Today I was musing about different version control systems and merge algorithms. I've been thinking specifically about how I maintain Debian packages in Darcs. I tend to import upstream tarballs into one branch, and maintain the Debian packages in another, simply merging when a new upstream is released.

Now, there seem to be two prevailing philosophies on how to handle merges in this case. I'm thinking here about merges back to upstream. Say I want to contribute my Debian patches to them.

1. Commit "clean" patches upstream. Don't have a bunch of history -- the fixing typos commits, the fixing bugs commits, or the merging to track new upstream releases. Just something like a series of diffs against the current head.
2. Bring across the full history, warts and all, and keep it around permanently.

git encourages option #1, with its rebase option. Darcs encourages option #2 (though some use its amend-record option to work more like #1).

As I got to thinking about it, it occured to me that git-rebase would be very nice if you are going to use philosophy #1. In short, rebase will remove your local patches from a repo, update it to the latest upstream, then re-apply your local changesets -- aborting to have you fix any conflicts. This is as opposed to a more traditional merge, where you add the upstream changesets to your local branch and then commit new changesets to resolve conflicts. (So a rebase would be totally useless in situation #2)

I got to thinking about this, and started wondering what would happen to people that I'm working with that in turn work off my branches. And sure enough, the git-rebase manpage says, "When you rebase a branch, you are changing its history in a way that will cause problems for anyone who already has a copy of the branch in their repository and tries to pull updates from you."

I maintain, therefore, that git-rebase is evil and should be avoided. It only works for a situation where someone maintains a private branch of a project, never shared in any way except to submit patches to an upstream. Forget it if you have a team maintaining that branch, or want to post that branch online for others to help with (as I do with my Debian darcs package). Even if you keep it private now, do you really want to adopt a work process that forces you to keep it private forever, or else completely change how you work?

And this brings me back to the original question of patch philosophy. Personally, I dislike philosophy #1. I'd much rather have the full history of a change, warts and all. Look at the Linux kernel example: changesets that introduced bugs that made it into the official tree have their fixes documented, but changesets that introduced bugs that were fixed before being merged into the official tree could be lost to the public due to rebasing by submitters. Is that really what we want? I don't think so.

With Darcs, tagging is very cheap and it is quite trivial to write an "apply a changeset bundle" script that makes a before tag, applies a series of patches, and makes an after tag. One could then run a darcs diff between the two tags to see the net effect on the repository, or could still look at the individual patches. (Or, you can avoid tagging and manually specify the "from" and "to" patches.) I find that a much better model: you can have it both ways. I'd think that most modern VCSs ought to support some variant on that, too.

And I think that git-rebase should be removed on the grounds that it encourages poor version tracking practices.

XS-Vcs-Browser: the brother of Xs-Vcs-* A couple of day ago godog (thanks!) applied my patch for the PTS which add the long overdue support for the XS-Vcs-Browser field in debian/controls. Here is a summary of the Version Control System related fields now supported by the web interface of the PTS:

• Xs-Vcs-Browser whose value is an URL pointing to the web-browsable version of a versioning control system repository (e.g. a Subversion ViewSVN installation)
• Xs-Vcs-XXX (where XXX is an identifier of common VCS systems, e.g.: CVS, SVN, Arch, HG, ...) whose value is a string meaningful for the given VCS identifying where the latest version of the sources for a given package can be found using the given VCS. Some history is available.

Here is an example of the two field usage from the debian/control of the (not yet uploaded) Vim package:

Source: vim
Section: editors
Priority: optional
Maintainer: Debian VIM Maintainers <pkg-vim-maintainers@lists.alioth.debian.org>
Standards-Version: 3.7.2
...
XS-Vcs-Svn: svn://svn.debian.org/svn/pkg-vim/trunk/packages/vim
XS-Vcs-Browser: http://svn.debian.org/wsvn/pkg-vim/trunk/packages/vim/

The current sample rendering can be seen, for example, in the PTS page of the mako package. More information can be found in the current patch for the Developer's Reference documenting the support for the two fields in the web interface of the PTS. /me hurries-up writing a small post to -devel before John yells at me again for (ab)using the planet for such announcements

While we're fixing some network problems, here is a musical interlude^W^Wset of links...

Explaining Debian at parties

'Do not try to convince people to try it out or you will become a support hotline. Instead, tell them about LUGs and mailing lists (and how cool it can be) and put the challenge on them: "if you try it, those are your support channels. Are you up for it?"'

Index of /~joerg/templates

Explanations of some common reasons for getting REJECT from ftp-master.

gravityboy: Politics

"If we're going to make interactions between developers more civil and friendly and less personally hostile then we need a different kind of stick. Maybe a carrot of sorts is in order too?"

