. But until that project gets to the stage of being widely usable I think that we just have to accept a certain level of security risk when using mobile phones.

Uwe Hermann: libopenstm32 - a Free Software firmware library for STM32 ARM Cortex-M3 microcontrollers

Olimex STM32-H103 eval board I guess it's time to finally announce libopenstm32, a Free Software firmware library for STM32 ARM Cortex-M3 microcontrollers me and a few other people have been working on in recent weeks. The library is licensed under the GNU GPL, version 3 or later (yes, that's an intentional decision after some discussions we had). The code is available via git:
 $ git clone git://libopenstm32.git.sourceforge.net/gitroot/libopenstm32/libopenstm32
 $ cd libopenstm32
 $ make
Building is done using a standard ARM gcc cross-compiler (arm-elf or arm-none-eabi for instance), see the summon-arm-toolchain script for the basic idea about how to build one. The current status of the library is listed in the wiki. In short: some parts of GPIOs, UART, I2C, SPI, RCC, Timers and some other basic stuff works and has register definitions (and some convenience functions, but not too many, yet). We're working on adding support for more subsystems, any help with this is highly welcome of course! Luckily ARM stuff (and especially the STM32) has pretty good (and freely available) datasheets. We have a few simple example programs, e.g. for the Olimex STM32-H103 eval board (see photo). JTAG flashing can be done using OpenOCD, for example. Feel free to join the mailing lists and/or the #libopenstm32 IRC channel on Freenode. The current list of projects where we plan to use this library is Open-BLDC (an Open Hardware / Free Software brushless motor controller project by Piotr Esden-Tempski), openmulticopter (an Open Hardware / Free Software quadrocopter/UAV project), openbiosprog (an Open Hardware / Free Software BIOS chip flash programmer I'm in the process of designing using gEDA/PCB), and probably a few more. If you plan to work on any new (or existing) microcontroller hardware- or software-projects involving an STM32 microcontroller, please consider using libopenstm32 (it's the only Free Software library for this microcontroller family I know of) and help us make it better and more complete. Thanks!

Next.

Previous.