While anyone who has had a 1) medical condition and 2) access to Internet in the last five years probably knows that patients are increasingly using the net (and now google) to diagnose medical conditions, it is only now that the medial establishment is starting to recognize or really admit to the reality of this widespread phenomenon and even doing studies on them, such as the one released a few days ago by the BJP Googling for a diagnosis use of Google as a diagnostic aid: internet
based study. The study sought to ascertain how effective google was as an aid in medical diagnosis. As various new outfits are reporting it is moderately high. What I love about this study and the corollary reporting is the naive tone they have to assume, transmitting the news as if the public knew very little about this, and would in fact, be induced into surprise!!!!!!!!!! when first facing the new. But in fact, I think it works in the opposite way. The surprise is that they took so long to admit to what was in front of us for many years now. While the news articles reporting on the study stay within the province of doctors, the report acknowledges, in fact opens with, the fact that patients may be forging the path in Internet-diagnosis. The authors write in their second paragraph:

It seems that patients use Google to diagnose their own medical disorders too. After evaluating a 16 year old water polo player who presented with acute subclavain vein thrombosis, one of us (HT) started to explain that the cuase of the thrombosis was uncertain when the patients father blurted out But of course, he has paget-von Schrotter symdnome. Having previously googled the symptoms, he gave us a mini-tutorial.. and the correct treatment for the syndrome. This experience led us to ask How googe is google in helping doctors to reach the right diagnosis

Again, what I love about the tone of this opening is that it is as if these doctors stumbled on a great but deeply hidden fact to make a breath-taking discovery, one that, however, since is it is SO very emergent and thus still not *really* verified by Science, they must proceed with great caution, qualifying with phrasees like It seems that patients use Google to diagnose their own medical disorders too . I am sure they and most doctors are personally are not so na ve but since this has been something virtually without no official acknowledgment among professionals and in the journals, the genre of writing just requires it to be framed cautiously. As fun to read are the comments, for they stretch from moral panic:

The implication that ‘googling’ be an adjunct to proper medical school training, continuing medical education through courses and reading peer reviewed journals is laughable and bordering on dangerous. I am shocked that this has been published by the BMJ.

to celebration:

For the modern dermatologist, the internet is indispensible and google is only the start, and for this reason a desktop computer with high speed internet access is an essential tool for all clinicians. Long live the information superhighway!

While others muse on the broader emacipatory possibilities

One can imagine the benefit to young doctor in developing country who now have access to a grand medical library in their hands.

I am especially interested in this very dynamic because it is one pillar propping my next project on psychiatric survivors, which exceeds the particular topic of challenges to psychiatry in its general focus on medical/patient reconfigurations following from Intent-based activism, self-help, diagnosis, and critique. And for those who think I have made a radical departure from my last project, here is where I see one (of two or three) threads of continuity: for patients are generating an enormous amount of amateur knowledge, that I think is not unlike the peer-to-peer production of software hacking, and it is a form labor usually accompanied by a strong critique of expertise and other medical practices. I am now reading some literature on patient activism, like the issue from the February 2006 in Social Science and Medicine that collects 11 articles on patient organization movements. For those who work on this topic, the collection is worth your while and the editorial introduction by Kyra Landzelius is stellar. It is not only written beautifully (which I think is rare for these openings because it is often a rote, unimaginative regurgitation but this was a pleasure to read) but provides an engrossing overview of some new trends and some of the diverging forms of politics that arise from what is really a motley bunch of organizations and contests in patient and anti-patient activsm. She opens by defining four spheres that shape and inform the forms of contents that are part and parcel of these patient movements, the four being: 1. Revolutionary feats in technoscientific engineering
2. Restructuring of healthcare systems across industrialized nations
3. A Revised contract between science and the public stemming from a criss of confidence in science
4. An upsurge in the articulation and diversification of health activisms (p. 530) These four are key but I was shocked that there was no specific inclusion—though it comes out plenty in the introduction in other ways of the Internet. For while I am no techno-determinist, the Internet I think, can’t be ignored for it has fundamentally changed the map and tenor of patient activism, allowing for more rapid connections between various stakeholders, providing a medium by which those officially unrecognized illnesses are given shape and form, and where an ethical cultivation of self-help, self-diagnosis, self-medication, along with copious critique and forging of alternatives is happening, right before our eyes, virtually in real time. It is the medium by which a new chapter of patient activism is being written and I think it is a real mistake not to give it serious attention and credit. And perhaps one of the most interesting things about it is that it without it, it would leave many otherwise home-bound, sick folks, without a medium by which to engage in political activity or even community self-help, for let’s face it, these take a lot time and energy. When you are sick and home-bound, for example, there may be a limited number of types of engagements you literally have the energy to partiicpate in and the Internet lowers the barrier of political entry because of its ease and because you can still type away, even when feeling otherwise totally awful… This may be a brute material point but nonetheless, key to understanding the political power of the Internet. Now of course the question left is will Google capitalize on this and create “Google Diagnosis”?