Consensus and community review in open source and open standards Decentralized Information Group (DIG) Breadcrumbs

'this is quite a stretch with respect to the normal dictionary meaning of "consensus"'

Social Drag

How many Debian Developers are dressed in Social Drag?

debian Gender Research

More research to add to the surveys page

#354950 - ITP: gauche-readline -- A readline-like library for the Gauche Scheme implementation - Debian Bug report logs

Contemplating sponsoring again.

The joys of English cuisine are abomination in God's sight Ted Walther's Private Diary

Blast from debian past: Ted Walther's gullibility for stereotyping is an abomination in God's sight and those foods are hardly typical English. For instance, the only one on his PS list that I've eaten recently is flapjack (not flapjacks, which is something else and not English AFAIK) and I can only remember eating five of the list in the last year. Also, the linked site seems to concentrate on processed pap from multinationals and supermarkets, rather than real trad English food. Example: "Yorkshire puddings are basically a bread type product. You can use them in place of dinner rolls." Why not make 'em a bit harder, cook 'em a bit longer and you can use them for cobbling the street instead? Yorkshire pudding should be a baked batter with a soft middle and a crisp puffy edge. Nothing like bread. And don't get me started about the pasties. Honestly, if you learn about food from such sources, no wonder you'd think it an abomination.

Re: Position Statement to the Dunc-Tanc "experiment"

"had somebody wanted to kill (or inflict maximum damage) to the project, he couldn't have done any better than the current DPL"

Releas-o-meter

Interesting idea - why no cron-run copy on the web?

EUPL v 1.0 revokable ?

One that may appear in a future 'bits from debian-legal' - it seems the EU are popularising a type of termination clause. Yay.

Future of Debian Weekly News

As I hoped, Joey is explicitly calling for sponsorship for DWN production.

DPL 2007, Current Candidates

still don't have a title is keeping a list of DPL candidates, so I won't put one up this year.

#411041 - request for debian-l10n-persian mailing list - Debian Bug report logs

Tell all your persian-speaking friends to show their support!

Interprete I cite, you cite, I rant

Lack of references is a problem on lists like debian-legal where explaining everything again can drive you insane and still not convince some people.

Lucas Nussbaum's Blog State of software for Suspend to RAM/Disk ?

More tips on the "Will I Work Or Not?" suspend problems.

only on debian-devel - she.geek.nz

> Am I mistaken or this is a flame on how to flame ?

Miriam, coroutines have the same problem as threads, futures and all the other interesting concepts out there: they are perceived as a magic bullet when they are merely one tool in the great toolbox. Whether a tool is appropriate depends on the job. Postgres, for example, handles each connection in a separate process, which adds a lot of complexity to their internal structures as all concurrent accesses need to be handled properly. However, SQL's transaction and isolation semantics make a single-threaded implementation almost as hard to implement, so the correct answer was to use threads. The biggest problem with threads is data consistency, and this is where almost all negative examples originate: some variable was not declared volatile, some lock not held long enough, some set of locks taken in the wrong order. A rule of thumb should be: if your threads need to interact, then you should not be using threads. If you have to compute something which will take longer, it is absolutely fine to start a new thread, but then you will have to protect the inter-thread communication appropriately. What is appropriate depends on the problem again; in most cases it will be message queues which allow the other thread to handly the request when it is in a safe state. Coroutines come in at a point where "you should not be using threads", by essentially allowing me to write a producer-consumer model as if it were threaded, and then letting the compiler build a nonthreaded version from that. In the C++ world, most algorithms can not be combined directly because they are written as a consumer/producer loop and cannot be suspended -- coroutines will make that possible.

I was up late last night upgrading Wikitravel from MediaWiki 1.8.3 to the new 1.9.3. It took a long while, since the 404-handler caching extension that I built for MediaWiki a couple of years ago (which keeps Wikitravel running on a single, albeit quite big, server) is pretty invasive, and a lot of things had changed with the way users and stuff worked, so I had a lot of hacking to do. But it's stable now, even if some watchlist stuff is a little funky. Doing major upgrades is a real bear for me, but I'm happy when it's over. tags: mediawiki wikitravel caching extension 404 handler

