Search Results: "reg"

26 September 2009

Christoph Haas: This should work fine nowadays (about vino, Compiz and wrong optimism)

I ve been back from KDE (4.2!) to Gnome and with the mighty powers of Compiz my desktop is the envy of my Windows coworkers and still geeky functional. Well, somehow functional. For a while I wondered why I can t properly use VNC to remote-control my desktop from home. The connection works and I see the desktop but nothing seems to happen when I click or type. Now I figured out the desktop in the VNC client window is just not refreshed while my mouse and keyboard actions really do what they were supposed to on the VNC server. This is my sad tale of how I learned that a regression may mean driving the motorcycle to work in the middle of the night after cursing VNC. :) After a little searching through the lazyweb I found out that it s a bug reported on Ubuntu already. Apparently Compiz doesn t use the XDAMAGE extension properly. Somehow when using the graphics adapter s magic 3D powers X11 loses control of what sections are changed I m not an X11 guru. At least the client doesn t know when to redraw areas of the screen that have changed. The suggested workarounds were pretty ridiculous. Start another x11vnc session without compiz and connect to that. Very funny. I want to control my running desktop not create a new one. So I switched off compiz at work and voila VNC works again. Some eye-candy and shortcuts are gone but remote controlling the desktop is far more important while im on call. But I quickly missed Compiz. The missing eye-candy wasn t that bad. But metacity s window placement algorithm sucks as badly as back in 2002. As if I can hear it whisper: I have no idea where to put that stupid window. You tell me. I researched a little further and somehow the bug is known to Gnome, too. And other users suffering from the problem are pointed to the VirtualGL page of Wikipedia. Apparently the problem was fixed for several people until a regression was reported where things failed again. Seems like the vino developers removed the piece of code that detected the use of 3D window managers as a 2008 christmas present. Their reason: This should work fine nowadays. Hell, no, it doesn t! Somehow I downgraded vino to version 2.24.1-3 and ran the vino server manually (/usr/lib/vino/vino-server sm-disable) to see if it prints any error message. Indeed it does:
Composite detected, disabling XDamage extension.
This is a workaround while XDamage extension does not work correctly with 3d desktops.
Hopefully it will work at next vino release.
This time it worked well, too . I upgraded to the current version 2.28.0-1 (as in unstable by today) and suddenly my VNC connection had the same problems again. Aha! Let s try the Lenny version 2.22.2-1. Works, too. This has taken me hours to debug. Finally I know I can report a bug against the vino package. I wonder how long it would have taken a mortal to figure that out. :( [Sorry to my sponsorees who's package sponsoring requests were delayed again due to this mess.]

Pablo Lorenzzoni: Ruby versus Python

This is not another rant to praise one in spite of the other (an everybody knows I love Ruby, so it would not be impartial), but sometimes people seems to live in another world and do things for the wrong reasons. I just read this blog post by Kanwei Li in which he gives 2 or 3 reasons he ditched Ruby in favor of Python. First of all, both are great languages and, although I favor Ruby, I use Python for some projects and they are not all that different. Of course, everyone is free to choose which language one favors, but Kanwei seems to be ditching Ruby out of not knowing much about it, or out of preferring one style over the other His first reason is that in Python white spaces matter. I used to think this is just a matter of style, but every now and then mandatory alignment hurts me (just try to put together a code generator and you ll notice it). Although my code is always correctly aligned, I like that it s done so because I want it that way, and not because some language demands it. Rants and more rants have been written about Python s mandatory alignment (or other languages lack of it), and I am not going through all of it Just I don t think it s a good reason to ditch Ruby After, he makes a big deal out of Ruby s ternary if. As written by him, he prefers

#python
if len(a) > 0:
        v = a[0]
        a = a[1:]
else:
        v = None
over Ruby s ternary if

#ruby
v = a.empty? ? a.shift : nil
Hey! Come on Ruby s ternary if is not mandatory It was copied from C just as a syntax sugar. You can do without it, just as in Python:

#ruby
if ! a.empty?
    v = a.shift
else
    v = nil
end
Better yet! you can use if s return as v value:

#ruby
v = if ! a.empty?
    a.shift
else
    nil
end
How beautiful is that! Python lacked ternary if for a long time, and when it finally acquired one via PEP 308 its syntax was made different from every other language! Although I don t think that is a problem, some people might think it would be better not reinventing the wheel. Next, Kanwei goes over a famous problem of Ruby: the lack of a sum method for Array. I admit it s strange, but that is completely coherent: Ruby s Arrays are ordered collection of objects and not mathematical arrays. How do you sum objects that are not numbers? Many different people will have many different answers to that, so Ruby leaves this decision for the programmer and provides basic methods to deal with collections of anything (that can be used to apply sum to numbers, if wished). So, in Ruby you have to use Array#inject to perform a sum:

[1,2,3].inject(0)    sum, value  sum + value  
Array#inject (actually Enumerable#inject) was borrowed from Smalltalk and allows you to loop through an array, building up an accumulator value as you go. When it s done, the final value of this accumulator is returned. Very useful for combining array elements, whether by summing them, building up a pretty display string, whatever. In the example above, I am initializing the accumulator with 0. If you use Array to mathematical operations and you want your arrays to work that way, you can always add a sum method to Array class:

class Array
    def sum
        self.inject(0)  sum, value  sum + value 
    end
end
Maybe it would be better if you just use Arrays as containers (as it was intended to) and implement that sum inside your own class I completely agree with Reg Braithwaite here. Kanwei also mention Python is faster than Ruby. That is true, but was more true some time ago. First of all, Python is older and has had more time to improve its speed. Ruby, ITOH, just now acquired a good VM and improvements to it finally can run parallel to improvements in the language itself, so I am expecting this to be less true every release. Python is already not getting much faster between releases, unlike Ruby (the differences between 1.8.7 and 1.9.1 are really impressive!). IMHO this is not a good reason to choose one instead of the other: if you really need speed, go for C :-) Now this is something I find interesting Kanwei has mentioned: Python is more production ready . He argues that Google is using it, so it must be good. Well I cannot argue against that: Google is really using Python. But IBM, Oracle, EA, Cisco, Siemens, etc are using Ruby so that is just a matter of preferring one or another company. Both are production ready I agree, though, that Ruby 1.9.1 has many differences from 1.8.7, and that that may be seen as some inconsistency, but Python also has changed a lot since its 2.0 version, for that matter. And the changes to Ruby brought many benefits I think they worth it. At last, Kanwei compares Python and Ruby docstrings. Here I also have to agree with him: Ruby docstrings sucks. Actually that s why everybody uses rdoc instead (and that is much more powerful than Python s docstrings). Again, I don t think that is reason enough to ditch Ruby (actually, the existence of rdoc, rubygems & friends should bring people to Ruby instead), but that is a matter of personal taste. Surely, Kanwei s reasons were easy to argue against. There are areas were Python shines much more than Ruby (and vice-versa), but those Kanwei mentioned are not among them. I think both languages are powerful enough, and both are way better than Perl or PHP, so either one you choose would be fine. Better if you don t have to choose and use both ;). If you have to, ITOH, pay more attention on how you feel while coding in each one, and not to some cheap reasons such as above. If you are a programmer, what matters most is that you ll spend a lot of time coding with any given language let that be something pleasant then.

John Goerzen: Town Hall Questions

Sen. Brownback (R-KS) will be at my employer Monday, and will have a short town hall session. I m debating whether to go or not, and whether to say anything or not. I don t agree with him on much, and highly doubt that I d change his mind on anything. Should I go? If so, what should I say? Here are some random facts I m considering mentioning: Suggestions? One final note: I will not be doing anything disruptive or disrespectful.

25 September 2009

Gunnar Wolf: Honduras: .hn NIC attacked/intervened by the de-facto government authorities

I was requested to forward this information to as wide an audience as possible. Possibly two months ago the legality/legitimacy of the actions carried out by the Hondurean armed forces, which captured a democratically elected president and without a judicial order or trial process forced him out of the country, starting a de-facto government, was something questionable. Each day, however, it becomes clearer and clearer the Hondureans are suffering a represive military-backed system which cannot be expected to fulfill as a trustable entity to conduct fair, credible elections. I got this message from a Hondurean friend (of course, whose identity I am not divulging) denouncing the government's invasion of the .hn domain name registry, which is handled by the Sustainable Development Network (Red de Desarrollo Sustentable RDS-HN). The National Telecomunications Comission (Comisi n Nacional de Telecomunicaciones, CONATEL) demands all domain name registration under the .hn top-level domain (TLD) to be suspende, and all the lists and databases regarding said TLDs to be handed over, detailing the IP ranges and the responsibles. They did this under the argument that RDS-HN is an Internet Service Provider (which it is not Being a registrar means they are responsible for the well-keeping of public information and of handling a public good, the .hn TLD, not that they provide any kind of regulated service to individuals or organizations), with military personnel disguised as civilians (and who refused to identify themselves). If you are interested, please read further on the text I received straight from my Hondurean contacts (Spanish) (or its unaccurate but often helpful automated translation to English, done through Google Translate) Even though this information is normally accessible via WHOIS and similar services (this only states clearly nobody in CONATEL was able to do what I just did legally and anonymously from my personal workstation), they did it in such a fashion in order to scare the operators and the society. Honduras is going through a very hard process. Whatever happens there will likely impact on the future reactions to the most retrograd and powerful sectors of society in the rest of Latin America. We do our best (even if as non-Hondureans living outside Honduras it only means raising our voices) to avoid the risk of our region going back to the sad, cruel and bloody 1970s history. [update] My friend Mave, who works at NIC Chile, sent as a comment to this post LACTLD's official stand on this regard (Spanish. English version also available). LACTLD (Latin American and the Caribbean ccTLD's Organization) clearly backs RDS-HN and condemns the illegal government's actions.
AttachmentSize
Detailing the intervention attempt of RDS-HN by the de-facto government agents (Spanish)8.61 KB

Kumar Appaiah: Community at work - a success story

This is a positive event which happened to me recently in a Debian bug report, with regard to audio troubles. There are several positives, and I owe some gratitude to several people in the Debian (and ALSA) community, so I thought a blog post would be a good idea. It also shows the advantage in filing a well-written installation report to the Debian project. Here is the description of events.This was an extremely positive experience. While I agree that the number of people who would encounter this quirk may not be large, it makes me happy that at least some users who use Linux on this hardware will not have to face this issue anymore, irrespective of which distribution they use, as long as it carries an up-to-date ALSA.I wanted to share this experience with you, since this is a glowing example of how the "community" approach works perfectly for FOSS. Thanks to Elimar, for being a concerned maintainer, and to the ALSA upstream developers who were proactive in producing a fix to this problem. And, most of all, thanks to me, for filing an installation report; these things really work! (OK, tongue-in-cheek. But I did take the effort of filing it, so I deserve the credit, don't I?) :-)So, have you filed an installation report for your Debian installation? If not, I urge you to do so; I sincerely believe that filing good bugs and being proactive in helping developers zero in on the problem and fix is an important contribution to free software which any user can do. And the best way to start this process in Debian, is with an installation-report. :-)Tags: debian

