Search Results: "reg"

3 January 2010

Debian News: spamassassin update to avoid false positives in 2010

The Lenny version of the spamassassin package contains a regular expressions that considers as coming from the future mails dated in 2010. Starting from a couple of days ago, that has increased the possibility of false positives.
More information about that can be found in some blog posts such as this one and in the Debian BTS, bug #563245.

If you are running spamassassin on a Debian machine, you should probably upgrade it to avoid false positives. That can be easily achieved using the volatile version of spamassassin 3.2.5-2+lenny1.1~volatile1. More information about this update and instructions of how to update in this announcement from the debian-volatile-announce mailing list.

Generally, it is a good idea to have a volatile line in your sources.list. Read more about the debian-volatile project in their website.

Unstable users only need to make sure they update to the latest version available in the archive 3.2.5-7.

Contributed by: Stefano Zacchiroli

2 January 2010

Asheesh Laroia: Detecting stale versions of WordPress

I run a personal server that hosts web space for a few friends. Probably the most popular thing to do with the space is to install WordPress and run a personal blog. A few days ago, I discovered some attackers were abusing one of the sites. Once we upgraded the site to the latest version of WordPress, the attack went away. So I wrote a tool that, every night, emails me a report of the locations of old versions of WordPress. A sample email:
Current version of WordPress: 2.9

oldroommate has WordPress 2.5 in /home/oldroommate/web/oldroommate.com/
Eek! WordPress 2.5 is old!

How it works Each time it runs, it looks at wordpress.org to see what the current version is. The code to do that is written in Python and uses lxml.html. It prints the current version in the report, and it uses it when analyzing WordPress installs. To analyze WordPress installs, it executes locate readme.html, looking for WordPress's tell-tale documentation file. For every such readme.html, if it matches a simple regular expression suggesting it's a WordPress readme file, it performs the following analysis:
  • It does some simple seding and greping looking for the version of WordPress described by that file.
  • If the version detected is older (as calculated by dpkg --compare-versions), it creates a one-line report like the one above about oldroommate.
If it found any installs of old WordPress, it prints a report like the one blockquoted above to stdout.

How to use it To get emails, I run it with cron. You can add a stanza like this to your crontab (edit it with crontab -e):
@daily cd find-out-of-date-wordpress; ./look.sh
Ta-da, nightly reports.

To get a copy Do a git clone: 
git clone git://git.asheesh.org/find-out-of-date-wordpress.git
or browse its gitweb.

Feedback I'm quite interested to hear what others do to avoid old web apps being attacked. If there's another bit of software that monitors web apps for needing upgrades, I'd love to hear about it! Obviously if you have feedback on this tidbit I wrote, let me know. (To me, apt-get doesn't seem to be the answer. Web apps (especially PHP ones) don't usually seem to support keeping the code in one place with multiple different configuration files. And users get excited about the latest and greatest and don't want to wait for me to upgrade, and I can't blame them.) If some of you don't like the Python dependency or anything else, I do welcome patches!