Home people Maj had her final oral exam in her French class tonight, which left me and Amita June home alone to fend for ourselves. We had a lot of fun. First, I had to do the day's dishes (lunch and breakfast) that were sitting in the sink. I brought the footstool around to the sink from our laundry room, and she stood on it and helped me with the dishes. After I'd finished washing a dish, she'd carefully fill it up with water, dump it out, then put the dish in the dishrack next to her. Pretty good for 18 months old. That went so well that I moved the stool over to the kitchen table where I cut tofu and vegetables for dinner. I gave her pieces of pepper, cabbage, and carrot while I was working, and she nibbled on them a bit and then practiced chopping them... with the handle of her mother's toothbrush, which she'd stolen out of the bathroom earlier in the day. After dinner, we had a bath, then we read some books, and then she went to sleep on my shoulder while I walked around her room and sang, like she's been doing for the last 2 months. It was another good night. tags: home amita june dishes home with papa

Soft launch We launched two new Wikitravel versions overnight, too: Catalan Wikitravel and Finnish Wikitravel. Catalan recently, uh, catalyzed from a blog post by Carme Pla . Readers and the Catalan-speaking community rallied to our Catalan Wikitravel Expedition and got the project rolling. I got the site set up last night and they've started translating key help, style manual and policy guidelines already. Mean, Finnish had been simmering on the back burner for a while, so we got it launched at the same time. My friend and colleague Jani Patokallio is a Finn and a longtime and well-respected Wikitraveller; I'm glad he's taking leadership of the project. Finns have such disproportionate contributions to Free Software and Free Culture; I'm glad to have that Freedom Powerhouse Country all working together on Wikitravel now. And, y'know, I'm going to totally rack up a ton of HugAFinn points off of this. Actually, now that I think of it, I have no idea if "Carme Pla" is a real name or even a plausible personal name in Catalan. It sounds like it to me, though. tags: fi ca expedition finnish catalan wikitravel

coComment A couple of months ago Don Marti recommended that I check out coComment, and I made a mental note and then forgot to follow up. But I started using the system a few days ago, and now I wonder how I ever lived without it. coComment is a Firefox plugin that keeps track of when you post a comment on a blog or some other comment-handling system. It then keeps track of the conversation that happens after you comment. I have a lot of standing keyword searches on Technorati and Google Blog Search, and if people are talking about a subject I'm interested in, I'll usually jump in and talk about it. But sometimes I'll go back months later and see that people asked me questions and continued the conversation without me. So coComment is exactly the kind of cross-the-Internet aggregation service I need. tags: cocomment comment blogs firefox

Sage Speaking of keeping up with blogs, I've realized in the last week that I've outgrown Live Bookmarks for following RSS feeds. Rather than going with a Web-based RSS reader like Google Reader or Bloglines, I opted instead for the in-browser reader, Sage. It's simple, it does what I need it to do, and it supports OPML so I can move my subscriptions somewhere else if something better comes along. Good piece of software. My best candidate for something better coming along? Probably if I get my Netvibes home page customized well enough to handle my 50-60 feeds. And maybe when Netvibes gets smart and becomes and OpenID identity provider (or at least figures out a way that you can log into your ID when you start a browser session). tags: sage rss feed firefox netvibes

Note: this feature was at least unknown to me.

If you have a local mirror and one which is further, you will most surely have the local mirror listed first in your /etc/apt/sources.list so that apt tries to download first from the local mirror. Nothing new here.

Add a laptop to that mix and moving frequently to another place, let's say office at work, where the link to the second mirror is waaay faster than the one to your home local mirror.

How do you make updates/installations via the most speedy connection, no matter if you are at work or near the local mirror at home?

Simple (if you count simple something I had to figure out in 1 months or so - to quote partially aj :-); apt will use that mirror if you comment out the lines that point to your local mirror and will use those without the need to run update.

Are you getting my drift? So, how does that add up? Throw in there laptop-net and its feature to replace files depending on profile and you got it all almost sorted out (you'll have to make a restore feature based on the $ PROFILE /before-deselect hook).

So, to conclude, here are the instructions:

• install laptop-net
• create a profile for the local mirror connections (there is a skeleton example in /etc/laptop-net/profiles/_skel with some examples and pointers, please read the README, at least) that is meant for the place where you have the local mirror
  
• create the files.d directory in the new profile and add there etc/apt/sources.list (with the intermediate directories) the variant that has the local mirror specification uncommented
• modify $ PROFILE /before-deselect hook script to replace the sources.list file with one that does have the local mirror lines commented (I created a files-back.d/ directory whose contents is copied over the / directory, exactly like laptop-net does itself for files.d/; that is not actually a backup, but is good enough)

Now you should be able to always install from the fastest mirror at all times.

