In close to 11 years of living in Europe, I've accomplished plenty beyond working in the high-tech sector: I've also been fairly active in Immigration Policy, especially on aspects that affect migrant labor. Because of this, I keep on getting more and more requests to produce statements or to appear on panels to discuss issues pertaining to migrant labor and to immigrants' integration. The hot topic of last week was Swedish language for immigrants, the crux of the issue being that even though Swedish has an official language status in Finland, in practice, it is pretty much impossibly for immigrants to register their kids at the Swedish language school, to claim public services in Swedish or, even more so, to request labor training in the Swedish language at the Employment Office. The weekly newspaper Helsinki Times, in collaboration with the media think tank Magma, recently conduced a survey of the immigrant population, to find out how much they know about Swedish culture in Finland and about the Swedish language. It was in this context that the Helsinki Times and the national television's Swedish programming (FST) asked for an interview with yours truly, because I have recently visited the Ministry of Employment and Economics with a concrete proposal to facilitate the availability of labor training in the Swedish language. This FST webcast, starting at 16:03 minutes into the show, and the above Helsinki Times article provide more details about the context and about my proposal to the Ministry.

You might have noticed that during last week the Mexican Debian mirror, nisamox.fciencias.unam.mx (a.k.a. ftp.mx.debian.org, a.k.a. debian.unam.mx), went offline. The motherboard died on us, and Facultad de Ciencias was kind enough to give us a brand new one. So, excuse us for the blackout, but we are back Meaner and badder than ever before! Now, Sergio (nisamox's main admin) prefered to rebuild the whole mirror, as there was a shadow of doubt regarding the data integrity. So, rsync was pulling as fast as he could for the whole weekend (leading to some people scratching their heads regarding the 404 for the missing files; sorry, we should have left Apache shut down until the mirror was complete!). After three days of sustaining a 10-20Mbps download from the main mirrors, all 364GB of Debian are finally installed and as you can clearly see we are back to normality, with small, regular mirror pulses and a nice sustained 5-10Mbps (with some up to 40Mbps peaks We have seen up to 100Mbps peaks in the past, and I doubt with the current network infrastructure we won't top that). You can see we have currently plenty of disk space still to fill up. Among our plans is to host the most popular ISOs, which are a common request, and... What else? Well, ask us and we shall do so (quite probably). So, if you switched away from ftp.mx.debian.org due to our downtime, readjust your mirror settings. Nisamox is back!

Attachment	Size
Nisamox Ethernet statistics for the last week	23.38 KB
Nisamox disk space statistics for the last week	24.29 KB

One day, I would love to teach a class on the culture and politics of technology and ditch all of the academic pieces and replace with a string of novels and fictional short stories. Though it may be a few years before I can pull this off, I am already compiling my list and there is naturally a healthy serving of science fiction (along with Kurt Vonnegut, who I adore). Perhaps one my favorite science fiction authors is Philip Dick who edges his readers close to delirum and sometimes insanity and all through mere words. But one of my favorite writings by PD comes not from his fictional fun house but from a regular (and staid) letter composed of a simple and elegant description of what makes science fiction so e(special):

I think Dr. Willis McNelly at the California State University at
Fullerton put it best when he said that the true protagonist of an sf
story or novel is an idea and not a person. If it is *good* sf the
idea is new, it is stimulating, and, probably most important of all,
it sets off a chain-reaction of ramification-ideas in the mind of the
reader; it so-to-speak unlocks the reader s mind so that the mind,
like the author s, begins to create. Thus sf is creative and it
inspires creativity, which mainstream fiction by-and-large does not
do. We who read sf (I am speaking as a reader now, not a writer) read
it because we love to experience this chain-reaction of ideas being
set off in our minds by something we read, something with a new idea
in it; hence the very best since fiction ultimately winds up being a
collaboration between author and reader, in which both create and
enjoy doing it: joy is the essential and final ingredient of science
fiction, the joy of discovery of newness. Philip Dick (in a letter)
May 14, 1981

Truth be told, I don t really know much about science fiction outside of the classics but I look forward to reading more and slowly am adding a few pieces to my collection. And when I need to find out something about sci fi, I turn to Sumana who is pretty well schooled in its ways. She has recently co-edited a new anthology of science fiction stories including one on hardware hacking and faith that some of you might enjoy.