24 September 2009

David Welton: LangPop.com Updates

It took me a while to get the September update of LangPop.com out. The reason: I had to redo the book statistics. Previously, I got those from Amazon's web service, which worked ok as far as those things go. However, recently, I ran into several problems:
  • They started requiring signatures on the requests, which meant I had to stop and fiddle with my code, which I did not appreciate. (If you have this problem and use Ruby, get the amazon-ecs Ruby gem)
  • Their results suffered from some kind of regression in any case: C, C# and C++ all showed up with the same number of results. They didn't use to show the same numbers. Not good from my point of view.
  • They were completely unresponsive to requests for information or help.
  • And for good measure, they hid their information about their products API on some other web site, with no links from their web services page, which makes it kind of annoying to look for it, and suspicious that they may be removing it at some point in the future.
All of these together made me decide it was time to switch data providers. Where to go? The answer was obvious: back to my home state of Oregon, to Powell's Books, a huge independent book seller. If you ever go to Portland, do yourself a favor and go to Powell's. It is a city block full of books on multiple floors. When I lived in Portland, I would go there before eating to give myself a reason to leave (although they do have a cafe...). And that's just the regular book store. They have another huge space a few blocks away dedicated entirely to technical books. Powell's is one of my favorite things in Oregon, and a great experience. Anyway, I decided that they're big enough, and do enough business online that I'd ask them about getting data, so I sent some email asking after what options were available. I got a very helpful answer from a real person, CJ Stritzel, who was kind enough to explain what the options were, and work with me to help find the best one for what I needed. Definitely better than "/dev/null", the Amazon message board! The API is still something they're working on, but it works well enough for what I need, and I'm quite happy with the situation. It has caused some changes in the rankings, though: they show Java books as being by far and away the most popular, which has pushed that language into the top spot in the rankings. We'll see over the coming months; I may rework the queries I'm using some as their API stabilizes and I experiment with different combinations of keywords. In any case, thanks Powell's, and enjoy the new statistics everyone.

Matthew Garrett: Intel IGD opregion and GMA500

A while back, Intel defined a specification for binding ACPI-defined methods for controlling hardware to the OS-specific driver, ensuring that the two don't get out of synchronisation. I added support for this to the in-kernel i915 driver last year, and after a couple of awkwardnesses it works well now. One consequence of this that showed up slightly later is that it's necessary to do some of the setup from the i915 driver rather than the ACPI driver, which meant that we had to defer the ACPI driver from binding until the drm driver had done that setup.

The problem with GMA500 is that it also implements the IGD Opregion spec, and the ACPI video driver detects this and refuses to bind. But the GMA500 kernel driver doesn't implement support for the spec and so doesn't call the function that triggers the ACPI video registration. Working around this is simple - just add acpi_video_register() to the init function of the GMA500 drm. But note that this means that you're failing to implement the spec properly, and there's potential for stuff to be broken. A full implementation of the spec for GMA500 wouldn't be especially difficult, but there's no docs and I have no hardware so I'm not going to do it myself.

The reason I bring this up is that various people have been approaching this problem in a different way. It's easy to assume that the check in the acpi driver was naively assuming that all Intel hardware was driven by i915 and that this patch was broken. It's actually entirely correct and the (out of tree) GMA500 driver was broken. If Intel had made the effort to get their code properly upstream, it'd have been fixed there when the original change was made and nobody would ever have had a problem. Just say no to out of tree drivers.

Daniel Stone: xds part two

Just under a week after XDS was announced, we've already got 38 (out of 40!) attendees registered. 40 is our current cap, and we need to change it soon if we're going to break that number, so please, ensure you're registered if you're planning to come. If there's too many people, registering now won't bump other people off, it'll just mean that we know we can increase the size a bit. :)

Our accommodation is in 'single sets': a study with adjoining bedroom (single bed), and en suite (so, your own shower and toilet). For the moment, registration is everyone who's signed up on the attendees page, and hasn't told us that they're not staying in the college. Please do not contact Clare College and book the rooms yourself: we have a big group booking.

Wireless will be available in the main conference room, as well as in the bedrooms, and a common area.

So: if you're thinking of coming, register!

Update: We're now at 38 people, not 25. Two spots left.

23 September 2009

Ben Hutchings: Debian kernel team at Linux Plumbers Conference

Most of the Debian kernel team members are attending the Linux Plumbers Conference in Portland over the next 3 days. We'll be discussing kernel packaging and integration issues among ourselves and with upstream and other distributors.~ You may have noticed that Linux 2.6.31 is out but not yet in sid. This kernel version contains a large number of known regressions which should be fixed in subsequent stable updates, so we will wait for those. In the mean time we've uploaded an update to 2.6.30 which should resolve the most serious bugs.

Roland Mas: FusionForge news, September 2009

Here's another round of the semi-regular bulletin about FusionForge. First item: FusionForge 4.8.1 was released this week. It's not exactly an important update, but the 4.8 branch had been accumulating fixes over time and we felt that it would be good to push these fixes out. If you don't encounter particular problems, there's probably no need to upgrade in a hurry. A follow-up for the rewrite of the SCM subsystem: I now consider the Bazaar and Git plugins complete. The missing part, in both cases, was a proper integration of a repository browser and the collection of commit statistics; since one of my clients wants to use Bazaar and another one wants Git, both features have been completed recently. The code still lives on a branch based off 4.8 (for people who need a 4.8-based instance), but it's also been pushed into trunk so the next release will have it natively. Another branch I've been working on (for clients) was about making the Mediawiki plugin able to handle one wiki per project rather than one shared wiki. This is now possible with yet another 4.8-based branch, where the wiki creation is completely automated. A nice feature is that the FusionForge identification is used as a basis for Mediawiki, with different groups on the wiki depending on project membership and role in the forge. That allows specifying wiki permissions in a simple way, for instance to say that only project members can create new pages, authenticated users can only edit existing pages, and non-authenticated users are read-only. This code will be pushed to trunk in the coming weeks. Thanks to Alain Peyrat, we now have a buildbot running Hudson for unit tests and a few other things. The coverage isn't complete yet, but we hope to increase it as time passes. It's already proven useful, by ensuring at least correctness of PHP syntax, encoding and line-endings. I think that's about it for this time. Business as usual.

22 September 2009

Steve Kemp: Hack the planet!