31 December 2009

John Goerzen: My Reading List for 2010

I can hear the question now: What kind of guy puts The Iliad and War and Peace on a list of things to read for fun? Well, me. I think that reading things by authors I ve never read before, people that take positions I haven t heard of before or don t agree with, or works that are challenging, will teach me something. And learning is fun. My entire list for 2010 is at Goodreads. I ve highlighted a few below. I don t expect to read all 34 books on the Goodreads list necessarily, but there is the chance. The Iliad by Homer, 750BC, trans. by Alexander Pope, 704 pages. A recent NPR story kindled my interest in this work. I m looking forward to it. The Oxford History of the Classical World by Boardman, Griffin, and Murray, 1986, 882 pages. It covers ancient Greece and Rome up through the fall of the Roman empire. The Fires of Heaven (Wheel of Time #5) by Robert Jordan, 1994, 912 pages. I ve read books 1 through 4 already, and would like to continue on the series. War and Peace by Lev Leo Nikolayevich Tolstoy, 1869, 1392 pages. Been on my list for way too long. Time to get to it. Haven t read anything by Tolstoy before. The Politics of Jesus by John Howard Yoder, 1972, 2nd ed., 270 pages. Aims to dispel the notion of Jesus as apolitical. An Intimate History of Humanity by Theodore Zeldin, 1996, 496 pages. Picked this up at Powell s in Portland on a whim, and it s about time I get to it. The Myth of a Christian Nation: How the Quest for Political Power Is Destroying the Church by Gregory A. Boyd, 2007, 224 pages. An argument that the American evangelical church allowed itself to be co-opted by the political right (and some on the left) and argues this is harmful to the church. Also challenges the notion that America ever was a Christian nation. Daily Life in Ancient Rome: The People and the City at the Height of the Empire, by Jerome Carcopino, 2003, 368 pages. I ve always been fascinated with how things were on the ground rather than at the perspective of generals and kings, and this promises to be interesting. Slavery, Sabbath, War, and Women: Case Issues in Biblical Interpretation (Conrad Grebel Lectures) by Willard M. Swartley, 1983, 368 pages. Looking at how people have argued from different Biblical perspectives about various issues over the years. To the Lighthouse by Virginia Woolf, 1927, 252 pages. I can t believe I ve never read Woolf before. Yet another one I m really looking forward to. Tales of the Jazz Age by F. Scott Fitzgerald, 1922, 319 pages. Per Goodreads: This book of five confessional essays from the 1930s follows Fitzgerald and his wife Zelda from the height of their celebrity as the darlings of the 1920s to years of rapid decline leading to the self-proclaimed Crack Up in 1936. Ulysses by James Joyce, 1922 (1961 unabridged version), 783 pages. The Future of Faith by Harvey Cox, 2009, 256 pages. Per Goodreads, Cox explains why Christian beliefs and dogma are giving way to new grassroots movements rooted in social justice and spiritual experience. Heard about this one in an interview with Diane Rehm. Being There by Jerzy Kosi ski, 1970, 128 pages. Jesus: Uncovering the Life, Teachings, and Relevance of a Religious Revolutionary by Marcus Borg, 2006, 352 pages. Whether or not you agree with Borg, this has got to be a thought-provoking title. The Three Musketeers by Alexandre Dumas, 1844, 640 pages. The Book of Tea by Kakuzo Okakura, 1906, 154 pages. Per Goodreads: In 1906 in turn-of-the century Boston, a small, esoteric book about tea was written with the intention of being read aloud in the famous salon of Isabella Gardner. It was authored by Okakura Kakuzo, a Japanese philosopher, art expert, and curator. Little known at the time, Kakuzo would emerge as one of the great thinkers of the early 20th century, a genius who was insightful, witty and greatly responsible for bridging Western and Eastern cultures. Nearly a century later, Kakuzo s The Book of Tea is still beloved the world over. Interwoven with a rich history of tea and its place in Japanese society is poignant commentary on Eastern culture and our ongoing fascination with it, as well as illuminating essays on art, spirituality, poetry, and more. More of my list is at Goodreads.

30 December 2009

Gunnar Wolf: Internationalizing into your local customs

It seems strange to me. I don't think I know people as aware of internationalization issues as Bubulle, a.k.a. Christian PERRIER, and I have the feeling his last post regarding how he shall address himself is somewhat short-sighted. That might just mean I am in an even worse position. First, I recognize Christian's concern, but not only when dealing with people from around the globe It happens in my everyday life. When you show an ID stating Gunnar Eyal Wolf Iszaevich, the first reaction is a blank stare of disbelief, only to be followed by a question: So, what is your name? So I understand Christian wants to make it easier for people to guess what his name is in the least obtrusive way possible. I have seen the convention he suggests (uppercasing the family name) AFAICT used by French and Japanese people. But for me, it is intuitively backwards. If I were to emphasize a part of my name, it would be the part by which I expect people to address me with I would write GUNNAR Wolf. And yes, I usually leave out my second given name and my mother's family name, as it is customary here. Well, anyway... Reading my name, few people would guess I live in Mexico. Even fewer will believe I was born here. And if somebody calls me by the wrong part of my name, I won't feel at all offended. I strongly prefer my name to be used, as I like to be addressed casually, but quite often I am introduced as Dr. Wolf, in what at most would be an ex-profeso honoris causas doctorate, or at least an ignoratis causas one.

29 December 2009

Wouter Verhelst: Perl on the N900

Since about a week, I have a Nokia N900. They're not actually on sale in Belgium yet, but I managed to get hold of one through a grey market shop. The device is quite nice. I do have a few irks with the interface here and there, but Nokia has a public bugzilla that I'll surely use to file bugs whenever and wherever appropriate. And after using it for about a week, I thought of migrating this small application which I once wrote on half an afternoon using perl, postgres, and Gtk2, to the device. It's mainly a cataloguing system that I store my DVD collection in (which has gotten large enough that this is necessary), nothing earthshattering. The ideal candidate to get my feet wet in developing for the N900, so to speak. That effort got stopped dead in its tracks pretty quickly. 
Nokia-N900-42-11:~# perl
use Gtk2;
Can't locate Gtk2.pm in @INC (@INC contains: /etc/perl /usr/local/lib/perl/5.8.3 /usr/local/share/perl/5.8.3 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl .) at - line 1.
BEGIN failed--compilation aborted at - line 1.
Nokia-N900-42-11:~# apt-cache search perl
perl - Larry Wall's Practical Extraction and Report Language.
libpcrecpp0 - Perl 5 Compatible Regular Expression Library - C++ runtime files
po4a - tools for helping translation of documentation
libpcre3 - Perl 5 Compatible Regular Expression Library - runtime files
libgdbm3 - GNU dbm database routines (runtime version)
perl-base - The Pathologically Eclectic Rubbish Lister.
liblocale-gettext-perl - Using libc functions for internationalization in Perl
Or, in other words: they only ship the perl bits needed to make dpkg run. Hrmpf. This would make stuff slightly more... involved. Oh well.

