Search Results: "reg"

12 October 2009

Christian Perrier: What marathon now?

So, now that I completed my 2009 program by running the Cologne marathon 6 months after my first one in Paris, I now plan the 2010 "season"..:-) (one point for you guys who told me that once you start you don't stop) The next step is definitely Paris. The race is close to my home, this is a great race in a great city at a great time. I really can't miss it. So, that one is registered. The point is "what about 'the other one'". I plan to run another marathon during that year, preferably during autumn. Actually, I would probably be able to run at least one more but, well, many people urge me to avoid exxagerating and that includes my beloved wife..:-) So, one more. Which one? At this very moment, I have about 4 options: So, at this moment, Berlin and Donostia have the lead. A good compromise could be running a marathon in Berlin and the 20km Behobia-San Sebastian run which is very popular in Basque country. We'll see..

Stefano Zacchiroli: ocaml-autoconf 1.1

new OCaml Autoconf release: 1.1 We have just released version 1.1 of OCaml Autoconf: a set of M4 macros for integrating your OCaml project with autoconf. It is mostly a regular maintenance release with some bug fixes, some new features, and most notably a new mini-tutorial and example by Richard Jones (including how to deal with automake). Check the news for more info.

10 October 2009

Dirk Eddelbuettel: R for system administration and scripting

On several occassions, R had suggested itself as a language for <it>systems scripting</it>. By this I mean random little adminstrative task such as (re-)moving or maybe renaming files or directories and the like. One of such cases just happened a few minutes ago. The aforementioned Garmin Forerunner 405 can cooperate quite nicely with Linux using the gant reader for the ant wireless communication protocol between the usb hardware dongle and the Garmin 405. (Sources for gant are both this file and this git archive.) I had meant to blog about this tool and the resulting files one of these days anyway, but today I just want to mention that the default filenames created by the program were somewhat horrid such as 20.09.2009 101112.TCX to denote the 20th of September of this year at 10:11h and 12 seconds. As we all know, filenames with spaces are bad for the environment as well as plain annoying. So I had made the simple change in the C sources to switch to a saner format such as 20090920-101112.TCX (and I see that the git archive now contains a similar fix). But that still left me with some 80+ files with the dreaded names. There are of course many ways to skin this cat and to rename the files in bulk. However, I found the following four lines to be fairly succinct
#!/usr/bin/r
files <- dir(".", pattern=".*\\.TCX$")
res <- lapply(files, function(f)  
    pt <- strptime(f, "%d.%m.%Y %H%M%S.TCX")  # parsed time
    ft <- strftime(pt, "%Y%m%d-%H%M%S.TCX")   # formatted time
    file.rename(f, ft)
 )
as they show, among other things, So about five lines and two minutes later, some eighty-ish files were renamed and sanity was restored. Hm, and I took me five times as long to blog this. Lastly, I do not mean to imply that Python or Perl or Ruby or (insert favourite tool here) cannot do it equally well. I simply meant to say that programmatically creating new filenames is definitely easier in R than it would have been in shell. And as an added bonus, we even get fully parsed time objects that I could have tested for. But then tests and documentation never get written on a Saturday.

David Pashley: Blog Copyright

To make things explicitly clear, my blog is copyrighted and licensed as "All rights reserved". It even says that at the footer of every page. That means you may not redistribute any content without my permission. Yes, this means you, Ross Beazley. I may allow aggregation sites to redistribute my content, but the only sites where I have given explicit permission are Planet Debian and Planet BNM. I am unlikely to be upset if your aggregation site links back to the original entry and does not carry advertising, and will probably give you permission. If both these conditions are not met, you do not have permission and will not be granted permission.
Read Comments (7)

9 October 2009

Biella Coleman: Taking Down Internet Pundits

So I love biting irony as a way to make A Point and one of my favorite essays in this regard is If Men Could Menstruate. For a while now, I have been waiting for some biting irony, really mockery, to be launched at the free wheeling Internet punditry that is so common today . Well, here is one amazing video morsel directed at the social media guru (pictured below). Since the social media guru is just one class of Internet pundit, I hope more mockery will follow. <object height="344" width="425"><param name="movie" value="http://www.youtube.com/v/ZKCdexz5RQ8&amp;hl=en&amp;fs=1&amp;"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="344" src="http://www.youtube.com/v/ZKCdexz5RQ8&amp;hl=en&amp;fs=1&amp;" type="application/x-shockwave-flash" width="425"></embed></object>

Biella Coleman: Taking Down Internet Pundits

So I love biting irony as a way to make A Point and one of my favorite essays in this regard is If Men Could Menstruate. For a while now, I have been waiting for some biting irony, really mockery, to be launched at the free wheeling Internet punditry that is so common today . Well, here is one amazing video morsel directed at the social media guru (pictured below). Since the social media guru is just one class of Internet pundit, I hope more mockery will follow. <object height="344" width="425"><param name="movie" value="http://www.youtube.com/v/ZKCdexz5RQ8&amp;hl=en&amp;fs=1&amp;"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed allowfullscreen="true" allowscriptaccess="always" height="344" src="http://www.youtube.com/v/ZKCdexz5RQ8&amp;hl=en&amp;fs=1&amp;" type="application/x-shockwave-flash" width="425"></embed></object>

8 October 2009

Barry Hawkins: More Expensive and Complicated Equals Better: Carseats and Software

