Search Results: "pm"

16 April 2006

Brett Parker: bpgallery.sh v1.0.2 released

Just tagged up the latest version of bpgallery which is my rather light bash script for generating static gallerys, this version fixes a couple of (minor) bugs, removes some duplication of code (to make it easier for me to maintain, and because I'm going to need to extend that part of the code for the next release), and fixes an outstanding part of the todo list (i.e. regenerate thumbnails if the required width changes). It's also added a per gallery config file option, so now putting in a file called .bpgallery.rc with the right variables in it (WIDTH, TITLE, BPGALLERY_THEME), will use that file as the last one to get settings from, overriding previous settings (well, unless they're set readonly, in which case it won't ;). Next release should have some extra themes in the release as a demonstration, medium sized images (and the pages to go with them, and an extension to the themeing for this), next and previous 'buttons' on the autogenerated pages, and should generally just be a nice release! Sometime I'll get round to finishing off writing the documentation for it, but until then, if you're using it and get a problem, mail me (or find me on IRC!).

13 April 2006

Matt Brown: 2.6 Suckiness

Has anyone else noticed a sharp decline in the quality and stability of the 2.6 kernels recently? I know that they’ve supposedly done away with “stable” releases and changes are being merged from the development trees straight into the 2.6 mainline, but surely we can still expect some level of stability. I’ve run into some fairly major problems lately. In early December I tried to upgrade our Biscuit PC distributions kernel package from 2.6.13.1 to 2.6.14 but was stymied by the fact that 2.6.14 seems to have completely removed support for building out of kernel modules against the kernel headers only, the full kernel source is now required to be present. This does not play nicely with Debian kernel packages. I haven’t had time to try 2.6.15 yet to see if this change has been reverted, but its a fairly major thing to drop support for and completely removes the ability for me to build packages for external drivers like madwifi. Today I was upgrading a machine with software raid from Woody -> Sarge and proceeded to upgrade the kernel too. I pulled down a copy of 2.6.15.4, ran make oldconfig and then verified that all the crucial options were still selected (raid, promise controller, e100, etc). make-kpkg, dpkg -i, reboot. BANG.

VFS: Cannot open root device "md0" or unknown-block(9,0)
Please append a correct "root=" boot option
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(9,0)

A quick investigation revealed the promise controller as the source of the problem

PDC20267: IDE controller at PCI slot 0000:02:0e.0
PDC20267: chipset revision 2
PDC20267: ROM enabled at 0xf4640000
PDC20267: 100% native mode on irq 22
PDC20267: neither IDE port enabled (BIOS)

Now, the Promise controllor is certainly not disabled in BIOS, and 2.4.21 manages to boot off it just fine so what is wrong with 2.6.15!? Google suggested that I needed to enable the PDC202xx_FORCE option, (which was enabled in 2.4.21 but in 2.6.15 is only available if you happen to select the completely unrelated driver for the next model up promise card to what I have - a bug that has apparently been acknowledged since 2.6.9 but still not fixed!!), however that made no difference whatsoever. After a couple of hours of fiddling around with various kernel settings and boot options (did I mention this machine is 200km away from me…) I gave up and started trying early kernel versions starting with the existing 2.6.13 kernel I was using for the Biscuit PC distribution, which worked first time. So far I’ve not been able to find any other reports of problems with 2.6.15 and the Promise drivers, but from what I saw today they are completely non functional. The common argument I seem to hear when I usually mention this subject (2.6 suckiness) is “but you should just use your distributions kernel”, to which my reply is “but I do…”, for my desktop. The standard Ubuntu kernels work great and I have had no reason to meddle with them. However my desktop needs are a far cry from what I need to be able to do for the servers I maintain at work, or the kernel packages that I need to build for our BiscuitPC distribution. I’m certainly not one of those gentoo type people that need the latest and greatest the instant that it comes out, and I don’t try and run the latest kernel just for the sake of it. But the fact is, new kernels bring new features (not to mention bugfixes and security patches) that are frequently needed, especially in the networking and wireless areas. When I have to spend several days debugging and testing every time we need a new kernel only to find some critical flaw that prevents us from using it I have to stop and wonder whether the current kernel development process is working. Have others had similar experiences with 2.6 kernels recently, is the fact that the latest kernel-image I can find in sid is 2.6.8 confirmation that it’s not just me, or am I really just overly angry due to the hours I’ve spent battling 2.6 lately? Update: Several people have pointed out that I failed to look for linux-image instead of kernel-image and that 2.6.15 is already in sid. My mistake. And yes, I do plan to file bugs, not just rant, but sometimes you need to vent first :)

12 April 2006

Eric Dorland: The Pain of the GFDL GR and the DPL throws down

(aside: I love acronyms) The GFDL GR is particularly painful for packagers of GNU software like, say, automake. While I voted for it, and I think it was the right thing, it's almost physically painful to have to split my package apart for such ridiculously trivial 3 lines of Front and Back Cover Text:
     Permission is granted to copy, distribute and/or modify this
     document under the terms of the GNU Free Documentation License,
     Version 1.2 or any later version published by the Free Software
     Foundation; with no Invariant Sections, with the Front-Cover texts
     being "A GNU Manual," and with the Back-Cover Texts as in (a)
     below.  A copy of the license is included in the section entitled
     "GNU Free Documentation License."
     (a) The FSF's Back-Cover Text is: "You have freedom to copy and
     modify this GNU Manual, like GNU software.  Copies published by
     the Free Software Foundation raise funds for GNU development."