John Goerzen: Review: The Happiest Days of Our Lives (by Wil Wheaton)

I started to write this review last night, and went looking for Wil Wheaton s blog, where many of the stories came from, so I can link to it from my review. It was getting late, I was tired, and so I was a bit disoriented for a few seconds when I saw my own words flash up on the screen. At the time, his most recent story had excerpted my review of paper books. Wow, I thought. This never happens when I m about to review Dickens. And actually, it s never happened before, ever. I ll admit to owning a big grin when I saw that one of my favorite authors liked one of my blog posts. And Wil Wheaton is one of my favorite authors for sure. I enjoy reading others too, of course, but Wil s writing is something I can really identify with like no other. My parents were never in a London debtor s prison like Dickens were; I was never a promising medical student like A. C. Doyle. But I was, and am, a geek, and Wil Wheaton captures that more perfectly than anyone. After I read Just a Geek a few years ago, I gave it to my wife to read, claiming it would help her understand me better. I think it did. In The Happiest Days of Our Lives, Wil recounts memories of his childhood, and of more recent days. He talks of flashbacks to his elementary school days, when he and his classmates tried to have the coolest Star Wars action figures (for me: calculator watches). Or how his aunt introduced him to D&D, which reminded me of how my uncle got me interested in computers. Teaching himself D&D was an escape for the geeky kid that wasn t good at sports, as teaching myself Pascal and C was for me. Between us, the names and activities are different, but the story is the same. I particularly appreciated Wil s reflections on his teenage years. Like him, at that age, I often found myself as the youngest person in a room full of adults. Yet I was still a teenager, and like any teenager, did some things that I look back on with some embarrassment now. Wil was completely honest with himself he admitted crashing a golf cart on the Paramount studio lot, for instance, but also reminds me that he was a teenager then. He recognizes that he didn t always make the best choices and wasn t always successful with what he did, but isn t ashamed of himself either. That s helpful for me to remember; I shouldn t be unreasonably harsh on my 16-year-old self, and need to remember that I had to be a teenager too. I also identify with him as a dad. He wrote of counting the days until he could teach his boys about D&D, about passing on being a geek to his sons. I ve had a similar excitement about being able to help Jacob build his first computer. Already Jacob, who is 3, loves using the manual typewriter I cleaned up for him, and spent an hour using the adding machine I dug out on Sunday while I was watching the boys. (I regret that I didn t have time to take it apart and show him how it worked right then when he asked). And perhaps his 2nd-favorite present of Christmas was the $3.50 large-button calculator with solar cell power I got him as an impulse buy at the pharmacy the other day. He is particularly enamored with the square root button because a single press replaces all the numbers on the screen with completely different numbers! I can t find the exact passage now, but Wil wrote at one point about his transition from a career in acting to a career in writing. He said that he likes the feeling he gets when his writing can touch people. He s been able to redefine himself not as a guy that used to be an actor on Star Trek but a person that is a good author, now. I agree, and think his best work has been done with a keyboard instead of a camera. And that leaves me wondering where my career will take me. Yes, I m an author, but of technical books. Authors of technical books rarely touch people s hearts. There s a reason we read Shakespeare and Dickens in literature classes, but no high school English teacher has ever assigned Newton s Opticks, despite its incredible importance to the world. Newton revolutionized science, mathematics, and philosophy, but Opticks doesn t speak to the modern heart like Romeo and Jiuliet still does. Generations of people have learned more about the world from Shakespeare than from Newton. I don t have Wil s gift for writing such touching stories. I ve only been able to even approach that sort of thing once or twice, and it certainly won t make a career for me. Like Wil, I m rarely the youngest person in the room anymore. His days of being a famous teenage actor on a scifi series are long gone, as are mine of single-handedly defeating entire teams at jr. high programming contests. (OK, that s a stretch, but at the time it sure felt exciting.) But unlike him, I m not completely content with my niche yet. I blog about being a geek in rural Kansas, where there still aren t many. I m a dad, with an incredible family. And I write about programming, volunteer for Debian and a few other causes, and have a surprisingly satisfying job working for a company that builds lawn mowers. And yet, I have this unshakable feeling of unsettledness. That I need to stop and think more about what I really want to do with my life, perhaps cultivate some talents I don t yet have, or perhaps find a way to make my current path more meaningful. So I will take Wil s book as a challenge, to all those that were once sure of what their lives would look like, and are less sure with each passing year: take a chance, and make it yours. And on that score, perhaps I ve done more than I had realized at first. Terah and I took a big chance moving to Kansas, and another one when we bought my grandparents run-down house to fix up and live in. Perhaps it s not a bad idea to pause every few years and ask the question: Do I still like the direction I m heading? Can I change it? Wil Wheaton gives me lots to think about, in the form of easy-to-read reflections on his own life. I heartily recommend both Just a Geek and The Happiest Days of Our Lives. (And that has nothing to do with the fact that the Ubuntu machine he used to write the book probably had installed on it a few pieces of code that I wrote, I promise you.)