So I finally got around to checking out the TED site; I ve quickly become a fan. One of the first talks I watched was Steven Levitt s child carseats talk. Both the talk and the feedback comments on the TED site reminded me of things I see in software development. Here s the video if you haven t seen it.
<object height="326" width="334"><param name="movie" value="http://video.ted.com/assets/player/swf/EmbedPlayer.swf"><param name="allowFullScreen" value="true"><param name="wmode" value="transparent"><param name="bgColor" value="#ffffff"><param name="flashvars" value="vu=http://video.ted.com/talks/dynamic/StevenLevitt_2005G-medium.flv&amp;su=http://images.ted.com/images/ted/tedindex/embed-posters/StevenLevitt-2005G.embed_thumbnail.jpg&amp;vw=320&amp;vh=240&amp;ap=0&amp;ti=30&amp;introDuration=16500&amp;adDuration=4000&amp;postAdDuration=2000&amp;adKeys=talk=steven_levitt_on_child_carseats;year=2005;theme=unconventional_explanations;theme=presentation_innovation;theme=how_the_mind_works;theme=not_business_as_usual;event=TEDGlobal+2005;&amp;preAdTag=tconf.ted/embed;tile=1;sz=512x288;"><embed allowfullscreen="true" bgcolor="#ffffff" flashvars="vu=http://video.ted.com/talks/dynamic/StevenLevitt_2005G-medium.flv&amp;su=http://images.ted.com/images/ted/tedindex/embed-posters/StevenLevitt-2005G.embed_thumbnail.jpg&amp;vw=320&amp;vh=240&amp;ap=0&amp;ti=30&amp;introDuration=16500&amp;adDuration=4000&amp;postAdDuration=2000&amp;adKeys=talk=steven_levitt_on_child_carseats;year=2005;theme=unconventional_explanations;theme=presentation_innovation;theme=how_the_mind_works;theme=not_business_as_usual;event=TEDGlobal+2005;" height="326" pluginspace="http://www.macromedia.com/go/getflashplayer" src="http://video.ted.com/assets/player/swf/EmbedPlayer.swf" type="application/x-shockwave-flash" width="334" wmode="transparent"></embed></object>
Steven Levitt shows in his talk how 30 years of data on car crash fatalities imply that carseats do not outperform regular seatbelts for children ages 2 and up. Anyone who has a child or grandchildren will probably bristle at hearing that; as the father of a pre-schooler, it certainly gave me pause. We spent no small amount of time and decent chunk of money in selecting carseats for our child, thinking we had done our best to ensure our child s safety. For that matter, it would be illegal for us not to have done so. To see a decent-sized data sample suggesting my child would be better off in a seatbelt at her age is rather unsettling. By the end of the talk, I took away these observations: So, software professionals, does any of that sound familiar? It reminds me of numerous initiatives over the years that have led us inexorably to the software productivity morass we have slogged through for years now. I suppose the most heinous case study in my own experience would be J2EE and the insistence that it was the solution that any reasonable business application would choose for a platform. (Before you .Net folks jump on that one, DCOM and later the .Net enterprise stack was much the same.) And who hasn t read a benchmark or white paper with seemingly incontrovertible data depicted in highly-polished graphics insisting that Product Y is the one solution to address them all? I noticed that there were comments below the video on its page at the TED site, largely because the negative verbiage of the topmost comment jumped out at me. I took the time to read through them all (there were 36 at the time of this writing), and to my amusement, I saw parallels between them and how people react to questioning and examining our existing practices and means of developing software. See if any of these strike a chord: In recent years I ve been greatly encouraged by the willingness of companies to question whether or not the heavyweight frameworks and technology stacks are what they should be using. Helping companies slough off high-ceremony processes in favor of right-sized process that focuses on delivering the right software in a timely manner has been some of the more rewarding work I ve done the past several years. I think we have an encouraging number of people in the industry who are challenging the more expensive and complicated always equals better mantra. For the brave individuals willing to put these questions to the community at large, I hope you find some comfort in knowing that the resistance and rejection you will encounter is a thing to be expected; you are not alone in that respect. Here s hoping we continue to be open to self-examination, no matter what emotional responses it might provoke or what fear of the future it may stir up within us.

6 October 2009

Steve Kemp: Poppa's got a brand new bang.

Recently I posted a brief tool for managing "dotfile collections". This tool was the rationalisation of a couple of adhoc scripts I already used, and was a quick hack written in nasty bash. I've updated my tool so that it is coded in slightly less nasty Perl. You can find the dotfile-manager repository online now. This tool works well with my dotfile repository, and the matching, but non-public dotfiles-private repository. I'm suspect that this post might flood a couple of feed agregators, because I've recently my chronicle blog compiler with a new release. This release has updated all the supplied themes/templates such that they validate strictly, and as part of that I had to edit some of my prior blog entries to remove bogus HTML markup. (Usually simple things suck as failing to escape & characters correctly, or using "[p][/P]" due to sloppy shift-driving.) I should probably update the way I post entries, and use markdown or textile instead of manually writing HTML inside Emacs, but the habit has been here for too long. Even back when I used wordpress I wrote my entries in HTML... Finally one other change in the most recent chronicle release is that the "mail-scanning.com theme" has been removed, as the service itself is no longer available. But all is not lost. ObFilm: Blade II

5 October 2009

Christian Perrier: 42195 K lschmeter done!