New DPL Anthony Towns has started his term, guns blazing. I like his idea. Making it easier to contribute to Debian can only really be a net win. The obvious objection is that this will allow untrusted people to upload to Debian. But does the current New Maintainer process really guarantee that an applicant is not malicious? I don't think so. It only weeds out impatient attackers, not determined ones. Now, if we really do believe that it is too dangerous to allow these "Debian Maintainers" direct upload, their uploads could go into their own queue. A queue that would be viewable by any "Debian Developer" to vet the package and approve it. I believe the Fedora Extras project does something similar.

10 April 2006

Joey Hess: libacpi

Hmm, is there still no good general-purpose C library for pulling info out of /proc/acpi easily? I'd have thought we'd have one by now, but currently the closest thing I know of is my own acpi.c not-quite-a-library. Seems weird that there's a libapm, but no libacpi when the acpi info in /proc is so much harder to parse than /proc/apm (especially if you want to be somewhat efficient about doing so). My acpi.c kinda wants to turn into libacpi, but I kinda don't want it to. (Maybe something like HAL is how we're supposed to deal with this stuff these days?)

8 April 2006

Martin F. Krafft: Restless travellers

We've been busy travelling, never spending more than a night in the same place. Leaving Bangkok on the "3rd class" train for Ayuthaya was an experience of its own kind. The platform was full with people waiting for the train to arrive, and when it did, we witnessed something totally unexpected for the Thai: they almost quarelled to get into the train first to catch a seat. Fortunately we got lucky in the otherwise crowded wagons. We stopped frequenly, and a glance out of the window would give you a peek into the lowest end of Thai civilisation: barracks built along the tracks with large numbers of people vegetating along. Inside the train it was hot and sticky, and we were surely happy to disembark in Ayuthaya about an hour later than planned. Ayuthaya was the Siamese royal capital between the 14th and the 18th century (the name derives from Sanskrit and means "undefeatable") and a bunch of temples and ruins, most with strong Khmer influence, survived the various Burmese attacks until today, making the city a nice attraction for those who like "stone piles" (as I've heard them described). We had made arrangements from Bangkok with the Baan Lotus Guesthouse, run by a lovely lady who spoke good English. Apart from the broken light in our room, the setting, the friendliness of our host, and the cleanliness of the rooms were definitely worth the price. After visiting Wat Phra Mahathat, the temple home to a Bhudda's head embedded in twisted roots, we had a guide escort us to a remote Elephant camp to witness the preparations for the upcoming New Year celebration (Songkran) in a week from now -- we are definitely looking forward to that. Later that night, we met some locals at a bar for chatting and went to bed late, thanks to our host handing over the keys and making an exception to the 11pm curfew. We got up to meet the guide from the night before, who took us around three temples before dropping us off at the boat stop for a short cruise around the island (Ayuthaya is encircled by a river). Our train to Khorat (Nakhon Ratchasima) was scheduled for 12:23, and so we had to forgo most of the temples due to time constraints; Ayuthaya is close enough to Bangkok to come back here again during a future trip. Reaching the station with ample time, we found the (express) train to be full, but did not feel like waiting for the slower train an hour later, so we talked the station ward into getting us on anyway. Interestingly, I think he would have tried his best even if I had not slipped him 100 Baht (2 EUR) under the table. We got on, and even had two seats in an air-conditioned wagon, so the trip was quite relaxing -- to the point that we almost missed our stop. Shortly before reaching Khorat, we rode through a thunderstorm, and there was a light drizzle as we stepped out of the station. The distance from Bangkok showed, the Tuk Tuk drivers (Tuk Tuks are the infamous three-wheeled taxis you find all over Southeast Asia) didn't hassle us, it was in fact not at all easy to find one, and when we did, he did not know where the Tokyo Hotel, our chosen home for the night, was located. With a map in hand, we thus simply started walking, but had to run for shelter at an ice factory when the rain picked up and sent cats and dogs onto the streets that really aren't made to take that much liquid. Eventually, a Tuk Tuk picked us up and got us to the hotel safely, and an hour later, the rain stopped. We did not miss a beat to get outside and ended up at "The Mall", a magnificent American-style "shopping paradise" (as Aline would call it) which clearly showed that shopping is one of the top passtimes for Thais. We ended the evening at Khorat Texas, a very nice bar in the centre of the town, with decent food and live music. As I was rolling a cigarette, a local from the next table curiously came over, and shortly thereafter, the two of us joined the three of them at their table for some cultural exchange in broken English. We picked up quite a few handy Thai expressions but also came to the conclusion that the Thai don't really know how to say things themselves and would often disagree with each other over the endings of words. But as the beer kept flowing, we seemingly got better at Thai intonation, although the language is definitely very hard for Europeans. I could not help but notice though that it seems to be better suited for cell phone conversations in noisy places while one of the three men we met kept chatting away to his wife for an hour while the band was playing in the background. This morning, we weren't motivated to get up before 11, checked out, made travel arrangements for our next destination -- Phimai -- dropped off some laundry, and then headed for the national museum, which we only found through the technique of circling and spiralling inwards. Not much to see otherwise here. The Lonely Planet guide says this city is unexciting, but it grows on you if you spend longer periods of time. Sure, like most cities, I say. As it stands, we have reason enough to abandon the place and spend tonight in Phimai, close to the famous and beautifully restored Khmer temples of the area, so that we can hopefully spend as much time as possible in the temple area before the heat gets unbearable. Nevertheless, speaking of heat, yesterday's rain shower cooled the air by 5 or 10 degrees, and it's very bearable right now. I have to point this out because in general, the month of April is not a month during which to travel Northern Thailand due to the temperatures approaching 40 degrees during the day. I know for sure that next time, I will be looking into clothing made out of fabric better suited to handle large amounts of sweat than cotton. We hope to leave Phimai on a bus to Udon Thani. I expect that shall be the next time I get to write. Thanks for reading along.