Recently I was viewing Planet Debian and there was an entry present which was horribly mangled - although the original post seemed to be fine. It seemed obvious to me that that some of the filtering which the planet software had applied to the original entry had caused it to become broken, malformed, or otherwise corrupted. That made me wonder what attacks could be performed against the planet aggregator software used on Planet Debian.
Originally Planet Debian was produced using the planet software. This was later replaced with the actively developed planet-venus software instead. (The planet package has now been removed from Debian unstable.)
Planet, and the Venus project which forked from it, do a great job at scrutinising their input and removing malicious content. So my only hope was to stumble across something they had missed. Eventually I discovered the (different) filtering applied by the two feed aggregators missed the same malicious input - an image with a src parameter including javascript like this:
<img src="javascript:alert(1)">
When that markup is viewed by some browsers it will result in the execution of javascript. In short it is a valid XSS attack which the aggregating software didn't remove, protect against, or filter correctly.
In fairness it seems most of the browsers I tested didn't actually alert when viewing that code - but as a notable exception Opera does. I placed a demo online to test different browsers: If your browser executes the code there, and it isn't Opera, then please do let me know!
The XSS testing of planets Rather than produce a lot of malicious input feeds I constructed and verified my attack entirely off line. How? Well the planet distribution includes a small test suite, which saved me a great deal of time, and later allowed me to verify my fix. Test suites are good things. The testing framework allows you to run tiny snippets of code such as this:
# ensure onblur is removed:
HTML( "<img src=\"foo.png\" onblur=\"alert(1);\" />",
      "<img src=\"foo.png\" />" );;
Here we give two parameters to the HTML function, one of which is the input string, and the other is the expected output string - if the sanitization doesn't produce the string given as the expected result an error is raised. (The test above is clearly designed to ensure that the onblur attribute and its value is removed.) This was how I verified initially that the SRC attribute wasn't checked for malicious content and removed as I expected it to be. Later I verified this by editing my blog's RSS feed to include a malicious, but harmless, extra section. This was then shown upon the Planet Debian output site for about 12 hours. During the twelve hour window in which the exploit was "live" I received numerous hits. Here's a couple of log entries (IP + referer + user-agent):
xx.xx.106.146 "http://planet.debian.org/" "Opera/9.80
xx.xx.74.192  "http://planet.debian.org/" "Opera/9.80
xx.xx.82.143  "http://planet.debian.org/" "Opera/9.80
xx.xx.64.150  "http://planet.debian.org/" "Opera/9.80
xx.xx.20.18   "http://planet.debian.net/" "Opera/9.63
xx.xx.42.61   "-"                         "gnome-vfs/2.16.3
..
The Opera hits were to be expected from my previous browser testing, but I'm still not sure why hits were with from User-Agents identifying themselves as gnome-vfs/n.n.n. Enlightenment would be rewarding. In conclusion the incomplete escaping of input by Planet/Venus was allocated the identifier CVE-2009-2937, and will be fixed by a point release. There are a lot of planets out there - even I have one: Pluto - so we'll hope Opera is a rare exception. (Pluto isn't a planet? I guess thats why I call my planet a special planet ;) ObFilm: Hackers.

20 September 2009

Stefano Zacchiroli: gdebi needs you

please help out with gdebi - a history of why Short summary: if you are looking for a way to help Debian become a bit more user friendly, please take care of gdebi in Debian. I'm rather upset. So beware, rant ahead. The reason dates back to the beginning of this afternoon, when a friend of mine, GNU/Linux newbie, mailed me asking for help with his brand new (to my astonishment) Debian Lenny installation running the GNOME desktop environment. The request was simple and common to a lot of our users: "how can I see videos on YouTube and use Skype"? Surely, the first (brief) explanation I gave was why those pieces of software are not in Debian, because they are pieces of evil proprietary software. Fair enough, usual song and dance, that gets the message through. But than, given that I personally care about releasing a completely free operating system, but not necessarily in inhibiting the usage of any non-free bits of software, I wanted to actually solve my friend's problem. Regarding flashplugin-nonfree, unfortunately it is not in Lenny. Two solutions to that: either point him to http://www.backports.org and explain how to use them from synaptic (not particularly hard). Or give him a direct download link of the .deb coming from backports.org. It turns out that for Skype there is no such choice. Once there used to be an APT-gettable repository for their debs, but it seems to have vanished (or else I can't find it). Still, there is a page from which you can download Lenny .debs. Given that for Skype the choice is forced, I was tempted to simply reply to him with a couple of link to .debs and solve his problem rather easily. But wait. Once he has the two debs, how can he install them? First attempt: "just click on them in Nautilus" (my hope: "synaptic will do the right thing ). No way, it will fire up file-roller. Second attempt: "install gdebi (using synaptic), right-click on the deb, and choose ;open with gdebi'". Seems to work, but no, you will be hit by bug #493352. (BTW, the reason why you need the right click is bug #421096). What makes me upset is that both bugs were there way before the Lenny release and slipped through our QA knots. Nobody's fault, the maintainer apparently lost interest (or time) package and stopped caring about it. Happens all the time. But damn!, we will lose a user the moment I tell him "you know, you need to open up a root terminal". A few remarks: this rant is not about "we should invite user to use non-free software"; it is not even about "we should be more attractive to newbies"; it is just about the pity of losing users like this, dumbly. Concluding:
  1. dear lazyweb, any idea of what can I suggest to my friend to install the debs I'll point him to, without needing the knowledge of a terminal?
  2. gdebi in Ubuntu is ahead of lots of version wrt Debian, I'm convinced that it fixes most outstanding issues (given that upstream author is a Canonical employee). If you have some free Debian-time slots (I currently don't) and you care about newbie-accessibility, please consider helping out with gdebi. He needs you.
EOR (end of rant)