Here we are back from our german week-end... The major event of this week-end was running the K ln Cologne marathon. Why Cologne? Mostly because my marathon Debian friends Ralf Treinen and No l K the ran it last year and enjoyed it. So, when we ran the Paris marathon together back in April, we decided to run either Berlin or Cologne later on. I finally settled for Cologne because this is closer from Paris and the date was more convenient. That was great also for No l, who lives close to K ln, so of course he planned that race in his (busy) schedule. Unfortunately, Ralf got tendinite problems since last Spring and could not join us. We really hope this will be temporary and we will enjoy running together in the future. So, I spent most of the week-end both visiting Cologne with Elizabeth...and running these 42,195 km. That was great, really. Even if there were much more Germans than in Debian, they were really as friendly and welcoming as Debian Germans are...:-). The race happens in Cologne center city and is well arranged for followers to be able to see runners several times, as the track comes back in the city center several times....with a memorable finish through the cathedral place, then central pedestrian streets and the bridge over the Rhein river (well, climbling it at km.42 is a small PITA, but still..). Animation nearly all along the streets with many K ln inhabitants and tourists encouraging the runners and shouting and applausing and playing percussions, and.... My own race was really as I planned to do it. I targeted 4h exactly (Paris was 4h10) and thus tried to keep a pace of 5'41"/km....which I nearly respected. I had a small alert around km13-15 when my legs where kind of heavy....and I was already imagining a terrible second part for the race. Finally, seeing Elizabeth encouraging me at km.19 in the middle of a big crowd, then passing through Friesen Platz in a great noise and with huge encouragements, just made it. I then completed the first half in 1h59'20", which was just fine. I slightly slowed down between km. 24 and 28, mostly because I was trusting my GPS watch to keep the pace...while it is indeed a bit inaccurate (its kilometers are about 950m long). So, when I realized that I was about 1-2 mins late at km. 30, I decided to accelerate a little and thus target 5'30"/km on the watch...which I could sustain up to km.38. I was fearing cramps and a very hard finish, just as it happened to me in Paris...but finally could finish in a quite good shape and keeping my pace. My final time is officially 4h00'47". So, I missed my target by very few seconds but I am really very happy with the result and the way I finished. Recovering in the hotel's sauna was amazing, after this, and I could then remember all the great moments of that race by viewing Elizabeth's pictures (soon online on my gallery, promise made). And, finally, today, we had another day off to drive back home and continue recovering....and register for Paris Marathon on April 11th 2010..:-)... Hopefully, No l (who did an amazing 3h15) will convince self that he should come with his running friends. So, dear readers, if you reached that part of my blog...I'm afraid you will again read about marathon stories from me.... As everybody was telling me: once you start, you never want to stop..:)

3 October 2009

Frans Pop: debmirror III

debmirror 2.3 should be hitting the mirrors about now. Main change is that it will now use the available diffs to update Contents files, which should give a nice bandwidth reduction for users who mirror those. With that the option --pdiff (for "package diff") no longer really covered its function, so I decided to change it to --diff. There's also a fix for mirroring archives that don't have a Release file. Question for users The option --add-dir has been marked as deprecated (for quite some time now I suspect). I'm considering to remove it in the next release as I cannot see any use cases for it, but it's quite possible I'm missing something and there are still people using it. If you would like that option preserved, then please mail me at debmirror@packages.d.o with an explanation of why and how you use it. Managing the size of a local mirror The archive has grown a lot over the past Debian releases and keeping even a partial local mirror can require quite some disk space. Luckily debmirror offers quite a few options to tune what is mirrored. My own mirror covers testing and unstable 'main' for 6 architectures (i386, amd64, armel, hppa, sparc and s390), no source, no D-I images. It uses only 61G. I say "only" as that's about 33GB less than it could have been without tuning. In other words, I'm saving a bit more than one third! Here are the options I added to achieve this:
--exclude-deb-section='^debug$'
--exclude='/(xen-)?linux-[a-z]+-2\.6[.0-9]*-[-[:alnum:]]*(openvz vserver xen)[-[:alnum:]]*_'
--exclude='(k/kde g/gnome o/openoffice\.org).*/.*_(armel hppa s390)\.deb'
--exclude='(a/axiom/ d/debian-edu-doc/ e/ember( -media)/ e/eclipse(/ -))'
--exclude='(e/erlang g/(gcl(cvs)? ghc6)/ l/llvm(/ -) p/paraview/ o/openturns/)'
--exclude='(s/scalapack(-doc)?/ f/festvox- g/gcc-snapshot/)'
--exclude='(/acl2-books_ /digikam-doc_ /fluid-soundfont-gm_ /deal.ii-doc_)'
--exclude='(/libxmpp4r-ruby-doc_ /lilypond-doc_ /qt4-doc_ /vtk-doc_)'
--exclude='/i18n/Translation-.*\.bz2' --include='/i18n/Translation-(nl de)\.bz2'
And the explanation is: Obviously I have nothing against any of the packages that I exclude. It's just that I don't need them.

Josselin Mouette: Sexism . Again.