5 April 2006

Erich Schubert: Too many projects...

I'm doing too many projects. I need to step back from most of them ASAP. I just don't want them to dwindle, but prosper... I really need to find more contributors for Oh, and half of above projects need a fancy web design and an icon. Anyway, I should basically turn off my computer for the next two months and refrain from going online. :-( I know that I won't have the discipline to do so... And there are oh so many projects still only existant in my head that I'd really love to do sometime. One involving new search technologies with tags, bringing together directories like DMoz, tag based stuff like del.icio.us and "traditional" text search engines. Definitely the stuff the Web 2.0 is made out of (read: hype). But when I'm done with my diploma this new dotcom bubble is probably over, too... :-(

Erich Schubert: Programming languages: the next big thing?

I've been thinking a lot about programming languages. Especially on what the "next big thing" after OOP will be (and I'm talking of the magnitude of OOP vs. traditional imperative programming). I'd predict we'll end up with such a new paradigm in like 10 years, and it'll do away with OOP like OOP did with traditional imperative programming. It won't be Aspect Oriented Programming. It won't be UML and all its sublanguages. It won't be a pure functional paradigm, these have been around a long time already. It'll have to have multithreading support in a very natural way (multithreading is somewhat ugly in all the OOP languages with locking and such; in theory it should be very nice in functional and logic languages, but I'm not aware of anyone actually making use of that...) I guess it'll be around data flows, and it will offer a range of detail levels, so that on the one end you can do amazing things with a few lines of code (like in python or ruby), but it'll also be possible to use (and enforce if needed) lots of constraints for validity checking such as typing, value constraints, pre- and postconditions and so on. And it won't be graphical like all the UML stuff, because coders type a lot faster than they click. It will however need to come with a very very powerful editor offering benefits from both the Eclipse and the VI worlds. It will be very interesting to watch these developments. Oh, and I have intentionally no comments on my blog.

Raphaël Hertzog: Leader election: last chance to vote

Given the low participation, it looks like the choice of a DPL is difficult this year. It probably means that the platform of the candidates do no suit everybody… however with DPL teams, there’s more than just the DPL and in theory each member should have their own platform. That’s not the case for me because writing a platform is a big job… which I can avoid since I’m not candidate. :-) However I now do feel the need to tell what I would like to propose (and do) if I’m part of a team so that you know better what to expect if you vote for a team where I’m involved. I’d just like to give a warning, those items are quick notes and are in no way full- and flesched out solutions, they will need to be discussed and refined in all cases, and somes ideas may be dropped of course. This list is neither complete nor definitive. Not all items will be achieved but each of them is a real progress IMO and I’d like to be able to work on them. For people who are concerned by those changes, I’m sorry if you discover my ideas by this post even before I had the opportunity to talk to you… I’m posting those ideas now because they may be considered by people who are currently voting, but it does not mean that I’m not interested to discuss them with you. It’s also true that some of those ideas can be implemented without being part of the DPL team and I’ll certainly try to implement some whatever the outcome of the election, but I really believe that being part of a DPL team helps greatly because you have access to some important informations, and you can effectively discuss with core teams which are otherwise difficult to approach for non-technical discussions when you’re a random DD. And last but not least, the trust of the developers is a big motivation (at least for me) to work effectively on those problems. See this post for my personal vote recommandation and see you in 3 days for the result of the election !

4 April 2006

Jos Parrella: Free Software vs. Privative Software in Venezuelan National Assembly