The other night I was rocking out to a newly acquired swath of rock and techno from the 1970s and 1980s when Mako pinged me on IRC to chat about my recent blog post, the outcome of which the was his following blog entry. And indeed, I made the associations and links very quickly to gesture to the absurdity of how these example are collapsed and under the umbrella of IP law and as a move to argue for maximalist positions. He took the time to explain how certain folks, like Pat Choate in Hot Property used these very examples to argue for more not less protection. Does anyone know of a case of people using these types of examples to argue the opposite or differently as I think can also be done?? (that is aside from Mako’s wonderful post)

These last weeks, Enrico and me have worked on a GUI frontend for pmnew. At the moment, the prototype is limited to the task of finding new packages to install. The goal of pmnew-gui is to have every little detail designed to be as smart as possible: for example, the list of packages shows at the top the packages that the system thinks you are interested in having comparing your system to thousands other systems. Screenshots http://people.debian.org/~enrico/2007-02/sshot-startup.png
http://people.debian.org/~enrico/2007-02/sshot-audio.png
http://people.debian.org/~enrico/2007-02/sshot-games.png Get it

bzr branch \
http://people.debian.org/~enrico/2007-02/pmnew-gui/

Setup The README gives some details about the setup. In short you will have to do the following steps:

apt-get install python-debian python-deb822 python-xapian \
python-apt python-glade2 python-gtk2
./update-data
./pmnew-gui

It works better if you have a network connection, and if you have popularity-contest installed and running. Feel free to send us feedbacks about the GUI. Links

• "The original brain dump"
• "The commandline draft"
• "Various ideas on improving package managers"

From Dojo Toolkit (a very powerful AJAX toolkit), but should probably go to The Daily WTF...

_getAdjustedDay: function(/*Date*/dateObj)
  //summary: used to adjust date.getDay() values to the new values based on the current first day of the week value
  var days = [0,1,2,3,4,5,6];
  if(this.weekStartsOn>0) 
    for(var i=0;i<this.weekStartsOn;i++) 
      days.unshift(days.pop());
     
   
  return days[dateObj.getDay()]; // Number: 0..6 where 0=Sunday
 

That code is inefficient and stupid on so many levels. For example the if statement... you might be aware that 0 < 0 is false. Yep. I'd prefer something along the lines of

  return (dateObj.getDay() - this.weekStartsOn) % 7;

No arrays were abused during the making of this function. I always thought PHP programmers were the worst, but apparently some JavaScript "coderz" are up to par.

when you have a svn-like use of git (I mean with a central repository), it's a good thing to repack the central repository from time to time. If your repository lives (totally random example) in /git/pkg-xorg/lib/mesa.git, you can do:

   cd /git/pkg-xorg/lib/mesa.git && GIT_DIR=. git repack -a -d

I'm told that some people that had more than 1.5Go of git repositories have seen their main repositories shrink well under 200Mo of disk usage. On my own git central server, I use that as a cron:

 #! /bin/bash
 GIT_BASE=/git
 for repo in $GIT_BASE/*.git; do
     pushd $repo &>/dev/null
     GIT_DIR=. git repack -a -d  &>/dev/null
     popd $repo &>/dev/null
 done

but on a big and loaded server one could make it better and repack only when it seems to be needed and use (untested):

 #! /bin/bash
 GIT_BASE=/git
 GIT_THRESHOLD=5000

 for repo in $GIT_BASE/*.git; do
     pushd $repo &>/dev/null
     if test $(find objects   cut -d/ -f3   wc -w) -gt $GIT_THRESHOLD; then
         GIT_DIR=. git repack -a -d  &>/dev/null
     fi
     popd $repo &>/dev/null
 done

The Weston Mercury - Tropicana vote - where was your councillor?

Fantastic work by Archant's local newspaper, actually calling councillors and asking them to account for the way they voted on a controversial seafront development. I'm surprised so many of the Worle councillors failed to vote for various reasons. I also think it's a bit poor that the vote was so late at night.

BBC NEWS England Cornwall Row over response to overcrowding

An amazingly brutal and probably honest answer about the local rail company's approach to commuter trains.

BBC NEWS England Train company says sorry to users

Train company admits "too much capacity was removed from the timetable".

Sustainable Building Sourcebook Contents

A book about green building in Texas USA. The whole thing seems to be online (sponsored) and it has some useful explanations about things like thermal mass.

The Weston Mercury - Town centre demolition

Dolphin Square is ugly, but I think it's actually one of the better examples of 60s rectangular town centre building. It's not listed or anything and it's so near the beach, I don't doubt it will be demolished. What will happen to our supermarket there? I hope there will still be one in the town centre area.