27 December 2009

Gregor Herrmann: RC bugs 2009/52

a short update on my RC-bug squashing activities: remarks:

Chris Lamb: Readline tab completion using Django models

The following snippet allows readline-style tab completion backed onto Django models. I am using this in management commands in preference to specifying primary keys as arguments. 
class QuerySetCompleter(object):
    def __init__(self, qs, field):
        self.qs = qs
        self.field = field
        self.prefix = None
    def __call__(self, prefix, index):
        if prefix != self.prefix:
            qs = self.qs.values_list(self.field, flat=True)
            if prefix:
                qs = qs.filter(** 
                    '%s__startswith' % self.field: prefix,
                 )
            self.matching = list(qs)
            self.prefix = prefix
        try:
            return self.matching[index]
        except IndexError:
            return None
Example usage: 
import readline
from mymodels import MyModel
completer = QuerySetCompleter(MyModel.objects.all(), 'name')
readline.set_completer(completer)
readline.parse_and_bind("tab: complete")
readline.set_completer_delims('')
while 1:
    print repr(raw_input(">>> "))
Pressing <tab> at this >>> prompt will complete from the name field of the MyModel model just like a regular shell would. We call readline.set_completer_delims as our items may contain word delimeters - otherwise readline would attempt a seperate completion of (eg) "Bar" if one of our items was "Foo Bar".

26 December 2009

Stefano Zacchiroli: RC bugs of the week - week 16

RCBW - week #16 ... and here are christmas (for those who care) RC squashes, by yours truly (for those who care too): and here are the usual notes: Hint/request of the week: please add +pending when you do DELAYED/ NMUs, that way filtering out already taken care of bugs gets easier and refreshing a bug log page in the browser will immediately show the new tag at the top.
(Yes, I agree that nmudiff should offer that when passed --delay, I intend to propose a patch for that, but feel free to beat me at it :-P) In other news, christmas vacations are awesome to catch up with books you planned to finish reading months ago ... Update: the patch for nmudiff I've mentioned has been kindly provided by gregor hermann, thanks!

24 December 2009

Clint Adams: Muppetry

I'm a notoriously late adopter of new technologies. Sure, if I think that something is potentially a good idea, I'll go for it, but for the most part, I assume that things are stupid. I refused to use the WWW for many years, thinking it was idiotic. Now I use the WWW. I find microblogging to be inane and narcissistic at best, but I have derived mild amusement from Shaq on Twitter. Microsoft Windows is something I thought would be ridiculously unsuccessful, because it didn't do anything I would find useful. The list goes on and on, and includes something known in the popular vernacular as configuration management . I've been hearing about BladeLogic and Opsware for quite some time, and idly wondering who the incompetent fools are that need something like this. Back in my day we could manage 100 servers with relative ease; no centralized authentication (because it was a running argument about whether NIS sucked more than NIS+ or vice-versa), no cfengine, no prebuilt server images or any of that jazz. If, for some reason, we needed to make the same change to all servers at once, or some subset thereof, we would just script it. So when one of my acquaintances started raving about Puppet, I assumed it was equally pointless. We'll call him Downs. Downs exhibits a pattern of behavior where he will rave about something for a few weeks, sometimes without having even tried it first, and then eventually become disillusioned with it and start ranting with the same fervor with which he had insisted that whatever fad of the week was the greatest thing ever. It came as no surprise to me when he fell out of love with Puppet and started raving about how much better Chef is. In case you're wondering, he still has not tried Chef to this day. Finally someone convinced me of the value of Puppet. I do not think it is the Way and the Light, but I do see a few situations wherein it makes sense to sacrifice efficiency, flexibility, sanity, and system resources to gain a way of building a near-identical machine from scratch. Now, beyond the flaws inherent to a solution like this, Puppet does have some annoying flaws which I find unnecessary, and which Downs ranted about back when I had absolutely no idea what he was talking about. I disregarded his alleged preference for Chef, but I have heard intelligent people extoll the virtues of Chef, and to a lesser extent Bcfg2. So I took a very brief look at each of those, and was pretty much horrified by what I found. If I need something Puppet-like in the very near future, I will probably be choosing Puppet. I have no intention of running Puppet on machines I manage all by myself though. For that eventuality I am NIHing something with what I consider a better design. The current code is published, but it does not do very much, and requires linking with libdpkg.a which does not exist in any package (but Guillem's working on that, I think). I have no idea whether or not I'll have the motivation to finish it all by myself, but it is Free Software. This post is intentionally weak on details, or deets as the kids call them.