One day, I would love to teach a class on the culture and politics of technology and ditch all of the academic pieces and replace with a string of novels and fictional short stories. Though it may be a few years before I can pull this off, I am already compiling my list and there is naturally a healthy serving of science fiction (along with Kurt Vonnegut, who I adore). Perhaps one my favorite science fiction authors is Philip Dick who edges his readers close to delirum and sometimes insanity and all through mere words. But one of my favorite writings by PD comes not from his fictional fun house but from a regular (and staid) letter composed of a simple and elegant description of what makes science fiction so e(special):

I think Dr. Willis McNelly at the California State University at
Fullerton put it best when he said that the true protagonist of an sf
story or novel is an idea and not a person. If it is *good* sf the
idea is new, it is stimulating, and, probably most important of all,
it sets off a chain-reaction of ramification-ideas in the mind of the
reader; it so-to-speak unlocks the reader s mind so that the mind,
like the author s, begins to create. Thus sf is creative and it
inspires creativity, which mainstream fiction by-and-large does not
do. We who read sf (I am speaking as a reader now, not a writer) read
it because we love to experience this chain-reaction of ideas being
set off in our minds by something we read, something with a new idea
in it; hence the very best since fiction ultimately winds up being a
collaboration between author and reader, in which both create and
enjoy doing it: joy is the essential and final ingredient of science
fiction, the joy of discovery of newness. Philip Dick (in a letter)
May 14, 1981

Truth be told, I don t really know much about science fiction outside of the classics but I look forward to reading more and slowly am adding a few pieces to my collection. And when I need to find out something about sci fi, I turn to Sumana who is pretty well schooled in its ways. She has recently co-edited a new anthology of science fiction stories including one on hardware hacking and faith that some of you might enjoy.

Switzerland voted today for the introduction of biometric passports, with 50.1% for and 49.9% against, one of the closest votes since 1848 (according to NZZ). While the news don t fill me with glee there are too many unanswered questions around the digital passports one aspect of the decision surprised and even shocked me. I do not like biometric passports, because I like to know when my data are consumed, and by whom. The German government assures that only authorised parties can access those data, and published information about the security features of the German biometric passports, but I am unconvinced that those are adequate to protection for the 10 years of validity of the passport. Furthermore, I could find absolutely no information on who the authorised parties are, or which regulations cover who will become authorised in the near future. If that was properly addressed, e.g. by leaving it up to me and only me to decide who gets access, then the digital passport could actually be a good step forward, streamlining border control and making travel easier. But there is a completely different avenue of concern, no matter who gives permission to whom to consume whose data: how are they used, and where, and how long are they stored, and for what? Again, I cannot find any regulations. Instead, my question to the German Department of the Interior was answered (!) along the lines of it being up to each country to decide themselves over the use and storage of the data. In this light, it makes little difference that the German procedure for the digital passport does not permit the issuing bureau to store the data, while Switzerland s strategy is to build a central database of all these personal details (this is what shocked me). It might make you wonder what use the Swiss government is hoping for, and you might feel uncomfortable with your government building up an even tighter database of its people. But I d much rather have my data stored in Switzerland than consumed and stored every time I enter another country, because when I compare the style of governance of Switzerland to pretty much anything else out there, I am glad I get to live here (even though I am not Swiss and cannot vote). Yet, it s a worrying step in a direction of the glass human , of a society in which personal privacy is unknown and everything is part of the system. These are totalitarian visions, and it s doubtful whether we ll ever actually get there (so far, I don t think any state has come up with the information management strategies required to properly store, make use, and read sense out of the massive amounts of information), but the trend is clearly visible. In the end, however, what worries me the most is how relaxed people treat their personal information these days. Look at the infamous social networking sites, or other Web 2.0 gimmicks and you really start to wonder how headless people can be these days. I cannot immediately paint a scenario where it might be dangerous to push all kinds of information about yourself to the masses, but the mere idea of that is scary in and of itself. I d prefer to have the choice with whom to share what data. The biometric passports, despite the advantages they might bring, are one step away from that, because they empower the government to make that choice for you. I don t consider that progress at all. Update: NZZ reports that the issue is not closed. In the cantons of Grishuna and Lucerne, people are challenging the vote and a recount or even re-vote seems possible. I will post an update as soon as I know more. Then, I would also like to address some replies I ve received over the real problems behind the digital passports, because it cannot be just the central data storage it s not like your government doesn t already have all that, and I can t imagine how your fingerprint could be used against you.