RADBURN, NJ

A recent planning process commented that my part of the village is a 'Radburn-style' development and that's why some parts have parking problems at the moment. I didn't know what that meant, so I looked it up. It means that the main access to our houses are footpaths and cars are left in cul-de-sacs around the edge of the development. That explains some of the apparently-confusing naming/numbering decisions. This is the site of the original Radburn.

Top 10 annoying commuting issues

Martyn in top form, ranting about his trip to work. I'm so glad my commutes are mostly cycling across countryside now.

Everyday Cycling - British Cycling Confirms Major Cyclosportive

Want to ride the TdF London-Kent route on 1st July?

Bagel Belly Blog: Travel trouble

Savs's long lane to Leicester. My comment: don't ever believe the route planners. Every one I've seen so far optimises for theoretical speed or distance, when what we really need is resilience and fuel economy too. The A47 vs A11/A14 choice is an extreme example: A11/A14 has far more free-flowing junctions and dual-carriageway than the A47.

Since there are few topics about academic etiquette than get me as excited as the norms of citations, I was quite fascinated by Joseph Reagle’s blog entry on the topic, a discussion that spanned a summary of Helen Nissenbaums’ work on the subject to his own wrangling with how he should recognize others who have independently reached similar conclusions as his own. Citations fascinate me because they are one of the few tangible inscriptions that reveal just how much of our work is indebted to others; it is stimergic (and if you don’t know what that is, read Joe’s entry as his moral wrangling over citations had to do with this term, his use of it and the discovery that someone else came up with it also). Despite the fact that all disciplines use them, we use them slightly distinctly. Lawyers use them in lawyerly-like ways: they cite the crap out of everything (it is kinda annoying but kinda helpful) and this makes total sense: they are covering their asses (lawyers know how to do this well), they are following the logic of their own practice as case law is quite citational, and well, law professors usually have one if not two research assistants, and this I am sure helps them in covering their citational bases. Another big difference in practices of citations is between a conventions that includes the name of the person you are citing in the body of the text and those that stuff all that data in a footnote. I can’t stand the later convention, not only because it is a pain in the neck to have to go back to the footnote JUST to see who the heck the author is citing but I think the credit should be right there, springing off the page so that the politics of collaborative recognition are, well, very evident (and I do understand that if you are citing a buttload of folks, that sometimes it is just better to do that in footnotes and sometimes with history they are citing way to may folks to really do it effectively in the body of the text). Joe raises some fundamentally thorny questions of who and how do we cite given that we may come up with an idea with the power of our own little brains, only to find out (gasp) that others, past and present and very unknown others, say something similar. On the whole, I tend to try to make clear, as Joe did in the example he provided, where I am totally taking the idea from someone to apply to another idea of mine and where I have an independently crafted idea and I am citing others so as to support my own position, which usually only strengthens my own argument. And what I find is that just because a cohort of folks may be working on similar topic (open souce, hackers), since we do so from our own perspectives and methods, most of the research will be original, though not as much as we tend to perform to our superiors. Also I sometimes find myself with an idea, which I consider as my own, but where I am so in need of a citation because it is an idea that seems at an intuitive level to be right on but it is hard to truly substantiate with the data I have (I am in that position right now and am desperate to find someone who says what I say and thus have a means to support what otherwise seems like a lofty idea…) And in fact, one thing that bothers me about citations is that we don’t seem to take seriously that the date of publication may not just tell us when something was published but help us gauge if something can become “dated.” What I mean is that when (and I guess if) I publish my book on hackers and Debian, it will not be a reflection not of some timeless aspects of hacking but firmly based out of the time period (roughly 10 years give or take 3 or 4) that I was either researching and writing about the topic. And while you can and should cite folks who wrote stuff in the past because that stuff still matters (a lot of what Steven Levy says for example still holds water) a lot changes. And yet I can’t stand how folks then cite someone as wrong when in fact all that went wrong is that time does what it does best: MOVE FORWARD and social phenomenon change along with the passing of new moons. This is not as likely to happen in the hard sciences but sure as heck happens with anything in the so-called human realm (which is why it bothers me that the social sciences and humanities model our citational and journal practices so similarly to the hard sciences, when it seems there are enough differences to warrant more differences than there are but that is a whole other topic). So now I try to note where my analysis diverges because the context so radically changed and really leave critique for those things I can safely and fairly disagree with on its own terms.
Finally, Nissenbaum’s article seems so interesting (I have not yet read it but now will) because it confronts how our practices of citations may or may not (or should) change in the face of a proliferation of access to work due to electronic media (she flags: wildcat publisher, grey literature, preprints). But I have found that, at least in anthropology journals, and especially in the anthropology of science, technology, and medicine, authors are mostly citing other anthropologists, as if a whole scholarship on a topic was non-existent, which seems more odd today when it has gotten easier to mine and find this stuff. They only cite “non-anthro others” when these folks are so standard, it would look horrible not to do so, but there is not a move to branch out, which I find a real shame and why I sometimes get really down on disciplinary journals (and why I am quite content to be joining an interdisciplinary department). And to be clear, I don’t fault individual authors, it seems that this is the unstated expectation and if that is what is going to get you in a journal, and that is what gets you tenure brownine-points, then you do as everyone else does. And that brings me to the final point which is the problem with standards in citational practices. So for example in the field of science studies, everyone must and usually does cite Bruno Latour. And as Chris Kelty reminded us, there is *very* good reason to. But I find what happens is that once a person is flagged and gets cited ad nauseum (which is mostly a decent but not full proof baramoter for judging good work), it become self-perpetuating reality/cycle because everyone else is doing it and it seems weird if you don’t (and I have sometimes seen some articles just awkwardly cite famous people in their discipline when it made little sense to do because, I think of this phenomenon). So all of a sudden, it becomes all Microsoft-Windows like: you cite, they cite, and it becomes “standard” who you cite and you can’t seem to escape the default. But alas, there is always an escape hatch, because one of the gems in academia is discovering that one theorist or book relate x to y and z topic that for some reason everyone else overlooked (because they were busy citing Latour,) to bathe some topic in a wholly new light and then a whole group of folks become unfashionable and the cycle begins, yet again…. The solution? If we only had a couple of research assistants like the lawyers, well maybe we could branch out a little and cover our bases a little..