23 December 2009

Ingo Juergensmann: Digikams 100% view

I'm using digikam to organize my pictures I took with my D90 DSLR. I always got the impression that the View -> "Zoom to 100%" menu shows not the full sized image (100%). When using another picture viewing program like okular and choosing View 100% there, I get a "bigger" image. Proof is here:

100% view - Okular vs. Digikam


You can see okulars view on the left in the foreground. Digikams 100% view is in the background at the right. Both apps are showing the same JPEG picture. I don't know that Digikam is doing wrong there, but it's definitely not a 100% view that it shows. Time for a bug report, I guess...

UPDATE:
Oh well... wondering why all those people got the Copyright-Notice.png instead of the real picture, I finally discovered that I need to change the rewrite settings for the IPv4 vhost section as well. IPv6 users hadn't this kind of problem. So, better use IPv6 instead of IPv4, folks! ;-)

And thanks to sgran for pointing out <vhost 1.2.3.4 2001::1:2:3:4> syntax! ;-)

UPDATE 2:
The bug report is filed and registered as #562197.

UPDATE 3:
Problem solved! See bugreport.

Robert Collins: bzr selftest uses testtools


the emperor has new clothes bzr has just changed the base class for its test suite from unittest.TestCase to testtools.TestCase . This change has cleaned up a bunch of test logic, deleted a significant amount of code (much of which was redundant with Python unittest) and added some useful and important features. bzr has only been able to make this change due to testtools expanding its mission from a simple aggregation of proven unittest extensions into one where new extensions that *make unittest more extensible*. My deepest thanks to Jonathan for permitting me to use testtools as the vehicle to put these extension-enabling-extensions (and for his patience in reviewing said changes!). The change was pretty easy: The bulk of the changes were in bzrlib.tests and bzrlib.tests.test_selftest. I chose to cleanup an ugly API at the same time which added a little scattershot across a number of tests. And there are more changes that can be done to take better advantage of testtools the amount of deleted and cleaned up code isn t complete. Even so, its a pretty clear win: 
18 files changed, 228 insertions(+), 496 deletions(-)
What went? bzr had an implementation of TestCase.run. This function is the main workhorse of Python s unittest module, and yet sadly it has to be replaced to change the exceptions that can be raised(to signal new outcomes), or to improve on test cleanup. Testtools provides an API to permit registering new exception types and handlers for them. Like python 2.7 testtools also provides the TestCase.addCleanup API, and these two things combined mean that bzr no longer needs to reimplement the run method. For expected failures, bzr uses a helper method TestCase.expectFailure to perform an existing assertion and convert the test into an expected failure if that assertion does not trigger. This was another feature testtools already provides and thus got deleted. All the custom code for skipping and expected failures got deleted, and the other outcomes bzr uses turned into extensions (as per the run discussion above). In bzr test cases generate a log (because bzr generates a log) and previously the TestResult in bzrlib inspected each test that had been executed to extract the log. This was made simpler by using the details API that testtools provides (see testtools.TestCase.addDetail), which permits tests to add arbitrary data in a semi-structured fashion. This is supported by subunit and a long standing bug with bzr selftest --parallel was fixed as a result logs from tests run in other processes are now carried across the process barrier intact and are presented cleanly. Some other minor cleanups are in unittest compatibility code, where bzr would degrade gracefully with unittest runners, and testtools provides such logic comprehensively, so all that got deleted too. Whats new? I think the most significant new facility that testtools offers bzrlib is assertThat. This assertion is inspired by the very nice assertThat in JUnit (which has changed substantially since Python s unittest was written based on it). This assertion separates the two concerns of raise an exception and decide if an exception should be raised . The separation allows for better reuse of custom checking code, because it permits composition in a cleaner way than extra assertion methods permit. Testtools does not include many matchers as yet, but matchers are easy to write, and if one were to write a small adapter to the hamcrest library, there are a bunch of ready made matchers there (though they have a very Java feel such as is not meaning is which is why Testtools did not use that library). Secondly, the addDetail API referenced above, in combination with testtools.TestCase.addOnException will permit capturing the entire working area when a test fails, something that developers currently have to fiddle about with breakpoints to achieve. This hasn t been done, but is a straight forward patch I hope to do in the new year. Lastly, Testtools offers testtools.TestCase.getUniqueInteger and testtools.TestCase.getUniqueString, which are not as yet used in bzr tests, but we may start using them soon. Beyond that, the other features of testtools are already present in bzrlib, and we simply need to find and delete more duplicated code.