The last time I made any serious contributions to Wikipedia was back in 2001 or 2002. The community was exciting, friendly, and welcoming, and I enjoyed spreading the word as most non-technical people I knew had never heard of wikis or Wikipedia. Since then, I may have corrected the occasional typo or fixed a legal error, sometimes anonymously and sometimes under my account (apparently I “clarified the 13(c) protective arrangement issue” in the Urban Mass Transportation Act of 1970 back in the Fall of 2003, although I have no recollection of having done so), but I hadn’t started any new entries since the early days. At a recent presentation I attended by Sun’s Hal Stern, I learned that his eating club (Colonial Club) at Princeton University has a Wikipedia entry (as do all the other eating clubs). On further investigation, I learned there were no entries for any of the student cooperatives or other upperclassman eating options. To the uninitiated, it may be hard to understand why this matters beyond the insular Princeton community, but — suspend your disbelief just for a moment — the eating clubs have been called Princeton’s “peculiar institution” (a side-long reference to slavery) and have a storied and controversial history going back at least to the 1870’s (see, for example, this summary of the historical record from 1888-1993). It seemed to me that omitting the student cooperatives was akin to having a Wikipedia article on political parties that includes links to both the Republican and Democratic parties but leaves out any mention of the Green Party. Of course, the Green Party doesn’t wield the influence of either of the main parties, but its existence provides insight both into the American political system and the character of the two main parties. If no mention of the Green Party were included in Wikipedia, a foreign researcher attempting to learn about the American party system would come away with an incomplete and misleading understanding. The fact that the Green Party has not been particularly successful nationwide is, itself, interesting, useful, and relevant information. Although I wouldn’t pretend Princeton is as important or interesting as the American political system, it’s still a subject of scholarly investigation, and a topic that a fairly significant number of people are interested in learning about. I thought I would start basically a stub article for the Two Dickinson Street Co-op and spend a couple of days building it out and asking knowledgeable experts to contribute and add sources. Within a few seconds after I created the article, however, it was “speedily” deleted. A bit surprised, I tried to start an explanation as to why the entry warranted at least consideration for inclusion, and the article was deleted again and I found this message on my “talk” page:

This is your last warning.
The next time you vandalize a page, you will be blocked from editing Wikipedia. Diez2 14:55, 9 November 2006 (UTC)

I had gone from citizen to felon in two minutes flat! There then ensued several attempts to at least allow a debate on the deletion, but the article was unilaterally speedily deleted several times by several different editors. Even after one admin restored the article as not appropriate for “speedy deletion,” another admin stepped in and speedily deleted it again. I received some fairly acerbic retorts to my attempts — e.g. this: “We don’t have a page for every club in the world. If you want free web-hosting check out Myspace or usenet. Also anonymous postings do not make a topic notable or important.” (I’m not sure why he accused me of posting anonymously — I didn’t. Also, does “usenet” offer “free web-hosting?”) Finally, the deletion of the article was converted from a “speedy deletion” to a nomination as an “article for deletion” (‘AfD’), which allows at least for some discussion on the topic. The debate is ongoing — see it here — and some of the comments continue to be fairly corrosive. For example, one editor wrote:

• Strong Delete Fails WP:N, WP:V. It should be noted that on User_talk:Eagle_101 the editor of the article hs refused to give even just one reliable source of the article to assert it’s verifiability and notability. That alone should speak volumes for the article’s worth. Wizardry Dragon ^{(Talk to Me) ((My Contributions) (Page Moves) (Support Neutrality on Wikipedia)} 23:01, 10 November 2006 (UTC)

Another editor called the debate a “pointless waste of time” over a “vanity article,” although I can’t find that comment any longer. I admit that I created the article without knowing much about the process, and certainly with little understanding of the numerous acronyms, flags, and the several different ways an article can be killed. Apparently, I didn’t contest the speedy deletion properly, although it wasn’t clear to me from the deletion notice exactly what I was supposed to do, and I assumed the restoration of the article by another admin meant that it would persist for at least a few days. I thus deserve some of the blame for not doing more pre-posting diligence, but I was relying for the most part on my 2001-2002 experience where you could create an article, spend a few days improving it, invite others to contribute, etc., and articles with a colorable argument for inclusion would generally stay in. It seems the new Wikipedia is a much less kind and less gentle Wikipedia. As another participant in the process wrote to me:

This whole situation is so strange. It makes me feel like I just stumbled into somebody else’s trench warfare. The defenders of notability! I wonder how long the constant vigilance of volunteers will hold out…

Of course, a similar phenomenon has occured with many open source projects. Initially, the doors are wide open and everyone’s contributions are, if not welcome, then at least tolerated. I suppose it is a sign of Wikipedia’s success that the front gates are locked so tightly. Still, I wonder how many potential good faith contributors are now permanently alienated by an initial bad experience such as this one, and whether Wikipedia will ultimately suffer from it. Low barriers to entry have traditionally been a key element to attracting participants to peer production efforts, but they seem to break down in direct relationship to the project’s external importance. Incidentally, Stern’s edit to the Colonial Club entry, mentioning F. Scott FitzGerald’s characterization of the club, was quickly reverted by another editor as “nonsense.”