For my hispanohablantes readers: this post is written in english since it’s gonna be syndicated into Planet Debian. Expect a post in spanish later in the day. If you can understand spoken spanish, I recommend you to hear the Free Software talk of M.Sc. Ernesto Hern ndez-Novich (Debian Maintainer) which ends noting several benefits of using Debian GNU/Linux. Available here. Update: other posts in spanish are already available in Planeta Linux Venezuela. Yesterday we (SOLVE, a Venezuelan Association of Free Software Users, Developers, Cooperatives and Entrepreneurs) had the opportunity to assist to a Free Software vs. Privative Software forum. This doesn’t sound amazing, indeed. But if you take into account that the Forum was held in the National Assembly (or House of Representatives, anyway I’ll call it AN) it gets better. Now, get this idea: the AN is having a forum to discuss a Law, and it’s listening to the parts involved. Let it sink for a minute. But what if the AN is also bringing this parts to a table to actually write the Law? This is how laws are made in our Country now (Damog always says we are terribly nationalistic. It may be true, indeed.) Anyway, we were there around 10 AM, in the Protocolar Room of the AN. The event was full-house, featuring two thirds of people supporting proprietary software (students between 17 and 20 years from the countryside and big entrepreneurs -and Microsoft, of course-) and one third of people supporting free software, including people working in the Government, students, cooperatives, developers, etc. The session was opened by Representative Luis Tasc n, which once was a great supporter of Free Software (now it seems the same for him, anyway he’s doing a great job changing the law-making roadmap) and the speakers were: Microsoft, the National Center for IT, Cavecom (the association of big software enterprises in Venezuela) in the Dark Side and Felipe P rez Mart (from SOLVE) and Ernesto Hern ndez-Novich (Sim n Bol var University) in the White Side. Kudos for IBM, in the Gray Side with Black Spots. The session of talks was incredibly amusing. The speakers started to change their opinions based on the last talk. So, this way, Berrizbeitia (Director, CNTI) tried to discuss Tascon (Representative), the Microsoft Brazilian guy tried to oppose Berrizbeitia, the guy from Cavecom fighted Microsoft (this guy was a complete moron, by the way: when he was told that a group of venezuelan people had developed translations into wayuunaiki he said that was useless since we only have 800 wayuu - native americans) the IBM-boy tried to say they were the best, Felipe Perez (SOLVE) tried to dismantle Berrizbeitia’s talk and finally Ernesto Heranndez-Novich roundkicked them all. The kids from Microsoft (wearing MSDN and VisualStudio shirts) said that Microsoft is a good company which is open-source and gives the code for free. I argued some of them that they were working free for Microsoft. They “hadn’t see it that way”. They also said the plain-ol’-good excuse that “free software was weaker since everyone can see it’s code”. They were changing their strategies and opinions sistematically as the Forum evolved. They argued no compatibility, security problems, and finally they arrived to their real reason to oppose Free Software. Several girls and boys (Daddy’s Boys, as we say to them) were arguing “no free speech” in the Country (which was amusing since this is the first time the National Assembly is writing the laws with the People) and that the Law was going to make them lose their years of University studies. Then, the most accurate of the interventions came, made by Rogmar Marin from Venezuelan Patents and Author Rights Office. He said that this event was all about the people controlling the State, not the State controlling the people. He cited two articles from the draft and the 3390 decree explicitly saying that Free Software was mandatory for Government (in the Decree it says the “National Public Administration” and in the Law it says the “National Public Power”) so he said that they were not going to lose their “bicoca” (a popular form to say “rivers of money”) since they still can program in whatever they want, just that the State has the right to decie the best for their people, and the best for their people was Free Software. This was the whole quid of the event. This is not about Free Software vs. Proprietary Software. This is not about Linux vs. Windows. This is not about IBM vs. Microsoft vs. Venezuelan Companies. This is about the best for the People (which is the maximum interest of the AN) and, in this case, the People was represented not only by the intellectual-closed-circles of Free and Proprietary Software, but by Ana Maria Morillo, from the Cambalache community in Puerto Ordaz, at the southern part of the Country. She said that their Community had absolutely no access to technology. They were poor and humble, and willing to learn. CVG Telecom, a State-based telecom company, installed a Nudetel (no, it’s not an ethic-relaxed phone operator. It stands for Telecommunications Endogen Development Kernel) in their Community, using Free Software. This was their first approach to technology and computers. They didn’t even know how to turn on a computer. Free Software helped them to approach the reality of computers. They felt prepared to use a computer, and proud of themselves. When they used privative software in other places, they needed to adapt to that technology. This demonstrates that Free Software is as easy as any Software. You need to adapt to it. The difference with Free Software is that you are free when you use it. The people from Cambalache appreciate that. Felipe Perez Marti talk was really good. He slapped Microsoft and opposed very roughly to the “technological neutrality” position of the CNTI Director, Jorge Berrizbeitia. Technological neutrality is a neo-liberal, right-wing doctrine which is the technological counterpart to laissez faire, laissez passer. The problem is that (Felipe is an economist, and a great mathematician) technological neutrality isn’t actual neutral. It happens under the conditions where the Smith’s “Invisible Hand” Theorem is valid, so, in a scenary of technological neutrality, the powerful always wins. So, Microsoft wins. He also noted the recent study funded by the United States Homeland Security and carried on by Carnegie Mellon, Coverity and Symantec, which stated that Proprietary Software had between 20 and 30 bugs per TLOC (thousand lines of code) while FOSS had only 0.434 bugs per TLOC. The Microsoft guy seemed astonished by the “discovery” and the students were offended by this. Great. What next? We brought CD’s for people, made Debian evangelization to several “disident” students, made a great cheer to every Free Software supporter, brought signs and SOLVE shirts. While the Microsoft dudes where more than twice times us, we were a coherent group which stayed until 1930 (they left at 1600, you know, it’s a Micro matter of Soft) and held great arguments, sometimes slapping the student’s moral, but definitely making our voice be heard after tenths of years being discriminated by companies, Universities and the Government. As a Debian Project volunteer, what’s your opinion about this? Is the State violating Free Speech taking this decisions? Does it have the right to take it? Is Free Software the best solution for the corporate environments of the Government, taking into account that it handles the citizen information? What are your general comments about this?

Andree Leidenfrost: I'm on Planet Debian!

Thanks to the indefatigable and ever helpful Amaya, I'm now on Planet Debian! Thank you also for your nice introduction, Amaya! :-)

Just to drop a few words about myself and what I do:

I am an expatriate German and have lived in lovely Sydney for almost seven years now. I work as an IT professional mainly programming and maintaining SAP systems.

I have been a Debian user for about a decade now and finally decided to become a maintainer almost two years ago when I started to get involved with the mindi and mondo packages that form the quite neat, flexible and versatile disaster recovery suite Mondo Rescue.

It turns out that I got sucked into Mondo Rescue upstream development reasonably heavily mainly because it is quite a low-level tool and thus needs reasonably extensive tweaking to get it to work properly on Debian (or any other distribution for that matter). Upstream (at the time) wasn't all too fond of Debian, but I was given CVS commit access pretty early on which suited my fine as I could commit my fixes directly upstream.