22 December 2009

Benjamin Mako Hill: Center For Future Irony

My sister just got a lower back tattoo that says "No Regrets." She does not seem to appreciate the potential for irony. That's too bad. In my book, that potential is the best reason to get such a tattoo.

Gustavo Noronha Silva: WebKitGTK+ HackFest!

The WebKit hackfest is now over, and I think it was a very productive week. Thank you very much to all who attended, to Igalia for organizing the hackfest, and hosting us so well, to Collabora for having sponsored the event, and allowed me to spend the week working on it, and to the GNOME foundation for having payed all of my costs!
Xan blogged about day 0, and also a summary of all that was done, so I ll focus on the stuff he forgot to mention ;D. The hackfest, for me, started on day -1 with me not allowing Xan to go sleep before he had reviewed a couple patches of mine to fix DOM context menu handling. It always bothered me that Epiphany failed to open right-click menus in some pages, or let pages handle the right click. Well, this is fixed now, and Zimbra users can now have their right click menus, and WoW players can remove talent points from their calculators =P. It turns out that many of the attendees don t like pages messing with their context menus, though, and they had some good points to back up their positions (like pages making it hard to save images, for instance), so I implemented a way to force openning the custom menu: Ctrl-rightclick. We wanted to use a GtkInfoBar to display questions regarding the form saving - our initial implementation always saved all credentials, but that didn t sound good enough. Xan and I thought it would be very complicated to make this work, because there were assumptions in the code regarding which widget contains which, but it turned out to be quite trivial - making EphyEmbed a descendant of GtkVBox instead of GtkScrolledWindow, fixing a small number of assumptions, and that was it. The passwords are saved in the GNOME Keyring. It s interesting to point out that GNOME Keyring seems to be unhappy with the number of passwords a browser stores - Xan s daemon was hanging, crashing, and spawning a large number of threads. My daemon decided to take up some 300MB of RAM at one point. It s somewhat funny to see how much a browser pushes the limits of our platform. We are hoping this will improve with the new keyring APIs, and the rewrite that is ongoing. It s nice to see my browser form passwords in seahorse, though, and be able to manage them like any other. One more thing worth of notice, although this post is already a bit too big: one of the main concerns people had during the Hackfest was on making build time smaller. Touching a single file in WebCore causes a debug build of 10 minutes on my laptop. Evan Martin and Benjamin Otte made a push at removing unnecessary includes from WebCore, and WebKitGTK+ files, which brough the build time down a bit. They end up inspiring Aroben, from Apple, to go even further into this, and remove many includes from files all over WebKit. Evan was also able to bring linking time down by making it possible to link libwebkit without having to build all the intermediate libraries, which brought build time down to 1 minute, when touching a single file in WebCore. Behdad and I also started looking into breaking WebCore up into lots of shared libraries for Debug builds, since we don t care too much about speed penalties in those. None of these experiments got committed yet, but I am hoping we will be having a better time hacking on WebKitGTK+ in the near future. It was awesome meeting everyone, by the way! See you around =).

Andrew Pollock: [life] All that's left is to pick up the keys

Yesterday morning we went to the title company to do all of the paperwork for the condo purchase. I'm still not entirely clear on the whole process, but basically we signed a ton of disclosures and the loan documents, and the whole lot got notarised. I found the thumbprint requirement rather amusing. So the loan should fund today, and the title change will register with the county on Wednesday, and by tomorrow afternoon, we should have the keys. We then had to do a walk through to sign off that the property hadn't turned into a pumpkin since we put the offer in. It was only the second time I've been able to see the place, so it was good to take another look. Sarah's been doing lots of running around to organise quotes for the kitchen renovation and measure the windows for curtains, so she's seen it many more times. There's going to be a few little odd jobs that need doing around the place. There's a few lights that aren't working (presumably just bulb replacements. There's an outside cupboard that's falling apart. There's a little water feature that I think we'll just get rid of, as the pump is a waste of electricity and it'll just breed mosquitoes otherwise. It's going to be home.