I can t say I m surprised, but I m still appalled by reading, again, a completely out-of-reality polemic about a leader of the Free software community being called sexist (among other nice names), after an innocent and random word used in a talk. Oh noes! Serving in the navy will hurt! It s often that you hear jokes or references picturing French as arrogant, Italians as womanizers, geeks as bearded and smelling under the arms, sailors as gay, et c tera. It s called a clich , and it helps people understand each other because it s part of the collective imagination. If you insert a reference to an Italian in a speech about womanizers, it helps picturing the clich of a guy in a black Armani suit, wearing sunglasses and using gomina. It doesn t mean you think Italians are like this, and if it ever convinces someone that they are so, it means that someone really had trouble using the thing she calls brain to begin with. The same goes for a talk about people not being familiar to computers, that is using women as a clich . When you look for a picture in your mind of someone who has trouble with using computers, what do you find? A granny fighting with her keyboard which keys are not in alphabetical order, or a busty blonde following with her eyes each movement of the mouse cursor. It s only natural to use these pictures as a ground for communication, and it doesn t mean you think bad of grannies or busty blondes. And if, because of that or of anything else, some people end up thinking that women can t use a computer, or that they are not equal to men in this regard, these people are the sexist ones. Not the guy who drew that picture in a magazine you read 10 years ago and forgot since, nor the one using it as a reference. My intolerance is worth more than yours And instead of actually focusing on educating or slapping those people, some of us are conducting a witch hunt, in which anyone implying the very existence of different categories of people, called men and women, regardless of his merits or opinions, is called a sexist and has stones thrown to him on several public fora. This is not acceptable. Do not let your speech be dictated by intolerance. If you apply the same reasoning to anyone that could be possibly hurt, in a completely literal and simplistic analysis of the speech, you can stop right now using any kind of metaphor, idiomatic expression or proverb. All that remains is a poor, sterilized speech. And when the speech is poor, the ideas get poorer as well. Imagine what would a complete stranger reading those blogs understand. She would surely picture hackers as a completely misogynistic community in which people only talk about women (whether it is for sexist jokes or for rhetorical discussions about them) and never talk with them. Which would be utterly wrong, since hackers (and geeks in general) are on the contrary open-minded and friendly to feminism, compared to the rest of the population of course, except for the OMG OMG it s a woman! We need to be nice!!! kind. And this is actually the reasoning that hides behind all this insane RMS and Mark Shuttleworth are sexist trolls. The picture they are giving of women are that of fragile little things that need to be protected against any attack of all these evil misogynist bearded geeks. Pretty ironical for people who claim fighting for gender equality, isn t it? Questioning the unquestionable Frankly, RMS and Mark are among the people I trust the less in the community, but I don t need to paint them as misogynists for that. Look at what they say instead of how they say it: one is an intolerant man who used to be a visionary but turned his principles into dogma; the other has seen the light and behaves as if he was the savior of Free software. I d prefer if we questioned their vision and leadership based on their ideas and actions, not on distorted ways to interpret what they say based on a few people s neuroses. Or, to say it shorter: dudes, get a life.

2 October 2009

Barry Hawkins: Just When a Wizard Would Have Been Most Useful: Coaching versus Contracting

Then they stopped, and Thorin muttered something about supper, and where shall we get a dry patch to sleep on? Not until then did they notice Gandalf was missing. So far he had come all the way with them, never saying if he was in the adventure or merely keeping them company for a while. He had eaten most, talked most, and laughed most. But now he simply was not there at all! Just when a wizard would have been most useful, too, groaned Dori and Nori (who shared the hobbit s views about regular meals, plenty and often).

- J.R.R. Tokien, The Hobbit

I am very fond of the works of J.R.R. Tolkien; it would not surprise me to find that many of you recognize these words from the second chapter of The Hobbit titled Roast Mutton . It occurred to me recently that there are parallels between Gandalf s role in The Hobbit and that of an Agile coach. Now, before my fellow Tolkien enthusiasts leap on their keyboards, bear with me on this. Know that I am not saying an Agile coach is on par with a wizard (OK, with one of the Istari sent by the Valar, but let s table that so as not to scare off the normal folk, alright?); that should be enough to calm you down. In the excerpt from The Hobbit at the top of the page, Bilbo and the dwarves have run into their first predicament. Note that it s not a particularly difficult situation; they just need to find shelter and partake of some food. Fire would be nice, too, if it could be managed. (Mind you, it s the first day of their journey; they set off mere hours ago fully provisioned and riding on ponies.) It isn t very long before the fledgling group finds itself not only without shelter and food, but in the hands of three rather nasty trolls who are deciding how best to eat the entire group. Gandalf returns once things have gotten out of control, and with some subtle adjustments to the situation, the crisis is averted. Could Gandalf have come back sooner and spared them this entire experience? Perhaps, but in their struggle a few key things happened. First, the group had to work out how to assess tasks at hand and appropriately delegate. To their credit, that effort was partially successful. The most skilled firestarters were assigned to that task, one of the keen-eyed dwarves was assigned to be the lookout. Second, they gathered some field experience that led to the establishment of improved practices, i.e. don t leave the ponies laden with packs when you make camp, particularly if it s all your food. (They lost most of their food that night when the pony carrying it bolted and ran straight into a nearby river later that night.) Third, Bilbo Baggins was called upon to perform his first task as burglar, albeit a fool s errand that landed them in the troll predicament. While Bilbo was wildly under-equipped for his job, he managed to work through it. That experience began a developmental journey that would prepare him for the great things that would be expected of him later on. This was not Gandalf s first adventure, nor was it the first group of people he needed to equip and challenge in order to develop them to a point that they could accomplish their goal. At this point, he s been in Middle-Earth just shy of 2,000 years. He would have been more than capable of walking them through their entire journey, but to what end? Agile coaching is a discipline that aims to help teams develop their own use of methodologies like Scrum and cross-methodology practices like testing, user stories, etc. This means equipping teams with just enough information to strike out on their own for a bit, then letting them run with it rather than dazzle them with one s own mastery so as to appear like the indispensable demigod. Until people struggle with the terse maxims of Agile Software Development, they cannot internalize them. And when the wizard is always around, why bother struggling? One of my greatest frustrations as an Agile coach is how few companies are willing to take a coaching approach with their Agile adoption. They want you to come in and be the demigod as a full-time contractor. Sure, there are fiscal, political, and seemingly practical reasons that they will cite; I chalk most of them up to being excuses for a lack of willingness to embrace what it would take to face the hard task of nurturing what you have. It s seemingly easier to just throw more money at more bodies and hope that somehow things will all work out, and surely if you can stumble upon some superstar to wrangle the mess, you ll eventually be able to browbeat them into becoming a full-time employee. Don t get me wrong; in some ways, I benefit from this dysfunction. From a selfish business standpoint, having a single full-time client is certainly easier than juggling multiple concurrent clients and their schedules. As far as actually accomplishing the aim of my business, however, I think it hinders the mission. One of my aims in working with companies is to be a coach despite being brought in as a contractor. It s certainly possible, though it is more challenging. There s not that natural separation of the coach from the team that forces them to take up the mantle on their own. Few things in my work are more rewarding than having a developer come to me and say, I wasn t really sure this Agile stuff could work, but now, after going through all this, I wouldn t want to go back to the old way of doing things. Much later in the journey of the hobbit and his dwarf companions, Bilbo is again called upon for a challenging task. His response makes me think Gandalf s approach has worked:
Perhaps I have begun to trust my luck more than I used to in the old days he meant last spring before he left his own house, but it seemed centuries ago but anyway I think I will go and have a peep at once and get it over. Now who is coming with me?