Since about half a year ago, upstream has become much more active, mainly thanks to Bruno Cornec (sorry no link), the new lead developer. So, hopefully for Etch, we will have a much cleaned-up codebase and fully operational RAID and LVM2 support! In the meantime, give Mondo Rescue a go - it is quite cool as it is right now! ;-)

Hopefully, there will be some time soon to look after a few more (maybe less demanding) packages and to get more involved in Debian in general. Oh, and hopefully I'll be a real Debian developer soon - DAM approval on 27 Mar looks promising - thanks, Joerg! ;-)

Matthew Palmer: Rewriting in Rails -- A Practical Examination

[Note: this article was mostly written some weeks ago; I left it in my "to be edited" box and then promptly forgot about it. So any and all temporal references are way out of whack. Since originally writing this article, I have commenced an incremental rewrite of an in-house business management application from crazy-PHP (a common -- some may say overwhelmingly so -- dialect of the language noted for it's complete lack of any sort of good software development practices, such as the creation and use of functions (!)) into Rails. Articles on this effort will be appearing presently.] Almost immediately after I'd finished writing my previous discussion on why rewriting software is evil, I decided to make a little experiment. What I did was take a fairly well factored PHP application, and rewite (a portion of) it in Rails. My intent in this was not to produce a production-quality rewrite. I have no interest in proliferating yet more functionally equivalent clones on the world. Instead, I undertook the work simply to get a feel for (a) writing a whole, traditional, Rails app in a short space of time, (b) how quick Rails really was to produce an application, and (c) whether wholesale rewrites really are as boring and life-sucking as I imagined them to be. My methodology was this: with a small amount of knowledge of the target application (SysCP), the existing database schema and templates, and a weekend, rewrite as much of SysCP as I could in a close-as-possible reproduction of critical SysCP functionality. My summary results are: rewrites are as boring as I thought they would be, Rails is powerful but fairly complex and slightly buggy when you get down into it (especially if you're working from an existing -- possibly suboptimal -- database schema), but overall, Rails is Way Good Stuff. On the boredom aspect -- I had two days to write code. I had some domestic duties to attend to (walk the dog, visit the hardware store, help my wife with attaching a new bag rack to her bike, mow the lawn, etc) but on the whole, it was dedicated to programming. I've spent whole days (hell, 40 hour marathon stretches) cutting code before. I knew this wasn't a six-month deathmarch, but only a weekend experiment. Despite that, I feel that my motivation levels were lower than they normally are when coding. I can only imagine what it must feel like, two weeks into several months of hard core coding, knowing that you'll end up with what you had before, functionally speaking. If you are going to do the rewrite thing (and may the Flying Spaghetti Monster have mercy on your soul if you do), then pick the right project. SysCP is large masses of tangled PHP (is there any other kind?) but it has a fair amount of local and global structure once you get down to it -- for instance, it's quite well factored into business logic and display, and the code is broken down fairly logically by action handler, so you get entire source files that look like this:
  if ($action == 'edit')
   
    // 150 lines of twisty passage PHP
   
  else if ($action == 'new')
   
    // Another 150 lines
   
  // repeat for another few actions
and so on. The nice thing about this is that, if you have to look for how something works, you can almost certainly find it in one place in the source. Deciphering it might be another matter, but at least you've got something to start from. As I mentioned, the display in SysCP is pretty nicely split off from the logic -- a large number of templates, with common header/footer files, with some small parts in common templatettes. Some HTML is still generated within the actions, but due to the above action-based structure, it's usually fairly easy to identify all of the HTML that will be associated with a particular action and turn it into a coherent Rails template. I would dread doing a rewrite of the presentation layer of, say, IRM. It's idea of well-factored presentation is to separate print statements from logic by a blank line. To my great shame, I've had the reins of IRM for a year, and it's still this bad. I claim it's because I hate HTML coding with a vengeance, but I think I'm actually just scared to try and tame that particular monster. (Update: Martin Stevens has been doing some good work turning IRM's HTML into Savant templates. The only downside is that I can hear his manic laughter -- caused by IRM's insanity slowly infecting him -- all the way from England, and it's keeping me awake at night). I also had to re-learn that most hated but most important of lessons -- that, no matter how much reading you may have done, until you've cut chunks of code in a language or environment, you have no idea how it actually behaves in your brain. Specifically, I spent a fair amount of my alloted rewrite time learning a few little lessons in how Rails actually behaves, and all of it's cool little features. Of course, everyone is going to have this pain, and I've suffered it in every language that I've done any appreciable amount of programming in, but it's always a shock to the system that -- after all this time programming -- a new language still makes my brane tingle curiously for a while. Luckily, I'd read and digested all of both the Pickaxe (Programming Ruby) and AWDWR (Agile Web Development with Rails) so I knew what was possible, I just usually wasn't sure how exactly, so I spent a lot of time with my head in the books. Rails' little foibles also bit me in the bum more than once. For example, I spent over an hour (a no foolin' hour) trying to hunt down what I was doing stupid in my code to make Rails completely forget about the value of a couple of my fields. The answer turned out to be to restart Webrick (Rails' internal webserver for development testing), and the problem cleared right up. You could hear my screams of anguish from the moon (even through the vacuum of space -- it was a lot of anguish). Rails isn't the Final And Ultimate Solution To The Webapp Problem, but it's a good start. There is near-zero administrative bumf when you're writing a Rails app. Rails is fairly intelligent about working out what you want done from the world around it. Code generators (which produces sensible, minimalist templates -- not the ugly, unmaintainable behemoths produced by Visigoth Studio, which has given the whole code generation world a bad name) handle a lot of the low-level "oh bugger, I have to add a new file" feeling. It's very, very anal about project structure, but (in contrast to many other bondage-and-discipline frameworks I've looked at in the past) this structure seems almost comforting (maybe I'm just getting old and turning into a satisficer). What all this means is that you (a) don't write much code unless it moves you toward your goal, and (b) Common structure means that any Rails app will be fairly familiar to an incoming programmer. Unfortunately it also means that cunning wankers will, sooner or later, work out a whole pile of ugly tricks and contortions to get themselves out of Rails' comfortable-but-no-doubt-incompatible-with-many-people's-ways-of-thinking straitjacket, which I will (sooner or later) end up maintaining. Like many of Rails' (and Ruby's) features, though, I don't see them being any more abusable than most features of any programming language or environment -- and at least they're powerful and useful (unlike, say, register_globals, magic_quotes_gpc, magic single-character variables, mandatory indenting, or banning tabs as indent characters -- I thought I'd spread the slagging amongst lots of languages). Productivity-wise, although I was only just kicking off my Rails webapp knowledge, I felt I was doing fairly well. From experience, what I produced in my weekend was roughly on par with what I could produce in PHP in the same amount of time, had the situation been reversed. Considering that I have about 3 weeks of Ruby/Rails knowledge, and about 5 years of PHP experience, I think that's a big win. (Update: I've since produced a DNS management applet for work in about 6 hours billable time, and a virtual mail account application in about 12 hours, both using Rails. There isn't a hope in hell that I could have performed a similar feat in PHP, especially with the same amount of inherent flexibility that the Rails solutions contain). Overall, my impression of wholesale rewrites as being soul-sucking experiences stands. I suggest they be approached with the greatest of care, and only be permitted after an appropriate period of psychological counselling. There is plenty of code that needs rewriting (but why do I always have to find it?) but replacing it by doing an rm -rf on the source tree and starting again is not the answer.