Gunnar Wolf: Toast to Turing

I was pointed to this Toast to Turing, by Matt Harvey. Very much worth sharing.
Here s a toast to Alan Turing
born in harsher, darker times
who thought outside the container
and loved outside the lines
and so the code-breaker was broken
and we re sorry
yes now the s-word has been spoken
the official conscience woken
very carefully scripted but at least it s not encrypted
and the story does suggest
a part 2 to the Turing Test:
1. can machines behave like humans?
2. can we?
What, don't you know who Alan Turing was? Read a bit on him then, one of the core seminal minds for Computer Science. And a scientist vilified for being different from what is regarded as normal. [update] And answering to some people's doubts: Why this toast? Because the UK Government, in the voice of the Prime Minister Gordon Brown, after over 50 years of leading Alan Turing to commit suicide due to criminally accusing him for gross indecency for being a homosexual and forcing him into a deep body-altering hormonal therapy to cure him, has finally posthumously apologized. Brown said, So on behalf of the British government, and all those who live freely thanks to Alan's work I am very proud to say: we're sorry, you deserved so much better.

19 September 2009

Sean Finney: dpkg triggers, the lost how-to document

this weekend while giving a bit of TLC to the php packages, i thought i'd finally get around to tackling #490023 and similar bugs, which meant learning about how to use the triggers feature provided by dpkg. unfortunately documentation for this feature was in fairly short supply, and after extensive searching (and by extensive searching i mean typing "dpkg triggers howto" into a google search) i had a couple short manpages (dpkg-trigger(1) and deb-triggers(5)) and an overly verbose and possibly out of date /usr/share/doc/dpkg/triggers.txt.gz. none of these documents really gave a clear "big-picture" for how to get going either. so, as is often the case, i got distracted from my intended task and ended up on a little side-project putting together a nice howto/tutorial for how to integrate dpkg triggers into a package. note that there may be misunderstandings or inaccuracies in the document, as it's based on an afternoon's worth of hacking and q&a directed at #debian-dpkg (thanks to Guillem and Rapha l for fielding those questions). so if i'm off on anything, please feel free to let me know! to get started:
git clone http://git.debian.org/git/users/seanius/dpkg-triggers-example.git

and for those who are too lazy even for that, the README follows: The debian package triggertest This package is a dead-simple "triggers in a nutshell". It shows a few different ways that triggers can be used in practice, to hopefully cover most of the general use cases for triggers. The purpose of triggers Triggers are used to ensure that during the standard package-management process certain operations always run, but not more than necessary. For example: How triggers work in a nutshell Trigger-using packages can be classified in two behavioral categories: When a consumer is triggered, its postinst script is run with the arguments:
postinst triggered "<trigger1> ... <triggerN>"

i.e. $2 contains an iterable list of activated triggers. Note that if a consumer is going to be normally configured (i.e. it is also being updated), then no triggering may occur and thus the standard control flow of the maintainer scripts should still take care to handle this. A "trigger" is declared for the consumer by shipping a file in DEBIAN/triggers (in the case of debhelper based packages, ./debian/consumer-package.triggers will JDTRT). Useful RTFM: deb-triggers(5). Example:
interest /path/to/a/directory
interest my-second-trigger

This declares that the package in question is interested in two triggers. The first trigger has a leading path separator in its name, which instructs dpkg that any filesystem modifications underneath this directory by other packages should cause the respective consumer(s) to be triggered. The second name is completely arbitrary (and also global, so you should probably pick something reasonably specific and identifiable), and will only cause a trigger to be activated when a producer
  1. ships its own triggers file with a corresponding "activate my-second-trigger", or
  2. invokes the trigger explicitly in a maintainer script by calling "dpkg-trigger my-second-trigger".
Another perhaps useful RTFM: dpkg-trigger(1). Examples contained in this source package This source package produces a single "consumer" package and a number of different "producer" packages. The consumer is triggered in various ways, such as: In this case the triggers correspond to an "update-foo" and "update-bar" command, which do nothing other than echo to the console that they are being run. In practice they'd correspond to updating some kind of database or restarting a daemon. More information For more information about triggers, see /usr/share/doc/dpkg/triggers.txt.gz, which will make a lot more sense having a working example like this package as reference. Especially useful is "Transition hints for existing packages", which can be used if you need to gracefully handle migrating in support for triggers across other packages not directly under your control. Corrections, suggestions, etc Are appreciated and should be sent to the author, below. -- Sean Finney seanius@debian.org Sat, 19 Sep 2009 15:57:48 +0200

Stefano Zacchiroli: RC bugs of the week - week 3

RCBW - week #3 And this week we have a new player, welcome on board David! This week summary of mine follows
(As usual, dates are not strictly the day in which a bug has been dealt with, but rather the day of the week I assigned a bug to). Comments / ponderings of this week:

Paul Wise: Delving into personal software freedom

Over on Planet Ubuntu there is a VRMS meme winding down. Usually I tend to think web log aggregator memes are an abomination, however, this one is a little more interesting, especially if Debian folk pick it up. It seems like many Planet Ubuntu posters require some non-free stuff, examples include; graphics and other drivers/firmware, Flash (Gnash/Swfdec aren't there yet), Sun Java (despite OpenJDK), RAR 3.0 archives, LHZ archives (despite jlha), Microsoft fonts (despite ttf-liberation), icon themes, ICC profiles, mind mapping, support for codec DLLs from Windows, VirtualBox drivers for Windows, the Opera web browser, games and other things. For Debian users, the popcon information pretty much confirms the above issues. Some other stuff Debian users use that isn't in Debian include; patented codecs, skype, acroread, the non-free version of VirtualBox and more. Next, lets get in on the getting your meme on part. On my Dell Inspiron 6400 laptop I have following Debian non-free/contrib stuff installed; firmware-iwlwifi, gcc-doc, gcc-doc-base, gcc-4.3-doc, autoconf-doc, gdb-doc, make-doc. On my OpenMoko FreeRunner phone I have nothing installed from Debian non-free/contrib. My wireless router and ADSL modem don't run Debian. The wireless router is a MIPS-based Netgear WGR614L (that is marketed as supporting DD-WRT, OpenWRT and Tomato) so I could conceivably install OpenWRT etc or Debian on it, but I haven't gotten around to that yet. The ADSL modem is a MIPS-based Siemens SpeedStream 4200, but it looks like that would require a significant amount of effort to get running FLOSS. Lets ponder my laptop freeness a bit more. The docs are all FSF-free, but not DFSG-free. It appears they are not DFSG-free because the FSF will not allow 28 words of FSF/GNU advertising to be removed (I'm not sure if Debian or the FSF is more pedantic). I'm not aware of any DFSG-free alternatives to them and I don't particularly care about the restrictions. My wireless card is an Intel 3945ABG mini PCI card that requires the kernel to upload the iwlwifi firmware before it works. Intel refuse to release firmware source code under a free license, citing FCC requirements. I'm not aware of any free firmware (or firmware reverse engineering efforts) for this device so the only alternative is to use wired Ethernet or buy another wireless card. Ethernet wires everywhere would be very inconvenient, so I've been thinking about trying to replace the card or laptop as soon as I am able. Since Atheros has released GPLv2 firmware for its AR9170 802.11n USB chipset I'll probably get something released by Atheros. I wonder why the FCC didn't prevent Atheros from releasing modifiable firmware, perhaps Intel will change their position too. So, what other software is on my laptop apart from Debian? Lets see, nothing on the HD apart from GRUB 2, /boot containing a Linux image/initrd from Debian and the LUKS partition containing swap and the Debian ext3 rootfs. Coreboot laptop support seems to be in the very early stages so I have no alternative to the supplied Dell BIOS at the moment. There is also the CPU microcode and other firmware installed in the various devices on the system, at least the HD, Ethernet, Bluetooth, GPU, DVD drive etc. have some kind of firmware in them. Some of this firmware is updatable using software from the Dell Linux repositories. Lets ponder my phone freeness a bit more. On it I have two copies of the u-boot bootloader (one in the protected NOR flash), u-boot is free. The NAND flash has an old Qt Extended Improved (QTEI) install that I need to copy stuff off and wipe. I also have a 4GB microSD card containing QTEI, Debian, FDOM and SHR. Now that QtMoko has brought QTEI to Debian packages I can probably ditch the QTEI install. I read that OM2009 is being merged into SHR so I can get rid of FDOM. That leaves SHR and Debian/QtMoko (nothing non-free). IIRC SHR does contain some firmware for devices that the OpenMoko FreeRunner doesn't contain, but that will get removed as Linux upstream moves more and more of that into linux-firmware.git. Nothing more on the main flash or microSD storage, so what else? The OpenMoko contains lots of hardware, but the main problematic devices here are the AR6000 Wi-Fi chip and the TI Calypso GSM device. The AR6000 is an issue because the firmware embedded in the chip is non-free and FullMAC so it is hard to add new features like AP mode or improve the connection quality/etc. In addition the firmware currently on the device is a development version of a 2.0 version (1.x was apparently broken) and further development does not seem to be happening yet. Since Atheros GPLed the AR9170 firmware I idly wonder if they could be convinced to release the source and GPL the AR6000 firmware. Perhaps a life-size gold statue of RMS would help there. The GSM device is problematic because of various bugs in the firmware. It apparently is an ARM chip with Nucleos, so perhaps uCLinux or something could be ported to it or written for it. There has been at least one discussion about hacking the GSM firmware (thar be dragons). Searching for some keywords extracted from the end of the first mail in that thread lead to some interesting results indeed. Lets ponder my network freeness a bit more. I should allocate some time to investigate putting Debian on my wireless router and ADSL modem. These generally just work except the ADSL modem reboots itself a lot during the summer. The just-works status of these devices means that messing with them is problematic in case I brick them (luckily I have a spare for the ADSL modem though). I presume OpenWRT and similar have replacements for all the software on my wireless router, drivers may be an issue though. I use gmail for reading email lists, mainly because of intertia, cheapness and because the interface has no GUI FLOSS peers yet (sup-mail exists for console use). TangoGPS, OpenStreetMap and other tools are slowly replacing my use of Google Maps, although I imagine routing will remain an issue for many years yet. One of the tech groups I'm involved in uses Plesk as a hosting control panel, mainly out of intertia, I'm not familiar with any FLOSS replacement though. Some of the upstream FLOSS projects I'm involved with use sourceforge as a hosting platform. There is a certain level of lock-in with SF.net, most of the data is easily exportable though. Lets ponder my software freeness in comparison to Planet Ubuntu posters. I have no freeness issues with drivers at the moment, however firmware seems likely to have freeness issues for a long time to come. I've avoided the need for the Adobe Flash Player by using swfdec and clive for downloading videos for some sites. swfdec works OK for some sites, some that I care about where it doesn't work and clive cannot download video include Vimeo, abc.net.au and sbs.com.au. For Vimeo you can download raw video if you have a login, but I do not, bugmenot is unreliable and Vimeo doesn't seem to be accepting new registrations. SBS I watch on television and ABC I get no reception so I just don't watch it. Java isn't an issue now that OpenJDK exists. I sometimes need to extract RAR 3.0 archives, which I do by copying the files to a friend's Windows machine or using a RAR extractor website. There is no free implementation of a RAR 3.0 extractor yet. I seem to remember that there is source code for a non-free extractor so presumably a clean-room documentation and reimplementation effort could fix this. I don't encounter LHZ files, but jlha-utils is available for if I do. I feel no need to install Microsoft fonts since the Liberation fonts and DejaVu meet my general font needs and Debian contains fonts covering all the scripts of Unicode (except for about half the huge amount of Han characters). In my music collection, only the Voxware audio codec and DigiTrakker MDL files are not supported by Rhythmbox, but I don't really miss those few tracks. I rarely have audio/video codec issues with video from the Internet. I don't have a use for Opera. Thanks in part to the efforts of the Debian games team, games from Debian main (such as warzone2100) satisfy my gaming needs. I just don't use Skype. Overall, I'm generally happy with my level of software freedom. My main strategy for preventing regressions in my software freedom is to just avoid doing things that require non-free software. The most problematic FLOSS issues for me are Flash support (adoption of the HTML5 video tag will resolve this for me), RAR 3.0 support and firmware. Please feel free to contact me with any comments or questions. Happy Software Freedom Day everyone!