- J.R.R. Tokien, The Hobbit

Here s hoping more people will be willing to embrace the challenging, messy, and altogether beneficial task of equipping teams and allowing them to struggle when necessary, even if it means the occasional scuffle with trolls.

Neil Williams: Cold calls and LinuxExpo

Normally I, like most people, ignore cold calls but someone asking about opinions on software caught my interest - doesn't happen often. Turned out to be a study using contact data gleaned from a now dead Linux magazine which, in turn, had been gleaned from the attendance information submitted to a now all-but dead conference: LinuxExpo (the data itself was hidden in the data stream behind those fancy barcodes on the admission badges).

Simple questions about which languages I used, which development environments I used (questioner hadn't heard of either anjuta or geany but then as she also asked me to spell Debian that was probably to be expected) as well as questions about magazines and other sources of technical information. (She had heard of LinuxFormat and El Reg so that wasn't too bad.) More complex questions about why I chose a particular tool which I couldn't really answer in just a few words seeing as Martin has done an entire thesis on the answers to that question!

Got a more interesting response when asked for my opinion on various vendors - 1 to 5 where 1 is rubbish and 5 is superb. Adobe: 1 - got an oooh, why's that? (umm, no source code and better free software alternatives). RedHat: 4 got a slightly surprised tone but Microsoft: 1 got a "Really? why?" - to which the only answer had to be "release all the source code". :-)

Interesting that RedHat was mentioned, along with Google and Sun/Oracle but neither Ubuntu nor Debian.

Gradually found that the inspiration for the (expensive) methodology came from companies trying to get me to use proprietary demos which then turned into subscription-model tools. No go area for me, all my tools will need to remain free software or I'll just find something else. (Got another "why?" to that - with the inevitable "I need the source code to fix the tools" answer.) Also asked "what are your hobbies?" - to which I could only say "You've spent the last 5 minutes asking about my hobby, my paid work is not in IT".

Despite the call ending not 5 minutes ago, I've no memory of who was doing the survey. Still, she seemed impressed that I've been subscribed to LinuxFormat since about issue 3. :-)

1 October 2009

Gunnar Wolf: Strange scanning on my server?