Gunnar Wolf: On Daylight Savings Time

Joey Hess blogs about possible dangerous ways to exploit the daylight savings time. Well, for the tenth year in a row (if I am not mistaken), we central-Mexicans can proudly announce we are GMT-5. When I was a kid, we were always told that daylight savings are a very important way to save energy in non-tropical areas, such as the North-Western states, USA, Canada and Europe. We understood that, as tropical beings, we didn't have to worry about that, as it would have neglegible effects for us.
Ten years (eleven?) ago, this changed, and we became first-class world citizens, together with the emotion of shifting the clock's hands twice a year. Of course, we all did stupid things once or thrice - The first time we got back to GMT-6, I moved to GMT-4 instead. We were laughing at the fools who forgot to move the watch. I went to the movies with Nadezhda, and was confronted by a less-than-amused clerk that had to explain the same to too many people along the day. At least he smiled when he noticed we were stupider than most.
Well, today I am a big fan of daylight savings. I simply like having sunlight up to 20:00, sometimes even 21:00 - But I have reversed the old logic I was taught at school. We Mexicans have very little variation in our clocks - We go from maybe 11 to maybe 13 hours of daylight comparing Summer and Winter. Ok, make it 10 and 14, to make it sound more dramatic. Having the sun raise at 6AM makes sense, no matter what time of year it is. Most electricity is spent in the early night (8-10PM)... So it makes a lot of sense. Even for the people in the USA, maybe even Canada, and most of Europe. But...
Why do Nordic countries adhere to daylight savings? I mean... You vary from 4 to 20 hours of sunlight a day - What difference does one hour make anyway? Why follow the hassle we all regular humans have to go through? I can't imagine people in Narvik and Rovaniemi trying to squeeze that little glimpse of sun they have during the winter, and trying to align their sleeping time to the exact the sun is only half-visible in Summer.

3 April 2006

Uwe Hermann: HOWTO: Disk encryption with dm-crypt / LUKS and Debian

A few weeks ago I published a small HOWTO for using loop-aes to encrypt your hard drive, usb thumb drive etc. As I have bought a new 300 GB external USB disk drive on Friday, I have tried something new this time: disk encryption using dm-crypt / LUKS. It has been suggested to me multiple times that dm-crypt is superior to loop-aes, however I didn't get a real reason. Yes, it doesn't require any kernel patches and is easier to setup. But has any serious cryptographer looked at it sharply, yet? Did it withhold his eye contact? Anyways, here's how I encrypted my 300 GB drive. I largely followed the guide at the EncryptedDeviceUsingLUKS wiki page...
  1. Make sure you run Linux 2.6.16 or better. Previous versions suffer from an implementation problem which affects the security of dm-crypt, see Linux Kernel dm-crypt Local Cryptographic Key Disclosure.
  2. Enable the following options in your kernel:
    • Code maturity level options
      • Prompt for development and/or incomplete code/drivers
    • Device Drivers -> Multi-device support (RAID and LVM)
      • Device mapper support
      • Crypt target support
    • Cryptographic options
      • AES cipher algorithms
  3. Overwrite the whole drive with random data in order to slow down attacks on the encryption. At the same time perform a bad blocks scan to make sure the hard drive is not going to die too soon:
    badblocks -c 10240 -s -w -t random -v /dev/sdb
    Replace /dev/sdb with whatever is correct on your system. If you're really paranoid, and are willing to wait one or two days, do this:
    dd if=/dev/urandom of=/dev/sdb
  4. Install the required packages:
    apt-get install cryptsetup hashalot
    The current cryptsetup in Debian already supports LUKS, which was not the case a while ago, if I'm not mistaken.
  5. Create one or more partitions on the drive:
    cfdisk /dev/sdb
    I created one big 300 GB partition, /dev/sdb1.
  6. Setup LUKS:
    cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb1
    Enter a good passphrase here. Don't spoil the whole endeavour by chosing a stupid or short passphrase.
  7. Open the encrypted device and assign it to a virtual /dev/mapper/samsung300gb device:
    cryptsetup luksOpen /dev/sdb1 samsung300gb
  8. Create a filesystem on the encrypted device:
    mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/samsung300gb
    I used ext3 with some optimizations, see mke2fs(8).
  9. Mount the encrypted partition:
    mkdir /mnt/samsung300gb
    mount /dev/mapper/samsung300gb /mnt/samsung300gb
    That's it. Everything you write to /mnt/samsung300gb will be encrypted transparently.
  10. For unmounting use:
    umount /mnt/samsung300gb
    cryptsetup luksClose /dev/mapper/samsung300gb
After unmounting, nobody will be able to see your data without knowing the correct passphrase. Drive is stolen? No problem. Drive is broken, and you want to send it in for repair without the guys there poking in your data? No problem. You leave the USB drive at home and some jerk breaks into your house, steals your drive, rapes your wife, and kills your kids? No problem. Well, sort of, but you get the idea ;-) There's more things you can do, thanks to LUKS: have multiple passphrases which unlock your data, change/add/remove passphrases as you see fit, etc. Comments?