This post of ubuntu-tutorials.com (via Planet Ubuntu) suggests to run sshd on a different port than 22. That does not increase security. Serious attackers aren't fooled by just changing the port; if someone has an SSH remote exploit we're all in deep trouble anyway (but that code is heavily audited, you bet!), and it's trivial to scan on other ports if a system is detected as being Unix and not having SSH on port 22. If you want to really increase security, you can

• Disallow password logins altogether, use cryptographic keys or One Time Passwords [wikipedia]
• Enforce (sufficiently) secure passwords
• Filter by source IP from trusted networks only
• Use port knocking [wikipedia]; use iptables RECENT match for this, not some obscure tcpdump-running shell script!
• Require multi-hop or VPN connections (e.g. have a tighly secured firewall host, for example with SELinux, which users can only use to forward their connection to their real destination host)

If your goal actually is to get rid of those annoying (but non-threatening, if you don't have trivial passwords) messages in your log files (you DO read your log files, don't you?) - consider using the iptables RECENT match to stop them early. At the university, we have a RECENT match filter at the border firewall. It stops SSH scanners early on, giving them 5 tries total for the whole network (and they usually give up after that, not retrying when the recent match has expired). For some details on how to use the RECENT match for filtering SSH connections, read this earlier blog post on iptables SSH protection. Use the INPUT chain to filter localhost. For an example how to do a two-hop SSH connection, read this blog post. Just replace his OpenWRT router with a tighly secured SELinux gateway system. Another (without nc) is to use the LocalForward option of ssh. Just forward some local port through one ssh connection to the final machine, then do a second ssh connection over this. The gateway host could easily be restricted to only allow outgoing connections to port 22 in the fenced off network. So basically, by NOT using a different port than 22 for SSH, you can increase security (by filtering port 22 specially, knowing that it's SSH). If you start putting your SSH daemons on different ports, you're actually making firewalling much harder. Also note that in some networks, bandwidth policies are used for different ports. The SSH port usually is not limited; arbitrary ports are (since it might be a filesharing application using them). Another reason to stick to the standard ports, so you don't get punished by your network administrators!

Seriously, RFC2445 is on crack. No wonder that few apps handle recurrence rules properly. Let me give you some examples straight from the RFC:

RRULE:FREQ=YEARLY;INTERVAL=2;BYMONTH=1; BYDAY=SU;BYHOUR=8,9;BYMINUTE=30

These are tons of events: at 8:30 and 9:30 every other year, every sunday in january. That's not precisely what I'd call a yearly frequency... I mean, we're talking about every sunday in januar. I'd more call that like... weekly. And yes, this is the official solution:

"every Sunday in January at 8:30 AM and 9:30 AM, every other year"

Note that you can not do 8:30 AM and 9:00 AM. You could do 8:00 AM, 8:30 AM, 9:00 AM and 9:30 AM (using BYMINUTE=0,30). Pure crack.