Humm... Has anybody else seen a pattern like this? I am getting a flurry of root login attempts at my main server at the University since yesterday 7:30AM (GMT-5). Now, from the machines I run in the 132.248.0.0/16 network (UNAM), only two listen to the world with ssh at port 22 And yes, it is a very large network, but I am only getting this pattern on one of them (they are on different subnets, quite far apart). They are all attempting to log in as root, with a frequency that varies wildly, but is consistently over three times a minute right now. This is a sample of what I get in my logs: [update] Logs omitted from blog post, as it is too wide and breaks displays for most users. You can download the log file instead. Anyway This comes from all over the world, and all the attempts are made as root (no attempts from unprivileged users). Of course, I have PermitRootLogin to no in /etc/ssh/sshd_config, but I want to understand this as much as possible. Initially it struck me that most of the attempts appeared to come from Europe (quite atypical for the usual botnet distribution), so I passed my logs through:
  1. #!/usr/bin/perl
  2. use Geo::IP;
  3. use IO::File;
  4. use strict;
  5. my ($geoip, $fh, %by_ip, %by_ctry);
  6. $fh = IO::File->new('/tmp/sshd_log');
  7. $geoip=Geo::IP->new(GEOIP_STANDARD);
  8. while (my $lin = <$fh>) next unless $lin =~ /rhost=(\S+)/; $by_ip $1 ++ ;
  9. print " Incidence by IP:\n", "Num Ctry IP\n", ('='x60),"\n";
  10. for my $ip ( sort $by_ip $a <=> $by_ip $b keys %by_ip)
  11. my $ctry = ($ip =~ /^[\d\.]+$/) ?
  12. $geoip->country_code_by_addr($ip) :
  13. $geoip->country_code_by_name($ip);
  14. $by_ctry $ctry ++;
  15. printf "%3d %3s %s\n", $by_ip $ip , $ctry, $ip;
  16. print " Incidence by country:\n", "Num Country\n", "============\n";
  17. map printf "%3d %s\n", $by_ctry $_ , $_
  18. sort $by_ctry $b <=> $by_ctry $a
  19. keys(%by_ctry);
The top countries (where the number of attempts 5) are:
  1. 104 CN
  2. 78 US
  3. 58 BR
  4. 49 DE
  5. 43 PL
  6. 20 ES
  7. 20 IN
  8. 19 RU
  9. 17 CO
  10. 17 UA
  11. 16 IT
  12. 13 AR
  13. 12 ZA
  14. 10 CA
  15. 10 CH
  16. 8 GB
  17. 8 AT
  18. 8 JP
  19. 8 FR
  20. 7 KR
  21. 7 HK
  22. 7 PE
  23. 7 ID
  24. 6 PT
  25. 5 CZ
  26. 5 AU
  27. 5 BE
  28. 5 SE
  29. 5 RO
  30. 5 MX
I am attaching to this post the relevant log (filtering out all the information I could regarding legitimate users) as well as the full output. In case somebody has seen this kind of wormish botnetish behaviour lately please comment. [Update] I have tried getting some data regarding the attacking machines, running a simple nmap -O -vv against a random sample (five machines, I hope I am not being too agressive in anybody's eyes). They all seem to be running some flavor of Linux (according to the OS fingerprinting), but the list of open ports varies wildly I have seen the following:
  1. Not shown: 979 closed ports
  2. PORT STATE SERVICE
  3. 21/tcp open ftp
  4. 22/tcp open ssh
  5. 23/tcp open telnet
  6. 111/tcp open rpcbind
  7. 135/tcp filtered msrpc
  8. 139/tcp filtered netbios-ssn
  9. 445/tcp filtered microsoft-ds
  10. 593/tcp filtered http-rpc-epmap
  11. 992/tcp open telnets
  12. 1025/tcp filtered NFS-or-IIS
  13. 1080/tcp filtered socks
  14. 1433/tcp filtered ms-sql-s
  15. 1434/tcp filtered ms-sql-m
  16. 2049/tcp open nfs
  17. 4242/tcp filtered unknown
  18. 4444/tcp filtered krb524
  19. 6346/tcp filtered gnutella
  20. 6881/tcp filtered bittorrent-tracker
  21. 8888/tcp filtered sun-answerbook
  22. 10000/tcp open snet-sensor-mgmt
  23. 45100/tcp filtered unknown
  24. Device type: general purpose WAP PBX
  25. Running (JUST GUESSING) : Linux 2.6.X 2.4.X (96%), ( )
  26. Not shown: 993 filtered ports
  27. PORT STATE SERVICE
  28. 22/tcp open ssh
  29. 25/tcp open smtp
  30. 80/tcp open http
  31. 443/tcp open https
  32. 444/tcp open snpp
  33. 3389/tcp open ms-term-serv
  34. 4125/tcp closed rww
  35. Device type: general purpose phone WAP router
  36. Running (JUST GUESSING) : Linux 2.6.X (91%), ( )
  37. Not shown: 994 filtered ports
  38. PORT STATE SERVICE
  39. 22/tcp open ssh
  40. 25/tcp closed smtp
  41. 53/tcp closed domain
  42. 80/tcp open http
  43. 113/tcp closed auth
  44. 443/tcp closed https
  45. Device type: general purpose
  46. Running (JUST GUESSING) : Linux 2.6.X (90%)
  47. OS fingerprint not ideal because: Didn't receive UDP response. Please try again with -sSU
  48. Aggressive OS guesses: Linux 2.6.15 - 2.6.26 (90%), Linux 2.6.23 (89%), ( )
  49. Not shown: 982 closed ports
  50. PORT STATE SERVICE
  51. 21/tcp open ftp
  52. 22/tcp open ssh
  53. 37/tcp open time
  54. 80/tcp open http
  55. 113/tcp open auth
  56. 135/tcp filtered msrpc
  57. 139/tcp filtered netbios-ssn
  58. 445/tcp filtered microsoft-ds
  59. 1025/tcp filtered NFS-or-IIS
  60. 1080/tcp filtered socks
  61. 1433/tcp filtered ms-sql-s
  62. 1434/tcp filtered ms-sql-m
  63. 4242/tcp filtered unknown
  64. 4444/tcp filtered krb524
  65. 6346/tcp filtered gnutella
  66. 6881/tcp filtered bittorrent-tracker
  67. 8888/tcp filtered sun-answerbook
  68. 45100/tcp filtered unknown
  69. Device type: general purpose WAP broadband router
  70. Running (JUST GUESSING) : Linux 2.6.X 2.4.X (95%), ( )
  71. Not shown: 994 filtered ports
  72. PORT STATE SERVICE
  73. 22/tcp open ssh
  74. 25/tcp open smtp
  75. 53/tcp open domain
  76. 80/tcp open http
  77. 110/tcp open pop3
  78. 3389/tcp open ms-term-serv
  79. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  80. Device type: firewall general purpose
  81. Running: Linux 2.6.X
  82. OS details: Smoothwall firewall (Linux 2.6.16.53), Linux 2.6.13 - 2.6.24, Linux 2.6.16
Of course, it strikes me that several among said machines seem to be Linuxes, but (appear to) run Microsoft services. Oh, and they also have P2P clients.
AttachmentSize
Results of parsing the logs21.58 KB
Relevant portion of the logs1.05 MB

Leo 'costela' Antunes: On the origins of perceived gender disparity

I was gonna write this as a comment to Daniel Kahn Gillmor s post on sexism in the FOSS community, but it got a bit too big and I noticed I couldn t log in with OpenID to comment, so here it goes. Do you think that the significant under-representation of women is a problem? I don t think it s a problem in itself, but it is a symptom which can point to a series of problems, with different levels of importance, depending largely on the cultural background involved. That is to say: the reason for this gender disparity may have significantly different roots depending on the place, some of which need to be addressed in completely different ways, if at all. Off the top of my head I d name a few:
  1. Cultural favoring of men as intellectually superior in any given field, filtering women out of participation in said field.
  2. Cultural/religious taboo of women as professionals in general.
  3. Cultural/religious taboo of learning for women.
  4. Cultural favoring of women as superior in some fields, draining other fields of prospective women professionals.
  5. Cultural characterization of certain fields as non-feminine, scaring women away on other grounds than technical capacity.
  6. Cultural expectations regarding pregnancy and marriage, coupled with age expectations for entry level jobs, barring entry to certain fields.
And since I m speaking theoretically, we could also imagine a maternalist culture in which women aren t attracted to IT because it s beneath their level , preferring instead careers in politics or whatever is seen as a superior career in this imaginary culture.
This is obviously bogus, but I feel the need to make at least one Devil s Advocate argument pointing out that women don t necessarily need help achieving equality everywhere. With this in mind, I d say we can start addressing the problems where they exist and for what they are. Seems like a clearer starting point, IMHO. Disclaimer: I m not really active in this endeavor, partly because I ve never believed in any particular large-scale plan to change the scenario. I m more of a small-scale guy: changing the world one person at a time (which is ironically contradicted by the sheer existence of this post, but anyway ).