18 September 2009

Daniel Kahn Gillmor: Tools should be distinct from Services

Modern daemon implementations can be run in a variety of ways, in a range of contexts. The daemon software itself can be a useful tool in environments where the associated traditional system service is neither needed nor desired. Unfortunately, common debian packaging practice has a tendency to conflate the two ideas, leading to some potentially nasty problems where only the tool itself is needed, but the system service is set up anyway. How would i fix it? i'd suggest that we make a distinction between packages that provide tools and packages that provide system services. A package that provides the system service foo would need to depend on a package that provides the tool foo. But the tool foo should be available through the package manager without setting up a system service automatically. Bad Examples Here are some examples of this class of problem i've seen recently:
akonadi-server depends on mysql-server
akonadi is a project to provide extensible, cross-desktop storage for PIM data. It is a dependency of many pieces of the modern KDE4 desktop. Its current implementation relies on a private instantiation of mysqld, executed directly by the end user whose desktop is running. This means that a sysadmin who installs a graphical calendar application suddenly now has (in addition to the user-instantiated local mysqld running as the akonadi backend) a full-blown system RDBMS service running and potentially consuming resources on her machine.Wouldn't it be better if the /usr/sbin/mysqld tool itself was distinct from the system service?
puppetmaster depends on puppet
Puppet is a powerful framework for configuration management. A managed host installs the puppet package, which invokes a puppetd service to reconfigure the managed host by talking to a centralized server on the network. The central host installs the the puppetmaster package, which sets up a system puppetmasterd service. puppetmaster depends on puppet to make use of some of the functionality available in the package. But this means that the central host now has puppetd running, and is being configured through the system itself! While some people may prefer to configure their all-powerful central host through the same configuration management system, this presents a nasty potential failure mode: if the configuration management goes awry and makes the managed nodes inaccessible, it could potentially take itself out too. Shouldn't the puppet tools be distinct from the puppetd system service?
monkeysphere Build-Depends: openssh-server
The Monkeysphere is a framework for managing SSH authentication through the OpenPGP Web-of-Trust (i'm one of the authors). To ensure that the package interacts properly with the OpenSSH implementation, the monkeysphere source ships with a series of test suites that exercise both sshd and ssh.This means that anyone trying to build the monkeysphere package must pull in openssh-server to satisfy the build-depends, thereby inadvertently starting up a potentially powerful network service on their build machine and maybe exposing it to remote access that they didn't intend. Wouldn't it be better if the /usr/sbin/sshd tool was available without starting up the ssh system service?
Good ExamplesHere are some examples of debian packaging that already understand and implement this distinction in some way:
apache2.2-bin is distinct from apache2-mpm-foo
Debian's apache packaging recently transitioned to split the apache tool into a separate package (apache2.2-bin) from the packages that provide an apache system service (apache2-mpm-foo). So apache can now be run by a regular user, for example as part of gnome-user-share.
git-core is distinct from git-daemon-run
git-core provides the git daemon subcommand, which is a tool capable of providing network access to a git repo. However, it does not set up a system service by default. The git-daemon-run package provides a way for an admin to quickly set up a "typical" system service to offer networked git access.
vblade is distinct from vblade-persist
vblade offers a simple, powerful utility to export a single file or block device as an AoE device. vblade-persist (disclosure: i wrote vblade-persist) provides a system service to configure exported devices, supervise them, keep them in service across system reboots, etc.
Tools are not Services: a ProposalLet's consider an existing foo package which currently provides: I suggest that this should be split into two packages. foo-bin would contain the tool itself, and foo (which Depends: foo-bin) would contain the service configuration information, postinst scripts to set it up and start it, etc. This would mean that every instance of apt-get install foo in someone's notes would retain identical semantics to the past, but packages which need the tool (but not the service) can now depend on foo-bin instead, leaving the system with fewer resources consumed, and fewer unmanaged services running. For brand new packages (which don't have to account for a legacy of documentation which says apt-get install foo), i prefer the naming convention that the foo package includes the tool itself (after all, it does provide /usr/sbin/foo), and foo-service sets up a standard system service configured and running (and depends on foo). Side Effects This proposal would fix the problems noted above, but it would also offer some nice additional benefits. For example, it would make it easier to introduce an alternate system initialization process by creating alternate service packages (while leaving the tool package alone). Things like runit-services could become actual contenders for managing the running services, without colliding with the "stock" services installed by the bundled tool+service package. The ability to create alternate service packages would also mean that maintainers who prefer radically different configuration defaults could offer their service instantiations as distinct packages. For example, one system-wide foo daemon (foo-service) versus a separate instance of the foo daemon per user (foo-peruser-service) or triggering a daemon via inetd (foo-inetd-service). One negative side effect is that it adds some level of increased load on the package maintainers if the service package and the tool package both come from the same source package, then some work needs to be done to figure out how to split them. If the tool and service packages have separate sources (like vblade and vblade-persist) then some coordinating footwork needs to be done between the two packages when any incompatible changes happen. Questions? Disagreements? Next Steps? Do you disagree with this proposal? If so, why? Unfortunately (to my mind), Debian has a long history of packages which conflate tools with services. Policy section 9.3.2 can even be read as deliberately blurring the line (though i'd argue that a cautious reading suggests that my proposal is not in opposition to policy):
Packages that include daemons for system services should place scripts in /etc/init.d to start or stop services at boot time or during a change of runlevel.
I feel like this particular conflict must have been hashed out before at some level are there links to definitive discussion that i'm missing? Is there any reason we shouldn't push in general for this kind of distinction in debian daemon packages? Tags: daemons, packaging, policy

17 September 2009

Anand Kumria: Firefox, Flash, FAIL!