It is time for stupid, empty politicians slogans once again in my dear country. And, as always, while we had lively, controversial presidential elections three years ago (and I won't rant this time on why so many Mexicans still believe the current president can only be called a de facto president), the mid-term elections... Fail to get any attention and cause only bored reactions. I am writing today mostly because I stumbled upon Francisco's post on why the Mexican Ecologist Green Party (PVEM) campaign does not impress him. As many, many other people with strong political opinions I know, I will go to the voting booth next July 5th, as I have done every time since I was of age - But I will most probably void my ballot, as I have found nobody worth my vote. And even if I am (and have always been) a leftist person, none of the four so-called leftist parties inspire the smallest bit of confidence. But hell, even the rightist or centrist parties fail to inspire confidence to their voters - After the 2006 electoral fiasco, we got a political system nobody believes in. And all analysts seem to concur that we moved from the most complete presidential regime to an utter partidocracy, where all of the (strong enough) parties cover each other's back not to lose the respective privileges (largely, money, but also law-making faculties and influence, which of course translates to impunity). Worth a very special mention is the crown jewel of political clowns in Mexico - PVEM, the Mexican Ecologist Green Party. A party that gets the gold medal for the most corrupt in our country (which is no small feat). A party where the National Party Presidents to date have only been father and son. And it is alarming because it is the only party apparently gathering more voters than they had before. But also, because of its utter pragmatism and lack of respect for anything they might once have stood for. I still remember on the 1994 elections, the first time they participated in general elections, their slogan was don't vote for a politician Vote for an ecologist... Little did the society know by then they were worse off than our oft-hated politicians. Can you imagine a so-called ecologist party that is expelled of the Global Greens as its behaviour is completely antithetical to anything a green party stands for? A party that promotes reinstating the death penalty (which was abolished from our Constitution, after decades of not being applied, less than a decade ago)? Or they say that, if a given medicine is not available at the Social Security hospitals, the government should pay the citizen so he can go and buy it at a drug store? (of course, if a needed medicine is not available at the Social Security it is most probably because the government is underfunded, not because the lazy administrators don't want to buy the medicines. And yes, with those two retrograde, stupid and -thankfully- completely unfeasible promises they have doubled their probable voters outcome in the past couple of months. The campaigns are only officially starting now. They are all really pathetic. A voter turnout of ~30% is expected. But yes, I am a politized person and just cannot help inviting everybody who has the right to go and vote. If there is somebody worth voting for in your district, please vote for him/her. However... Together with many people I admire, together with many of my friends, together with the people who still believe it is possible to make something out of this forsaken country's politic system... I invite you to void your ballots. Hopefully they will be enough so they must be heard this time.