Ingo Juergensmann: Debian Unstable - nomen est omen

Oh well... in the last days my machine crashed during the nightly backup. When I restarted it the next morning I realized two problems: the LVM is not recognized anymore and my X crashes on startup.
With the help of Tino Keitel (scorpi) I fixed the first issue by installing an older version of the lvm2 package (namely: lvm2_2.02.39-7_i386.deb) and libdevmapper1.02.1 (namely: libdevmapper1.02.1_1.02.37-1_i386.deb). Tino reported this in Bug #546817.

But there's still the Xorg problem left. Xorg.0.log reports:

CODE:
(II) RADEON(0): RADEONRestoreMemMapRegisters() :
(II) RADEON(0): MC_FB_LOCATION : 0xefffe800 0xefffe800
(II) RADEON(0): MC_AGP_LOCATION : 0xf87ff800
restore common
restore crtc1
restore pll1
finished PLL1
set RMX
set FP1
enable FP1
disable primary dac
disable TV
(II) RADEON(0): RandR 1.2 enabled, ignore the following RandR disabled message.

Backtrace:
0: X(xorg_backtrace+0x3b) [0x81314bb]
1: X(xf86SigHandler+0x51) [0x80c57d1]
2: [0xb7f32400]
3: X(xf86DiDGAInit+0x2f) [0x80f08cf]
4: X(xf86CrtcScreenInit+0x110) [0x80ed9e0]
5: /usr/lib/xorg/modules/drivers//radeon_drv.so [0xb7a2a114]
6: X(AddScreen+0x19d) [0x80712cd]
7: X(InitOutput+0x206) [0x80adfa6]
8: X(main+0x1db) [0x80719bb]
9: /lib/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7bb37a5]
10: X [0x8071051]

Fatal server error:
Caught signal 11. Server aborting


Maybe this is Bug #546586? I've already detached the second display, but it still crashes. Pointers and solutions appreciated!

UPDATE: thanks for the points! X is now working again!

30 September 2009

John Goerzen: Sen. Brownback s Visit

Since I asked for suggestions on the Brownback town hall, I figured I ought to report what happened. He was scheduled to spend about 30 minutes in it; he probably spent a total of 40 or 45. He arrived a few minutes early, went around the room shaking hands and asking each person their name (including me). It was polite on the one hand, and a little odd on the other, as he was occasionally reaching over chairs to reach people far away. Anyhow, he stood up front and had a little speech to start with. He spent the first 5-10 minutes talking about local sports teams. It might have been a nice icebreaker if it was 30-60 seconds, but it just felt weird by the time it was over. Everybody knew he was here to talk about other things and had very limited time. He then launched into the economy, talking about keeping taxes down and making sure they re low in Kansas for the recovery. He touched on energy, supporting wind energy (which led to his most memorable comment of the morning: This state blows, and it s got lots of wind, too. ) He also came out in favor of coal, oil, and gas. Basically he s pro-energy. Can t go wrong with that, eh? He rode our prototype all-electric ZTR mower, and praised it quite a bit. He touched on health care briefly, saying that he favors incremental changes to bring down costs. He thought health savings accounts and high-deductible health plans (such as one option at my employer with a $2500 deductible) were good innovations. He then opened it up for questions. There was a brief awkward moment when nobody raised their hand, so I did. I started by saying where I agreed with him. I told him I agreed that health care is way too expensive, that I agree that we need liability reform, and said that we pay almost as much each month in health care as we do in all federal taxes combined. I was going to continue, but he interrupted, and said, Are you serious? Yes. 80% as much in fact. Do you have an illness in your family? My wife has asthma, a thyroid disorder, and we had a baby this year. That s it. Wow. So I continued. I told him I was concerned about the 46 million uninsured Americans, that they weren t getting the care they needed. I pointed out that many of them wouldn t be able to afford that $2500 deductible in the HDHP, let alone regular doctor visits. And I said that it is our moral and even religious duty to take care of the least of these when it comes to health care. He answered by first saying that nobody goes without care that s the law because anybody can get care in any emergency room in the country. Then he spent several minutes describing how he thinks the government can t manage anything, and thus a single-payer system wasn t right for us. After a few minutes of this, he asked if that answered my question. I said that I don t care how the 46 million people get care, whether it s a public option or subsidies for private companies, just that they get it. I also acknowledged that ERs must provide necessary stabilizing care , but pointed out that 20,000 Americans die each year due to inadequate health care and reminded him that ERs are not required to provide diagnostic or preventative services, or long-term treatment of things like cancer. For the first, but not the last, time of the day, at that, he got really quiet, sort of hung his head, and said something like, Yeah, I agree. It is hard on the least of these. I wish we could do more. And moved on to the next question. At this point, it got weird. The next question was a guy that stood up, saying how we ve got to put God back into the constitution. He said he s lived long enough to see the moral decline in this country, and it s going to hell faster than we know. We need to be God-fearing again, he said. Brownback, in reply, again did the quiet hang-his-head thing and said, I agree. Then moved on. We then had a question about state s rights, nullification , and the 10th amendment. Though it was obvious some issue was underneath it, I couldn t figure out just what it was. Brownback, predictably, thinks that the federal government has grown way too powerful. (Ironic for someone that supported the Patriot Act, but hey.) Then one other question, and as he was going to wrap it up, a yelled question from the back: What s good about Kansas? Brownback was caught a bit off-guard, but launched into talking about aerospace, and how he hopes to lure wealthy retirees from California to settle here. All in all, an interesting experience. More respectful than I feared, more scary than I imagined, and about as genuine as I expected a politician at that level gets.