Everyday in January, for 3 years:

DTSTART;TZID=US-Eastern:19980101T090000 RRULE:FREQ=YEARLY;UNTIL=20000131T090000Z; BYMONTH=1;BYDAY=SU,MO,TU,WE,TH,FR,SA or RRULE:FREQ=DAILY;UNTIL=20000131T090000Z;BYMONTH=1 Isn't that totally on crack? Using FREQ=YEARLY for everyday in january? Notice how the semantics of "BYMONTH" change? In the first case, it's creating multiple events (BYMONTH=1,2 would name january and february independently); in the second case it's used to filter out individual days. Let me explain that a bit more: FREQ=YEARLY;BYDAY=MO,WE means every Monday and Wednesday. See how the modifier makes about 104 recurrences out of a single year? FREQ=HOURLY;BYDAY=MO,WE means every hour, but only on Monday or Wednesday. In this case, the modifier reduces the hourly events by throwing out all that are on other weekdays, reducing the number of recurrences. Again, this is not my weird reading, but the RFC says:

BYxxx rule parts for a period of time which is the same or greater than the frequency generally reduce or limit the number of occurrences of the recurrence generated. [...] BYxxx rule parts for a period of time less than the frequency generally increase or expand the number of occurrences of the recurrence.

(Note that I didn't find any details on if they consider a week to be be "less" or "more" than a month, since there is no obvious subset relationship, but a week can overlap two months, and a month usually overlaps five weeks... So if I have FREQ=WEEKLY;BYMONTH=1;BYDAY=WE, is that Monday in every week overlapping January? Every week completely contained in January? If I'd want every Monday in January, I'd use FREQ=DAILY;BYMONTH=1;BYDAY=MO...) Intersecting or joining two RRULE specifications is usually impossible (try to write one rule that is 8:00 and 9:30 every day for convincing yourself that a join won't work, and try to intersect FREQ=DAILY;INTERVAL=3 and FREQ=YEARLY;INTERVAL=2...) Anyway, I'm truly not suprised that my mobile and probably many other applications don't handle recurring events completely (that is when importing from iCal they often just lose the repetitions). My own implementation is doing okay. There are still a few missing features (BYSETPOS e.g. which can be used to say "the second to last tuesday or thursday each month"; should be trivial to add however, just picking the appropriate indexes out of a list), and some odd corner cases to dig in the specs and resolve (e.g. "every other week on friday, starting saturday march 3" - are we talking in business weeks, or intervals of 7 days here? When talking in weeks, is it friday in the week containing march 3, or following march 3, since that day itself is not a friday!) Some of these details probably vary heavily from iCalendar-supporting application to another... e.g. FREQ=DAILY;BYHOUR=8;UNTIL=20070215T000000Z does this include a recurrence on 2007/02/15 at 8:00 (which is past the UNTIL time, however the hour of the UNTIL field is not used in presence of BYHOUR). If you ever design a language for specifying recurrences, please:

• Allow interval repetitions or repetition patterns (e.g. Monday, Thursday) for any and multiple fields (iCalendar only has interval for one)
• Allow arbitray union and intersection
• Think of people not using Gregorian calendars, we have i18n/l10n...

Consider something like (intersect (repeat daily interval=3) (union (repeat weekly monday) (repeat monthly 1) ) ) (i.e. every 3 days, if they fall on the first of the month or on a monday) Also spend some time thinking about alignment: "Every monday in a week containing the 15th of a month." - months and weeks are not aligned; assuming a week being defined as Monday-Sunday, this can be any day between the 9th and 15th of the month (in fact you could specify this in iCalendar, but it's probably easy to come up with an example that is too difficult to represent in iCalendar RRULEs, albeit trivial to calculate.)

Jimmy Kaplowitz commented:

"The text "the board to confirm SPI's view of debian" goes to a 404 not found error page. If you are referring to this post: then I certainly had no idea what correspondence you were asking the secretary to report, and he may well not have known either if he wasn't up on the latest posts to debian-vote."

I'm not referring to that post. I sent a later message to board cc:general. I got bored waiting for it to appear, so I linked to where the next message will appear. I'm surprised it hasn't appeared yet. That's probably something to do with SPI's email-hostile server config, which I asked the board to address last month and they deferred.

"Please don't attribute a lack of response to a desire to avoid questions and add red tape when it can mostly be explained by a simple lack of understanding of the question. (Yes, if Neil had acted perfectly he would have replied to your mail asking what correspondence you meant, and if you had acted perfectly you would have included a link to the correspondence in the first place. Nobody's perfect.)"

I don't know what correspondence has been received, so how can I link it? I could link one example from me, I guess, but presumably there is more.