Some spring days just seem full to bursting with unusual experiences. I spent the night at the yurt and in just four hours today:

• Worked to protect my ethernet cables from spinning blades of doom by encasing them in pipes where my sister wants to mow.
• Just as I was getting into the creek for a dip, a hawk (or similar) flew down the creek through a tangle of trees and almost into my face. We were both pretty startled.
• Got in a splashing war with a dog. Lucy is capable of swimming out into the creek and splashing water three feet high, right at you. We had way too much fun, and now I think one of us is smarter than I'd thought, and the other, perhaps sillier.
• Got home to find a huge box from Amazon. Hmm, I hadn't ordered anything from Amazon... Double hmm, the inside was just full of packing paper... Yipes, there's a big red axe buried in here!

Thanks to Iain M from Melbourne who writes, "We have never met. I have used your software and gained insight from your blog, over the years. So thanks. Also, I have never bought someone an axe before. This is cool." I forgot I had that in my wishlist, but now I can split wood with ease, when I run out of Amazon packaging material to burn.

Is there any way to provide an alternate CSS stylesheet for GoLive CS2 only, not for regular browsers? Because there are some things in that layout that are too difficult for the GoLive renderer, it doesn't display them right. The pages are still editable (just plain XHTML), it's just not looking right in GoLive (advanced CSS).The site already has alternate stylesheets for browsers such as the broken Internet Explorers, so if I could convince GoLive to use their stylesheet it might be looking a lot better in the editor, too ...I am aware that GoLive CS2 has been abandoned in favor of DreamWeaver. Still it's going to be used in a project I help with the web templates.(Other options would be Kompozer and Amaya, but none of them seem really fit for production use: Amaya was just removed from Debian because it had some security issues and the maintainers had the impression the code was such a mess that there will be much more such issues. And Kompozer seemed to be a mostly dead branch of a Gecko hack (although there has been a new alpha release this year) ... is there some reliable opensource non-source HTML editor that I'm missing?)P.S. Sorry, no comments in this blog. Use Email: erich AT debian ORG

After i had to cancel my last attempt to go to Spain due to suddenly catching a heavy flu, I'm now having some holidays in the sun! Not quite like in those lyrics, rather some unexpected but long needed break from my normal routines. Part of them I'll be keeping here, ie I'll be going to C ceres in the next days for real... at least that's my plan now.

Loving regards to those people in Spain and Germany helping me making this possible, so that I can learn and enjoy and recover!

Gobby 0.5 (or to be more precise 0.4.92) just hit the Karmic Koala. Below you can see a screenshot of the new version (just click on it to get a large version). It is sadly not protocol compatible to the old version but it features local undo and redo! Furthermore it's not yet stable on-the-wire wise. The software itself is fairly stable but it could be a bit bumpy if the server protocol version goes out of date. If you want to try it out on earlier versions, I offer backports in the Infinote PPA for Intrepid and up. I hope to get to Hardy soon, sadly it needs some more backports. There is a public server available on gobby.0x539.de if you want to try it out (connections are encrypted, but all contents are public and can be deleted by everybody, wiki-like; so please be considerate and non-destructive). On local networks Gobby will look for servers through Avahi. That said Gobby is not yet able to host servers by itself, like the old version did. You have to install the infinoted server. You can do this on any computer, even on the local network and take advantage of Avahi. If you want encrypted connections you need to create certificates but if an unencrypted session is acceptable you can get an ad-hoc server by invoking infinoted --security-policy=no-tls without further configuration. It will persist content across invocations, too. Thanks to Greg Heynes, there will also be a KDE client for Gobby, called... Kobby! The first time someone actually uses the fact that the software uses a library for interoperability. Interesting that it's done now when the library's C instead of C++ (which obby was written in), with Qt being C++ anyway. I'm not yet aware of packages but I really hope that we can release with both. If you encounter problems, please report them to our Trac (preferred) or Launchpad.

I have decided that is high time to declare svn-buildpackage orphaned since many people are replying on it to be useful, but nobody cared enough to answer to the RFH Eduard Bloch made some 3 years ago.