Romain Beauxis: About free software and yellow pages...

Even if it has happened in the past that I could support a pragmatic approach in the context of free software and media technologies, there is something that offenses me in the context of free audio players. In the world of audio streaming servers on for net radios, there are two majors competitors. In the one hand, Shoutcast, the commercial proprietary streaming server released by Nullsoft, which is also the editor of Winamp, the popular media player. On the other hand, Icecast, which started as an open source implementation of the protocol used by Shoutcast, but was rewritten in its version 2 release to support the free codecs from xiph. Now, appart from the respective quality of the two servers, the real competition takes place in another place: availability of the radios using this or that server. For that purpose, both have implemented Yellow Pages. Shoutcast's yellow pages are here, whereas Icecast/Xiph's yellow pages are there. The great thing with yellow pages is their integration into the audio player. Then, the user can browse the list of radios, and test them. It is very good both for convenience no need to download a playlist or enter manually a complicated URL and advertisement a single place to list all possible radios. The yellow pages from Shoutcast are very popular. They are integrated in Winamp of course, but also in many other popular players, in the PSP, in the iPhone, etc... The Shoutcast yellow pages are reserved for shoutcast users. Of course, the protocol has been reversed it is kind of dummy but if your radio get caught registering to Shoutcast's yellow pages while not using their proprietary software, your radio gets blacklisted and you loose a whole lot of listeners (and money too). For that reason, many net radios want to use Shoutcast as their broadcasting server. From the point of view of Nullsoft, it seems a good call. At least, they play their game and make their money out of it, so let's put this appart. But, what about the free software world ? The obvious idea would be that the free software projects should push altogether for the use of free alternatives, hence pushing for a support of Icecast's yellow pages in the free players. Of course, free software being also a matter of choice, it should be possible to also support Shoutcast's yellow pages. After all, both protocols are very simple, so it is no big deal to implement.. Well, unfortunately, that is not exactly what happens.. Guess what, Amarok and VLC only implement Shoutcast's yellow pages... Given that VLC is a massively popular audio player that spreads among a lot of plateforms, I find it quite a pity that they do not do something to encourage its users to use free alternatives to the proprietary Shoutcast yellow pages, and similarly for Amarok. The adoption of free alternatives only works with massive demand, and we should not hope that proprietary softwares help in any way, but, at least, free softwares should be a bit more aware of what they're advocating when they choose to implement only the proprietary support...

28 September 2009

Jon Dowland: Ruby vs. Python

Pablo Lorenzzoni writes to defend Ruby in response to Kanwei Li's April post about dropping it in favour of Python. Kanwei's post has some questionable points that Pablo rightly picks up on (being forced to use ternary operators?) and some that he doesn't ("LOC matters, people."). Just like Kanwei, some time ago I decided to ditch Ruby and focus on Python for the tasks that I would normally use Ruby for. The two final nails in the coffin for me were Interestingly, Pablo cites rubygems as one of the points in favour of Ruby. Whilst both Pablo and Kanwei mostly focus on technical details for their attack and defence of Ruby, these two points for me were largely social, community issues.

26 September 2009

Gunnar Wolf: The bad and the worse; Representative democracies' minimums

Martin rants about the German electoral system. From his rant, I'll pick up only two points And I'll try to connect with Toxicore's excelent (Spanish) blog post, where he quotes political analist Denise Dresser. Dresser has made a great point: Our probably-imposed, legitimacy-impaired president Felipe Calder n has requested the society to talk good about Mexico, to project a positive image of the country. Dresser says, yes, there is a lot of good to talk about the country, and we should emphasize on its richness and beauty, invite people to come and visit, to know what the country is really like. But at the same time, it is our duty to talk bad about the bad areas and decisions of our government, as that is the best (if not the only) thing many of us can do to really get things to happen That is what we can do to push our country's good things forward, to make the country sustainable, to pull attention towards what needs (such as the very very deplorable cases of censorship, human rights violation, ecosystem predation we have seen in the last years). Anyway... What did I want to comment about Martin's post? He criticizes Germany's law requiring a 5% quota for a party to have parliamentary representation. In Mexico, the minimum is 2%. Most people agree, though, that it is too low, and that we should push to increase it. Why? Because the money that is spent in supporting the party system. In Mexico, when a political party fails to get 2% of the vote, it is basically disbanded and it is very hard for it to regroup, to compete again. Many people believe we should aim to a political system with as few political parties as possible (such as the semi-democratic system they have in the USA). I strongly prefer the system found in most European (and even many South American) countries where there is a real wealth of ideological positions represented, and where governments have to be formed by agreeing to form coalitions, as it is almost impossible for them to get full majority. I would much rather see Mexico march towards a parliamentary-based political system, away from the presidential one. Of course, that is almost impossible to expect. With the current political system, we are bound to have forever few monolithic, meaningless political parties. We will likely converge on three blocks, following the current three major blocks (leftoid PRD, centroid PRI, rightoid PAN). They are different in some important senses, yes, but in general they are much the same. I don't hold any hopes to ever see something like the Pirate Party appearing in our system...

Next.

Previous.