"I also can't find the correspondence to which you refer in any of my SPI list archives, private or not. If it was a direct mail to the secretary, then maybe Neil should have replied, but Neil is no more able to speak for the board in these matters than any other individual director. We'd need to pass a resolution if you wanted an official statement to end any confusion. Personally I think that SPI would act on a GR that overrode a DPL decision in keeping with the Debian Constitution, but as I just said, neither I nor any board member who spoke up on debian-vote can rightly express an opinion of the board on this matter in the absence of a resolution. Certainly a resolution would be reasonable."

I thought Neil is no more able to speak for the board than Joey or any other director. However, when I asked Joey to show proof that SPI only views the DPL, Neil posted. Neil's SPI secretary, so should know whether some proof exists, right? Now it seems a no-op resolution is needed to sort this out, as neither Joey or Neil agreed that SPI would follow non-DPL decisions. In a word: argh.

So far, DBus has two types of busses: the session and the system bus. The session bus is used by most of your desktop applications. The system bus is used e.g. by Hal signalling that new hardware was added, or by NetworkManager for network connectivity changes. The system bus is protected via a security policy. Problems arise now when you need to locate your session DBus from a different session. For example, from a cron job. There is a DBus application called "notification daemon" which can display popup baloons. This is useful for signaling yourself e.g. the completion of a long-running computation or just about anything you want. But it's using the session bus, so you can't reach it from outside of your current session. A year ago, I wrote a hack for this, which will locate your current Gnome session, read the environment variable to find the session bus and then send a message to the sessions notification-daemon. This is an ugly hack, however yesterday and today people asked on #dbus precisely how to do this. It seems to be a common question. Maybe DBus should be extended by a "user" DBus, and applications such as music players or the notification daemon should actually listen on that bus (as well). Maybe it could also be made possible to (securely) locate your session DBus via the system bus, I don't know how detailed the security policies of the system DBus are.

After using BitlBee as Jabber client during the last years, I recently switched to Gajim, a Jabber client written in pygtk2. It supports some important Jabber features which I really miss in BitlBee, for example group chat, gpg encrypted messages and priority adjusting according to the current status. After some tweaking of my ion3 setup (floating winprop for Gajim windows, getting trayer started in the dock to catch the Gajim trayicon, some additional keybindings for gajim-remote (which unfortunately requires dbus)), it's perfectly usable in my environment.

I’ll try to summarize the problems I usually encounter when packaging a game for Debian:

• Game data is not DFSG-Free: There are lots of games in which this problem seem to appear, including some of the most famous ones, maybe because of the influence these might have in new game developers. Many games have a free engine, and then decide to restrict game contents, mostly not allowing commercial use of these, or not granting the rights to modify them. This usually includes game maps, models, textures, sounds, fonts and so on. Sometimes those rights are granted under a Creative Commons license, which I hope will be DFSG-compliant sometime.
• Some game data might not be redistributable, even in non-free: It seems that many game developers don’t really understand copyright laws, or not care much about them, and pick images, models, textures or even fonts from random places without crediting their authors or even telling under which license they can be used. Thus, many games include data which might be not legal to redistribute. Not having a license means that no rights are granted at all.
• Game developers seem not to be very careful especially about fonts. Many of the fonts included with game data must be replaced by free ones.
• Releases seem to be quite atypical. Usually there’s a binary release including the game data and another different release just with the source code, but without any data file, you need both to make the game go. That means that repackaging is often needed. Game developers also tend to include in the same package whatever binary libraries are needed to run the game, mostly for Windoze.
• Build chain for data files often doesn’t exist. Some game developers even use their own packaging format to include all the data in a single file, and distribute only those packaged stuff with the game.
• Games tend to be very difficult to internacionalize. Many times texts are written graphically in screens. Some other times they use their own translation system, which might be relatively difficult to handle.
• Many games use relative directories to store their data, sometimes needing writing permissions too. As this doesn’t conform to Linux and Debian standards, the code must often be adjusted to use standard Linux paths and home directories to store whatever the program needs to save.
• Some games also need writing permissions in global files, for example for storing “hall of fame” lists. This is usually solved in Linux world by making a games group with permission to write on those files, but it’s quite a dirty hack in my opinion.
• There’s often not a clear documentation on which copyright and license applies to each file. Especially for non-code stuff, it’s hard to find out if it has been created by the game developers, where it comes from, or which license applies to it. I guess there’s a misunderstanding in that, when no license is explicitly said, all restrictions apply, and not the reverse as many people seem to think. No license means no rights at all.

I’m sure I’m leaving lots of points out of this list, it doesn’t mean to be exhaustive in any way. Maybe I’ll remember more things later.