2 April 2006

Andres Salomon: backports

Ever since the drive on my laptop died, I’ve been trying an experiment; I’ve been running sarge (debian 3.1) on my desktop. Of course, it’s not vanilla sarge; I’m using packages from backports.org as well. This means I’m running a gnome2.8 system w/ things like thunderbird1.5, kernel 2.6.15, and misc other things upgraded. For the most part, it’s been very successful; I haven’t really found myself wishing the software was newer. However, I would like to play around w/ gnome2.14. To that end, I’d started backporting it; you can find packages here. Unfortunately, I probably won’t finish, as I’m heading back to NYC tonight for at least 2 weeks, and thus won’t have a computer (my laptop is in for repair, my computers are all in Boston, and my office in NYC is unbearable after 10pm and on weekends). So, if someone wants to take up where I left off and upload the whole thing to bpo, go for it. While I found sarge to be quite usable w/ bpo, I don’t know how much longer I would’ve liked to use it. I look forward to AJ’s etch snapshots idea coming to fruition; I think a well motivated group of people could do an excellent job of polishing up a snapshot release (if ubuntu can do it w/ 10 people, using *unstable* as a source, all while adding experimental features like initramfs and xorg, certainly using testing as a base is doable), giving us something that would tide us over between debian stable releases.

Joey Hess: daylight savings crime

(Hmm, it's time for my bi-yearly DST rant. Here goes.) One of the many lame excuses given for daylight savings time is that it cuts down on crime, since more crime occurs after dark. This might be true of violent crime, since fewer people will be out after dark, but what about other crimes? It's interesting to think about ways that criminals could exploit possible confusion, broken data-keeping, etc around the discontinuity caused by daylight saving time changes. Q: Where were you on the night of October 30th 2005 between 1 and 2 am?
A: Well, I was at this bar with my friends that whole hour, I have an alibi. Ok, that's a bit easy to catch (although there's a real life story of a similar trick being used to avoid manslaughter charges), but what about more subtle cheats? All-night workers last night could pretty easily cheat their employer out of an hour's pay, for 2 am to 3 am. Conversely, if they're not careful, their employer might cheat them next fall. The only people I've ever heard discuss this are all-night radio jockies, but those guys love to hear themselves talk enough that an extra hour to do it in is not a problem to them. I'll bet that a fry cook would rather get some extra sleep. But this is still small, er, potatoes. For really nice exploits you have to take advantage of explicit failures of technology. One such failure is in the way Windows manages daylight savings changes. Unlike Unix, which elegantly flips between two time zones, such as EST and EDT, but still keeps counting each second from Jan 1st 1970, Windows actually changes the clock. Despite a brainwashed nation that has been taught that moving the hands back or forward is the right thing to do, in the world of computers, it's bloody stupid. A google for "daylight savings windows bug" turns up a million or so hits caused by this behavior, describing problems like this:
Windows reports erroneous file modification times, which change according to daylight savings.
And this:
When Windows NT automatically adjusts for daylight savings time, the times on files on Windows NT file system (NTFS) partitions and the events in the event logs are retroactively shifted by one hour, even though the files and event records were created before the daylight savings time change.
Now, I think there's all kinds of potential for criminal fun in file modification timestamps being wrong, and log files having innaccurate times. Throw in the odd backup that fails to run due to being scheduled to run at a time that never exists, and the time slip begins to seem like an ideal time for shady activities. (And a very poor time to be in a hospital hooked up to windows-controlled life-support equipment. Double-dose of morphine, anyone?) True story: A year ago I was at a fancy hotel, which was burgalarised. This hotel had electronic locks on the doors, which logged when the doors were opened, and by whom. The techies whose possessions were stolen were able to use this information, plus what they knew about when the theft must to have occurred, to narrow down the suspects to one or two hotel employees who opened the door at the right time. If those logs went to a machine running windows and the theft occurred during England's change to DST, it's quite possible the logs would have been useless. It's not too far from this kind of scenario to something suitable as an entry in Schneier's movie-plot terrorist threats contest. Although it's worth noting that the airline industry deals with timezone changes all the time, so if they have any sense, the DST change is not an exceptional event for them. One of the interesting things about plane travel to me is the way a plane in flight between timezones is a space in which no defined time zone exists. But I digress.. I suspect that the real source of fetile bugs related to DST is in the interstices between operating systems where programs have to deal with the peculuarities of multiple OSes to behave correctly. Such as this unison/linux/windows bug. Put different systems together and they fail in myriad ways, and there's room in the cracks for criminal activity. Thing is, I don't have a very good criminal mind, at all, so if any of the slightly weak approaches I've detailed above is feasable, it seems to me there must be some terrific scams, techniques, etc, that people who are good at thinking that way, and have the right motivation can use.