I know it would have been better if I would have asked a request for adoption, but, honestly, the package didn't had a maintainer in the last year and that would have been lying to everybody.

The package is quite important and I would hate to see it leave the official archive since many people do need it and use it regularly (I know for sure the GNOME, Perl and the Debian Games Team use it) and I have enjoyed working on the package while I was motivated.

The code is maintained in SVN and the trunk can be viewed at:

http://svn.debian.org/wsvn/collab-maint/deb-maint/svn-buildpackage/trunk/

and can be checked out with any of these commands:

# read-only copy
svn co svn://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk svn-buildpackage

# read write, if you have an account on alioth.debian.org:

svn co svn+ssh://svn.debian.org/svn/collab-maint/deb-maint/svn-buildpackage/trunk


Also, note that the package has several features which the new maintainer(s) should be aware of and must make sure they all work when changing the code. Also, there are some things to remember:

• there is support for native and non-native packages
• non-native packages' repo can be a complete repo (with an upstream branch) or an incomplete repo (just the differences from the upstream - most times the debian directory, but not always)
• there is an interactive and a non-interactive mode, both have to work properly
• the packages can be stored in the repo under 2 different layouts and both have to work since they are both used; support for an arbitary layout would be great and I have a few ideas about how to implement that, so please contact me if you want to work on that
• team maintainance workflow MUST be supprted and should be one of the highest concerns for the maintainer; this means that being able to work on a new package without issuing more than one command to have all necessary stuff for the build, package upgrades to be done is the target to reach for (currently the situation is a lot better than it was in the past)
• there is on misfeature from the past that should be finally dealt with - something that was supposed to work as a cache ended up working like an override; meanwhile the effect for new packages/checkout has been minimised, but the code could do better at dealing with old checkouts affected but this (drop the old file name for the overrides, use a new one and scream when the old file name is encountered)
• 0.6.24 is waiting for an upload
• a test frame is missing and would be most welcome; I already started working on this based on the git test frame, but didn't managed to have a good-enough-to-publish code
  

These being said, I am really hoping svn-buildpackage will find a new maintainer since it deserves a lot more attention than I am providing. Don't forget, 0.6.24 is wating for an upload already.

---

Update: Neil Williams answered and agreed to take over maintenance, but he doesn't usually use svn-inject and svn-upgrade, so somebody taking care of those would be needed. Ironically, those two scripts are the ones in the worst shape of the three main scripts.

Our place has a fancy magical lock on the front door that has been sticking lately. We phoned the locksmith who put it in to discover that he apparently can't talk to us because we're not the registered owners of the lock.

Right - when we bought the place, we apparently don't automatically get the title to the locks on our front door. The former owners could phone at anytime and get into our place. If we were locked out in the middle of the night, he couldn't let us in.

Fuck that. Will replace the lock myself with a crowbar if I have to.

I finally found some time to work on planet phpMyAdmin. It now has same look as phpmyadmin.net website, links to feeds are more visible and the website links to it at some places. All templates and planet configuration are now stored in our SVN repository. Now let's hope that I will not be the only one who regularly posts there :-).

With all the discussion about SHA-1 weaknesses and generation of new OpenPGP keys going on there's some concern about how the web of trust will be affected. I'm particularly interested in the impact on Debian; while it's possible to add new keys and keep the old ones around that hasn't worked so well for us with the migration away from PGPv3 keys. We still have 125 v3 keys left, many of them for users who also have a v4 key but haven't asked for the v3 key to be removed or responded to my email prodding them about it. I don't want to repeat that.

So if we're looking at key replacement we need to have some idea about where our Web of Trust currently stands, and what effect various changes might have on it. I managed to find the keyrings Debian shipped all the way back to slink and ran the keyanalyze and cwot stats against them. I then took the current keyring, pull in all the updates for the keys in it (so that any signatures from newly generated keys would be included) and ran the stats again. Finally I took details of 12 key migrations (mostly from Debian Planet but also a couple of others I knew about) and calculated what the effect of removing each key would be. These stats are cumulative and I replaced the most well connected (by centrality) keys first.