Ian Wienand: An open letter to the bald-headed salesman in Harvey Norman, Norwest, Castle Hill

I usally find blog rants useless, but sometimes something is just so annoying one is sufficiently inspired. Today I went with my parents to buy them a Tivo at Harvey Norman, Norwest, Castle Hill, NSW, Australia. I am a big Tivo fan; the interface is good and it "just works". I don't mind paying for (or in this recommending paying for) good products. After selecting the Tivo model, I asked for a HDMI cable. The salesman made a series of questions about what sort of HD TV it was being plugged into; I quickly sensed this as a probe to see what sort of suckers we were, and requested just a "normal" cable. At this point, he insisted on a $130 (you guessed it) Monster cable, and had the audacity to say that we didn't need one of the really expensive cables because our TV wasn't good enough! I openly expressed my concern, but the annoying high-pressure sales pitch had just begun. The amount of, frankly, crap that he spewed about 4-bit this, 10-bit that, legislating of labels, DA signal levels, mythical customers who regretted buying the cheap cables and who knows what else was to the point of being comical if it weren't so insistent and said with such seeming authority. There is only one thing that matters - if the cable has passed the functional requirements for being certified to have the distinctive HDMI logo plastered on it. From the HDMI FAQ:
Q. What testing is required? Prior to mass producing or distributing any Licensed Product or component that claims compliance with the HDMI Specification (or allowing someone else to do such activities), each Adopter must test a representative sample for HDMI compliance. First, the Adopter must self test as specified in the then-current HDMI Compliance Test Specification. The HDMI Compliance Test Specification provides a suite of testing procedures, and establishes certain minimum requirements specifying how each HDMI Adopter should test Licensed Products for conformance to the HDMI Specification.
Now, I can understand that if you buy any old HDMI cable off Ebay for $1, it may be a knock-off that uses the HDMI logo illegally. But there is no way that the certified $50 Philips cable (still very over-priced, but at least not insane, and discounted to $35) performs any differently to some overpriced Monster model certified to exactly the same standard. The thing that annoyed me most was his analogy to buying a tyre. He stated that "if you walked up to a tyre salesman and I said don't want the Pirelli's, just put the cheap-o tires on my Ferrari" I'd be insane, and thus by extension of that logic I was insane for not buying a Monster cable for my great new Tivo. This analogy is completely flawed and really just dishonest. A Ferrari is much more powerful and goes much faster than a standard car. It is plausible it needs a better engineered tyre to perform adequately given the additional stresses it undergoes. A Tivo doesn't put out any more or any less bits than any other HDMI certified equipment, no matter what you do. If the cable is certified as getting all the bits to the other end under whatever environmental conditions specified by the HDMI people, then it's going to work for the 99% of people with normal requirements. Nobody wants to make a significant investment in a piece of audio-visual equipment and feel they are getting something that isn't optimal. Harvey Norman's use of this understandable consumer sentiment to sell ridiculously over-priced cables that do nothing is extremely disappointing. I'm sure the commissions on these things encourage this behaviour, so it is useless expecting the retailer or individual sales assistant to change their policy to reccommend reasonably priced cables. However, it is really Tivo and other manufactuers who get the raw end of this deal; a $130 cable is over 20% of the price the actual Tivo! That is surely affecting people's purchasing decisions. If Tivo and others included a certified HDMI cable with their device, as they do with component cables, and had "Certified HDMI 1.3 cable included" plastered on the box, it would be a harder sell to explain why the manufactuer would bother shipping a certified cable that is supposedly insufficient, and consumers would hopefully avoid the very distasteful high-pressure theatrics I was subjected to today.

Lior Kaplan: Oracle removes gnome packages from its database requirements


As a sysadmin I try to make sure my servers will have the minimal installation needed in order for them to work. In most cases this policy works fine, but some applications depend on too much unneeded software like GUI or sound packages. Two years ago I wrote about Why does Oracle s applications needs xscreensaver in order to run ? . It seems that finally things have changed. In it s latest version of the 10g r2 release notes (B15666-14), Oracle dropped the control-center and gnome-libs packages from the software requirements. This change is only relevant for RHEL5, as the list for RHEL4 (x86_64) haven t changed except from dropping xscreensaver and adding some other packages. Notice that for RHEL5, 3 packages were added in order to let the installer display it s graphical interface:
  • libXp-1.0.0 (i386)
  • libXt-1.0.2 (i386)
  • libXtst-1.0.1 (i386)
I m glad to see Oracle update it s software requirements as a lot of people in the databases world are afraid to make changes which are against the official documentation, regardless of how wrong it might be. Posted in Proprietary software, Red Hat Enterprise Linux, System Administration Tagged: Oracle, software requirements