(aside: I have a number of blog posts in draft don't worry they won't spam the various planets but this was timely so I pushed it out first) The most recent version of Firefox 3.x will also prompt you to update your Flash plugin if it is out of date. According to Ken Kovash, the response has been phenomenal. Almost 10,000,000 click through. That is 10,000,000 failures. Like a lot of people, I provide technical support for my Windows using family (and some friends). So I get to see how badly Windows is in the 'update' space. It is pretty common to have: Windows, Anti-virus, Java and one / two other applications (e.g. Google apps, Skype, Yahoo IM, etc.) prompt you with little annoying notification bubbles. Most of them have trained themselves to not look in the bottom right of the screen and to ignore requests to update. Which means that whenever I see a big, important update, like the Firefox one I end up having to remotely take over their machine and do it on their behalf. The user experience was:
  1. Update Firefox.So far, so good.
  2. It prompts and say Flash is out of date.Excellent. Click on link.
  3. Adobe site says "click to upgrade".Great. It also includes, checked by default, a download of McCafe's anti-virus tool something or other.
  4. Realise that pointless download of McCafe is about to happen. Cancel. Uncheck. Download again.Why is Adobe offering me more than just an upgrade of the product I am after? Apparently this is very common in the Windows world (think Safari included with iTunes, etc.)
  5. Adobe figures out I am using Firefox and sends, instead of Flash, a 'Download manager' plugin.It includes instructions on how to enable things so that this plugin is updated by Adobe all the time. I, rather pointlessly, ponder why Flash does not do this itself.
  6. Once installed, you need to restart Firefox. I do so.
  7. This time the "Your Flash is out of date page" does not appear.At this point a normal person would think that they are now secure. Nothing could be further from the truth. Adobe has stupidly decided that first you need to have their update plugin. Then you need to actually do the update. FAIL.
  8. I manually go the the '3.5.3' release note page, where it detects, again, that Flash is out of date.I click through to Adobe's site (again), this time, it figures out that it needs to update Flash. It autoinvokes the autoupdate plugin and does the update.
  9. Prompted to restart Firefox, again. I do so.
  10. Everything is now perfectly fine.
That was a total user experience failure. Not Mozilla's fault but Adobe's. But Mozilla can make a difference in this area. And work around the stupidity of Adobe.
  1. All plugins MUST register a https URL where their version can be checked.
  2. Periodically Firefox does the version checky thing (like with Add-Ons) and ensures they are up to date
That implies that there is a, separate "Your plugins are out of date page" distinct from "You've installed an upgraded version of Firefox"

16 September 2009

Roland Mas: FusionForge 4.7 released

Hot from the oven: FusionForge 4.7 was just released. The release notes follow. If you have local enhancements based on a previous version of GForge, now is the time to port them to the 4.7 codebase and submit them, so they can be merged in time for the next version! Release notes for FusionForge 4.7 This is the first public release of FusionForge. FusionForge is based on GForge, and started as an identical copy, with only a name change to avoid confusion with the proprietary versions of GForge (known as GForge Advanced Server or GForge AS). As such, it benefits from mature code and known-good infrastructure, and builds on it for the future. This 4.7 release is focused on bringing the recent evolutions out to the community in an official stable release. This should provide a solid base as a starting point for community-based development, making it easier for enhancements to be maintained. The FusionForge name was chosen to reflect this: this is a community effort, and we hope to hear about your improvements. Contributing these improvements would make their future long-term maintenance easier for everyone. Major changes since previous versions (of GForge) include: Things to keep in mind when installing: Things to keep in mind when upgrading: For more up-to-date information, please visit http://fusionforge.org/ or http://fusionforge.fusionforge.org/ -- you can even join us on IRC from there! -- The FusionForge development team

Benjamin Mako Hill: Election Season

Two organizations I care deeply about are having elections this month. The first is the Wikimedia Foundation who is electing three community representatives to their board of directors. The second is Ubuntu who will soon be electing a new Community Council. The Wikimedia Foundation is perhaps the most important organization working on issues related to free culture. Wikimedia elections are currently ongoing and will close on August 10th. Editors who have more than 600 edits to their name across all Wikimedia wikis and 50 edits in 2009 made before July 1st are eligible to vote. The vast majority of eligible contributors to Wikimedia projects have not voted in previous elections. Ubuntu will be electing all members in a new --- larger --- Community Council. I have been a member of the council since it was created and I will be standing for election once again --- the last time I plan to do so. Work in setting up the election is being finalized and all Ubuntu Members will be able to vote in the election. Both Wikimedia and Ubuntu are struggling to find the right relationship between the communities who produce most of the value at the heart of their projects and the organizations and leadership structures that try to support and, from time to time, direct it. Ubuntu and Wikimedia are very different. What's at state at these elections is different too. But both elections are are extremely important and at pivotal times in their communities' growth. Both elections will have an important impact on the process of creating new organizational forms. My message in regards to both elections is also the same: If you are eligible to vote, please do. No governance system I've seen has as healthy and close relationship to the community it serves as it should. Wikimedia and Ubuntu are not exceptions. The result is a strange, and unhealthy, relationship between governance systems and the organizations at the heart of our community-driven projects and the communities themselves. We can all do better. There are not enough opportunities for community members to help push this balance in a better direction. These elections are one. I urge everyone who can to vote and to become involved.

Next.

Previous.