The results are below.

• Total is the total number of keys in the keyring
• SCS is the largest Strongly Connected Subset
• Reachable is the largest reachable subset
• MSD is the Mean Shortest Distance
• Centrality is the average centrality for the reachable subset
• update-foo indicates that foo's key was replaced with a newer one

	Total	SCS		Reachable		MSD	Centrality
1999-02-06 (slink)	228	36	(15.78%)	50	(21.92%)	2.9022
2000-01-03 (potato)	375	104	(27.73%)	180	(48.00%)	4.3382
2001-09-22 (woody)	948	538	(56.75%)	704	(74.26%)	4.7320	2008.6249
2005-05-28 (sarge/etch)	1106	883	(79.83%)	969	(87.61%)	3.3485	2074.6604
2007-12-04	1191	1001	(84.04%)	1062	(89.16%)	3.1103	2113.3747
2009-01-18 (lenny)	1126	947	(84.10%)	1010	(89.69%)	3.0489	1941.2594
2009-04-04 (squeeze/sid)	1121	946	(84.38%)	1008	(89.91%)	3.0466	1936.9761
2009-05-06 (current)	1067	894	(83.78%)	958	(89.78%)	2.9670	1759.4363
	Total	SCS		Reachable		MSD	Centrality
base	1067	904	(84.72%)	959	(89.87%)	2.9640	1776.4389
update-93sam	1067	902	(84.53%)	958	(89.78%)	2.9734	1780.9874
update-joerg	1067	900	(84.34%)	958	(89.78%)	2.9776	1780.7578
update-aurel32	1067	898	(84.16%)	957	(89.69%)	2.9803	1779.2497
update-noodles	1067	896	(83.97%)	956	(89.59%)	2.9831	1777.8326
update-jaldhar	1067	896	(83.97%)	955	(89.50%)	2.9855	1779.9193
update-srivasta	1067	896	(83.97%)	955	(89.50%)	2.9904	1784.3382
update-ana	1067	895	(83.88%)	954	(89.40%)	2.9926	1784.3102
update-nobse	1067	893	(83.69%)	953	(89.31%)	2.9947	1782.2392
update-neilm	1067	892	(83.59%)	951	(89.12%)	2.9974	1782.6098
update-reg	1067	891	(83.50%)	950	(89.03%)	2.9977	1780.8515
update-rmayorga	1067	890	(83.41%)	949	(88.94%)	2.9984	1779.4910
update-evgeni	1067	889	(83.31%)	948	(88.84%)	2.9974	1776.6445

This is actually more hopeful than I thought. There's an obvious weakening as a result of the migrations, but the MSD stays under 3 and the centrality stays fairly constant too. The reachable/SCS counts do decrease, but at this point it looks fairly linear rather than an instant partition. Of course the more keys that are removed the more likely this is to drop off suddenly. Counteracting that DebConf9 is coming up which will provide a good opportunity for normally geographically disperse groups to cross sign, reinforcing the WoT for these new keys.

Either way I at least have a better handle on the current state of play, which gives me something to work with when thinking about how to proceed. For now, bed.

So what did you expect? A new GPG/PGP key? Here it comes:

pub   4096R/333961E8 2009-05-10

      Key fingerprint = C575 A957 E819 BA18 BF07  E766 A1B0 9B42 3339 61E8

uid                  Evgeni Golov <evgeni@golov.de>

uid                  Evgeni Golov <sargentd@die-welt.net>

uid                  Evgeni Golov (Debian) <evgeni@debian.org>

uid                  Evgeni Golov (HHU Duesseldorf) <evgeni.golov@uni-duesseldorf.de>

uid                  Evgeni Golov (30doradus) <golov@30doradus.de>

sub   4096R/022DE268 2009-05-10

It's signed with my old AC15B50C and hopefully by others soon too.