21 December 2009

David Paleino: RC bug squashing

Just had some time in the last two days, and here's the list of uploaded NMUs. So far, I had only one maintainer complaining (again, sorry!), but I must admit that on Sunday I just didn't follow the correct NMU procedure Sad Anyhow, here's what I have:
  1. #504824 [libnids] FTBFS with GCC 4.4: #elif used instead of #else
  2. #504864 [omnievents] FTBFS with GCC 4.4: missing #include
  3. #504871 [bookmarkbridge] FTBFS with GCC 4.4: missing #include
  4. #504902 [libofa] FTBFS with GCC 4.4: missing #include
  5. #504943 [libassa] FTBFS with GCC 4.4: missing #include
  6. #504963 [libfcgi] FTBFS with GCC 4.4: missing #include
  7. #504970 [italc] FTBFS with GCC 4.4: missing #include
  8. #504973 [libspiff] FTBFS with GCC 4.4: missing #include
  9. #505021 [passepartout] FTBFS with GCC 4.4: missing #include
  10. #505078 [codeine] FTBFS with GCC 4.4: missing #include
  11. #505333 [gloox] FTBFS with GCC 4.4: missing #include
  12. #505372 [bobot++] FTBFS with GCC 4.4: missing #include
  13. #505420 [esteidutil] FTBFS with GCC 4.4: missing #include
  14. #510759 [log4cxx] FTBFS with GCC 4.4: missing #include
  15. #526151 [openmovieeditor] FTBFS with GCC 4.4: missing #include
  16. #551107 [fusecompress] FTBFS with GCC 4.4: missing #include
  17. #551718 [eboard] eboard: FTBFS with latest eglibc and gcc 4.4
Some highlights Most of these bugs, if not all, already had a patch attached. Thanks to Martin Michlmayr for his work on this! Regarding fusecompress, after my upload to DELAYED/2, the maintainer promptly replied asking for sponsorship of a package he already had. So this does not really count Smile If you want to participate in this great game too, and improve our loved distribution, you can have a look at this list of possibly easy bugs to fix. Have fun!

20 December 2009

Gregor Herrmann: RC bugs 2009/51

after attending the Munich BSP 3 weeks ago (thanks for inviting me, & thanks especially to Stefan for hosting me) I've tasted blood & started to look at our RC bugs more often. I'm still far from zack's RCBW frequency; but I thought I'd give a short overview anyway; maybe it motivates others to chime in? So here's a list of RC bugs I've touched in the last weeks (not counting some merges in the BTS): remarks:

Wouter Verhelst: Good, not evil

There is a bit of a fluff online currently about the following clause in the "jsmin" code (whatever that is):
The software shall be used for good, not evil
This seems to have started when Google rejected a project based on that code due to its license being not free or open source according to their standards, and therefore not welcome anymore. The arguments then quickly degenerated into things like 'when did google stop being against evil'. But those are all besides the point. One of the most important properties of free and open source software is that anyone can use it for any purpose; there are no restrictions to using them. The DFSG (and hence, the OSD which was derived from the DFSG) encode this as follows:
No Discrimination Against Fields of Endeavor
The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.
You may think "how is 'evil' a field of endeavor", but that is the wrong question. To "use software for evil" can mean any of a number of things, including "nuclear research", "weapons development", "abortion", or, heck "the cash register in a butchery shop", depending on the ethical and moral framework through which the person writing the license sees the world. The ability to give someone a CD or DVD with a bunch of software on there, being able to tell them that they can just use this in any which way they see fit, is a very strong and important feature of the free and open source community. Every time someone comes up with a clause like the above, however, this ability is diluted somewhat; and if it is readily accepted within the greater free and open source movement, then eventually everyone interested in using a piece of software must first check whether they're not trying to use software that forbids someone's pet evil, and we lose one of the greatest strenghts that does exist for free software, but not for proprietary software. The sad thing is, the jsmin author seems to agree. From a video/transcript on which he talks about his absurd license clause is the following quote:
Also about once a year, I get a letter from a lawyer, every year a different lawyer, at a company I don't want to embarrass the company by saying their name, so I'll just say their initials IBM
[laughter]
saying that they want to use something I wrote. Because I put this on everything I write, now. They want to use something that I wrote in something that they wrote, and they were pretty sure they weren't going to use it for evil, but they couldn't say for sure about their customers. So could I give them a special license for that? Of course. So I wrote back this happened literally two weeks ago "I give permission for IBM, its customers, partners, and minions, to use JSLint for evil."
Or, in other words, all you have to do if you want to use this software for evil is set up a second company, tell Douglas that this second company wants to sell software that uses his software to people who might use it for "evil", even though the first company won't, and you're in business. Because Douglas doesn't really oppose evildoers. So the question is, why is that clause in there in the first place? There are only two possibilities; either Douglas didn't really think about those issues, in which case I hope he will one day see the light and remove the clause; or he did, and decided to go ahead and put that clause there anyway. And that would be evil.

Next.

Previous.