Barry Hawkins: Defraying technical debt in java-package

I had so many plans for this weekend, but the first of them ate the entire two days. In working on the next release of java-package, I came across some serious issues with alternatives creation that had crept in under my watch when I first became involved with the package. It was one of those times where accepting a huge patch with tons of files introduced an error that I missed; that’s part of the trouble with some patches you receive; they are submitted with someone only thinking of a very specific problem for the moment, with no thought for the package-wide implications and any technical debt the suggested resolution may incur. There was nothing for it but to slog through the install and remove scripts for all 8 JREs and all 8 JDKs looking for the bug’s presence. Sixteen hours later I had corrected the issues and tested the install of all the JREs and JDKs on i386. I had a professor once who asked what was necessary to earn a PhD. After some of the more pompous asses in my class had spouted out their opinions, the professor stated, “a hard butt.” He said it wasn’t about being brilliant so much as it was about being persistent. The friends I have met since then who have shared their PhD stories have confirmed my professor’s allegation. I think Free/Open Source Software development is like that; what does it take to participate? A hard butt. On that note, my sore butt is getting out of this chair. Oh yeah, kudos to Mr. Burrows on aptitude 0.4.0; I love the changes. Control-T alone was worth the wait.

Barry Hawkins: The longer I manage a technical team, the more I am in awe of the Debian Release Team

Just finished a checkpoint of my current development project at work. There are only six developers, and we only have about 18 dependencies on 3rd-party libraries. Even on something that simple, getting the bugs and unresolved issues (after developers had performed their final check-ins of code) cleared up in order to get a 100% pass on the suite of unit tests ended up taking 14 hours over two days. Coordinating changes to the persistence, business, and presentation layers and being able to see the big picture in order to isolate bugs requires intense concentration on my part. On my way out of the office at 20:35, I was thinking about the some 10,000 source packages in Debian and the coordination and effort required to get a release out the door. I am awed. Debian Release Team, you rock. Thanks for Sarge, and I look forward to the Etch release.

Jose Carlos Garcia Sogo: ekiga in Debian

For those of you wondering about why Ekiga is not in unstable yet, the problem seems to be some discussion about MPL in debian-legal of which nobody has informed any of ekiga/opal mantainers (Thanks again for your communication folks!). The main problem is point 3.2, which reads
3.2. Availability of Source Code.
Any Modification which You create or to which You contribute must be made available in Source Code form under the terms of this License either on the same media as an Executable version or via an accepted Electronic Distribution Mechanism to anyone to whom you made an Executable version available; and if made available via Electronic Distribution Mechanism, must remain available for at least twelve (12) months after the date it initially became available, or at least six (6) months after a subsequent version of that particular Modification has been made available to such recipients. You are responsible for ensuring that the Source Code version remains available even if the Electronic Distribution Mechanism is mantained by a third party.
Also, as a comment in annotated MPL 1.1 you can read:
This provision is intended to ensure availability of code, while minimizing the burden on each Contributor. You do not need to ship Source Code to your Modifications with each Executable, as long as you make it available on-line and tell the recipient where it is. It does not require that you return Modifications to mozilla.org or any other named organization. However, you may do so if you choose, and we hope that you wish to participate in the development community that mozilla.org is chartered to foster.
You don't have to ask a lawyer to see that Debian does yet comply with this. As Alioth is now an official Debian system, and as OPAL is being mantained using Alioth and svn.debian.ORG, every patch we can make to OPAL source will be kept not only for those required 6 months, but forever. And nobody can comply about a SCM system not being an accepted Electronic Distribution Mechanism. For those wondering why OPAL is not relicensed using GPL/LGPL, you can ask yourself by performing a quick Google search. Basically the problem is that there were many conributors in the past and that some parts of the code were written sponsored under the condition of the code be kept under MPL. So, please, stop being so integrist and GPL centric. There are other licenses that have problems (as GPL have) but are as DFSG compliant like GPL and BSD are. We have to keep main clean, but we have a lot of problems to solve and we don't need to make up any more.

Holger Levsen: moving and a nice work meeting

March has been a pretty busy month for me, with much less debian work than usual. As you can see in these photos it also has been exceptionally much snow in Hamburg...

Two weeks ago I started moving within the flat into my new quiet and sunny room yay! One day later I lost net access at home, also because of moving :( Luckily I only had to wait twelve days to get back online. I spent most of them renovating, moving and reorganzing stuff and then was too tired in the evenings, when I went online at friends, to do much useful stuff.



Right now it's 3.30am, the debian-edu ftpmaster meeting is almost over and in an hour we'll leave the house to go to the fish market which will start at 5am :) Update: it's 7.30 now, we're back, fish market was very much fun and there are some more fotos online now.

This week(end) has been pretty much fun and got me back into doing debian(-edu) work, although at the moment I'm too tired to properly write this blog entry. Good $timeoftheday!

1 April 2006

Andrew Pollock: [life] Becoming an early riser

I'm a little surprised it's nearly 3 months to the day, since I first wrote about trying to become a morning person again. So it seems like a good time to record the results of the little experiment. In essence, the trick to it is to go to bed when you're tired (staying up as late as you like) and getting up as soon as your alarm goes off, at the same time every day. Within about a week of this, I found I was automatically waking up at around 7am, with or without an alarm, unless I was completely shagged for some reason, or had a particularly bad night's sleep. I did find that I was getting less sleep, as I'd continue not going to bed until late (around 11pm or midnight), but sometimes I'd be tired and crash earlier. The added bonus is on the weekends, I still wake up earlyish, and get to enjoy the feeling of a lie in. Sometimes I'll doze off again for a bit, other times we just get up at a reasonable hour. The upside is we don't burn half the weekend lying in bed.

Next.

Previous.