Never thought my first post to Planet Debian would be about security, but well, it is like it is and I add the regular Hi Planet Debian! here at the end :)

I ve previously written about memory squeeze problems in a Xen Dom0 when large amounts of memory were assigned to DomUs [1]. In summary the Dom0 would have problems if started with default options and the majority of the RAM was later assigned to DomUs, but if the memory of the Dom0 was limited by the dom0_mem parameter to the Xen kernel then things would work well. Fatal server error:
xf86MapVidMem: Could not mmap framebuffer (0xfae80000,0 80000) (Invalid argument) I have since found another exciting bug with Xen. I was in the process of upgrading an AMD64 workstation to using Xen so that I could test other versions of some software in the background. The first stage was to install the Xen kernel and the Xen enabled Linux kernel and boot the machine. Unfortunately I then received the above message when trying to start the X server. I discovered the solution to this in the comments section of Different Colours blog post about Virtualisation on Lenny [2]. It seems that there is a problem gaining mmap access to MMIO memory regions in Xen and that restricting the memory of the Dom0 is a work-around. My AMD64 workstation has 3G of RAM because the motherboard can t support more than 3.25G and buying 4G of RAM to have 3.25G usable would be an expensive way of doing it. So I used dom0_mem=1500M and now X works again. I have yet to discover if anything strange and exciting happens when I create DomUs on the machine. I don t have any immediate plans for running Xen on the machine. It s main uses at the moment is torcs (a slightly realistic 3D car racing game), supertuxkart (a cartoon 3D car racing game), and mplayer so it doesn t really need a lot of RAM. I like to keep my options open and have all my machines capable of virtualisation apart from routers.

• [1] http://etbe.coker.com.au/2008/08/25/xen-and-linux-memory-assignment-bugs/


• [2] http://diffrentcolours.livejournal.com/814563.html

Would all the paranoid crypto-users please stop flooding Planet Debian with GPG output? And if you just cannot avoid it, please tag those posts meme, because that s what they are. If you really think there s a need for a new key, you re one step ahead of me, because so far, there s only a theoretical attack and the valid question of whether this is actually something to worry about in the context of GPG (or in the context of Git, for that matter). There is no practical exploit out there, and I don t expect one that would endanger your use of GPG any time soon. Of course, we ought to replace the current crypto infrastructure with a new one before the current one is compromised, but that should really be motivated by careful consideration and planning, not by lemming-like behaviour and the infamous tipping point. I ve long been meaning to clean up my key and may also switch to using a new one in the near future. However, I don t think there is an immediate need and I ll take time first to investigate the options RSA is hardly free from problems or an optimal choice. For instance, why would I want to use an RSA key, which is limited in GPG to 4096 bit keys? Do we really want to deal with signatures that are 4-10 times longer than their DSA counterparts? When RSA is broken, will we see a replay of this whole key-replacing frenzy? Wouldn t it make more sense to leverage the current situation and work on pushing/improving the DSA algorithm with larger keys, and to strive towards better algorithms in general, e.g. through SHA-3. If you still need to replace your key, revoke the old one, point at the new one in the revocation reason, and please refrain from abusing feed aggregators from letting the world know. If gpg cannot follow the trust chain after the revocation, please fix it. In the mean time, it is a good idea to use RIPEMD160 instead of SHA-1 for signing, with the following lines in ~/.gnupg/gpg.conf:

personal-digest-preferences SHA512 SHA384 SHA256 SHA224 RIPEMD160
default-preference-list [ ] H10 H9 H8 H11 H3 [ ]

and to set the preferences on your key accordingly:

% gpg --edit-key $KEYID
> setpref [ ] H10 H9 H8 H11 H3 [ ]
> save
% gpg --send-key

Then, make sure RIPEMD160 is being used:

% gpg --clearsign -a </dev/null   grep '^Hash:'

I ll end with a link to a decent write-up on the cryptographic basics of GPG.

With last attacks against SHA-1 digest algo, I create a new GPG key (following instructions from Daniel Kahn Gillmor):

pub  4096R/B8612B5D 2009-05-10
uid  Gregory Colpart <reg@gcolpart.com>
uid  Gregory Colpart (Evolix) <reg@evolix.fr>
uid  Gregory Colpart <reg@debian.org>
sub  4096R/7D40310B 2009-05-11

A good excuse for beer^Wkey exchange next weeks :-)

Adrian von Bidder raises an interesting discussion on why public health care is difficult. Basically, it comes back to the challenge:

How much money should be spent on this person's illness? which is a very, very bad question. We try to sidestep it by only taking about statistics etc., but no matter how you look at it, you either do 20'000  per week medications for 80 year old patients who will die soon anyway and get a system society can't pay, or you don't and you get a system where the rich are better off than the poor.

The problem is, the majority of health costs are in the last few years of a persons life: when the body is breaking down. If viewed from the problem of health-care funding vs. eg. education, you have an ethical dilemma: is it worth it ? Here there are no easy answers. Nick Bostrom wrote a very interesting and persuasive essay a while back, The fable of the Dragon Tyrant. In short, we are getting somewhere with regenerative medicine While cures are hard to come by at this stage, there is a growing realization in medicine that senesence, what we used to call "old age", is curable. But we have a lot of psychological defensive mechanisms to help us cope with the carnage of old age that make us deny the problem: if we look afresh at "old age" knowing it to be curable, any delay in doing so is abhorrent. From a public, societal perspective, we spend a fortune every year on health. But we do so in a very disjointed way: we pay colossal amounts for health care, but also for basic health science: in the US, for example, the budget for the National Institutes of Health is about 30 billion dollars. Nearly twice that of NASA. Similar figures are spent in Europe, but there is this strange gap in the middle: the drug companies and medical industry. We start the development of new drugs with public money, and we buy the drugs with public money, but the choice of what drugs and treatments are developed are left to private industry, that is, a profit motive. This results in many cases in expensive treatments to treat symptoms rather than necessarily cure the problem. Faced with the huge costs of geriatric medicine and senesence, the response should be co-ordinated: funding a cure will be expensive, but save a fortune (Think, instead of a pensioner slowly dying and 'being a drain on resources', of 'experienced citizen in the prime of their productive, tax-paying years'). Instead of funding the basic science alone, we should be funding the complete drug and treatment development publically, only farming out the actual manufacture to private industry. It is silly to spend a fortune to keep merely keep someone alive at the age of eighty or so, when we know for a larger investment (bigger than a private company can do), we can cure them properly. The solution to the dilemma, then, is to stop thinking of the elderly being a drain, but actually applying our public efforts in a co-ordinated manner to solving the carnage of old age. Tags politics, health

For some time I've been pondering about buying a bicycle since it seems my weight has been increasing lately up to about 90 kg, which, for my height and age, is about 20 kilograms too much.

But since I am living in a rented apartment, storing the bicycle was a problem, until I realized I could buy a folding bicycle. When that idea hit me, I literally couldn't sleep until about 6 am and I searched the internet about the options, issues to expect, things to check.

In the end I found a Dahon Mu P8 bicycle someone was selling on a bidding site and, after seeing it I concluded that was in mint shape, so there was no reason not to buy it since the price was half of a new one, while this one was only a year old.

I bought the bike yesterday and rode it to work from the place where I met the person who sold it to me and it was quite an enjoyable experience. I still have to do some minor adjustments (saddle is a little bit loose and folding could be better if the handle bar was in another position) before I can ride it regularly to work, but that's just, well, a minor problem :-P.



Now I have a way to do regular exercise without feeling is a drag, so I expect to lose some weight soon after I start riding it to work regularly :-) . Maybe I'll manage to lose about 5 kilos until DebConf, which would be great.