I often need to do list-like operations on files in shell, for example:

• substract lines in one file from the lines in another file
• add lines from two lines, suppressing duplicates
• keep only lines which are not in both files
• keep only lines which are in both files
• etc

Such operations are easy to do with a combination of sort, uniq, cut, diff, etc. But they are so basic operations that it is a bit annoying to write the small shell script each time I need to do one of them. Isn’t there a tool out there already providing all of them ? Also, it would be great if such operations could be achieved considering only the first n characters or words (a bit like uniq -w, or the removed uniq -W option). It would be an easy way to do :

i1 c1
i2 c2
i3 c3
i4 c4

minus

i2
i4

Comments are opened. Update: many people pointed me to moreutils‘ combine. It looks good, bug not exactly what I need, so I filed wishlist bugs #398187 (combine: provide aliases for set theory operators) and #398193 (combine: allow to compare only on a subset of the lines). I won’t have time to provide patches, so if somebody want to work on them ….

My post about securing an office received many comments, so many that I had to write another blog entry to respond to them and also add some other things I didn't think of before.

One suggestion was to use pam_usb to store passwords on a USB device. It sounds like it's worth considering, but really we need public key encryption. I don't want to have a USB device full of keys, I want a USB device that runs GPG and can decrypt data on demand - the data it decrypts could be a key to unlock an entire filesystem. One thing to note is that USB 2.0 has a bandwidth of 30MB/s while the IDE hard drive in my Thinkpad can sustain 38MB/s reads (at the start - it would be slower near the end). This means that I would approximately halve the throughput on large IOs by sending all the data to a USB device for encryption or decryption. Given that such bulk IO is rare this is feasible. There are a number of devices on the market that support public-key encryption, I would be surprised if any of them can deliver the performance required to encrypt all the data on a hard drive. But this will happen eventually.

Bill made a really good point about firewire. I had considered mentioning it in my post but refrained due to a lack of knowledge of the technology (it's something that I would disable on my own machines but in the past I couldn't recommend that others disable without more information). Could someone please describe precisely which 1394 (AKA Firewire) modules should be disabled for a secure system? If you don't need Firewire then it's probably best to just disable it entirely.

To enable encryption in Fedora Core 6 you need something like the following in /etc/crypttab:

home_crypt /dev/hdaX /path/to/key
swap /dev/hdaX /dev/random swap

Debian uses the same format for /etc/crypttab.

The Peregrine blog entry in response to my entry made some really good points. I wasn't aware of what SUSE had done as I haven't done much with SUSE in the past. I'm currently being paid to do some SUSE work so I will learn more about what SUSE offers, but given the SUSE/MS deal I'm unlikely to use it when I don't have to. Before anyone asks, I don't work for SUSE and given what they have just done I will have to reject any offer of employment that might come from them.

I had forgotten about rsh and telnet. Surely those protocols are dead now? I use telnet as a convenient TCP server test tool (netcat isn't installed on all machines) and never use rsh. But Lamont was correct to mention them as there may be some people still doing such things.

The Peregrine blog made an interesting point about Kerberised NFS being encrypted, I wasn't aware of this and I will have to investigate it. I haven't used Kerberos in the past because most networks I work on don't have a central list of accounts, and often there is no one trusted host.

I strongly disagree with the comment about iSCSI and AoE "Neither protocol provides security mechanisms, which is a good thing. If they did, the additional overhead would affect their performance". Lack of security mechanisms allows replay attacks. For example if an attacker compromises a non-root account on a machine that uses such a protocol for it's root filesystem, the victim might change their password but the attacker could change the data back to it's original values even it if was encrypted. Encryption needs to have sequence numbers embedded to be effective, this is well known - the current dmcrypt code (used by cryptsetup) encrypts each block with the block ID number so that blocks can not be re-arranged by someone who can't decrypt them (a weakness of some earlier disk encryption systems). When block encryption is extended to a network storage system I believe that the block ID number needs to be used as well as a sequence ID number to prevent reordering of requests. CPU performance has been increasing more rapidly than hard drive performance for a long time. Some fairly expensive SAN hardware is limited to 40MB/s (I won't name the vendor here but please note that it's not a company that I have worked for), while there is faster SAN hardware out there I think it's reasonable to consider 40MB/s as adequate IO performance. A quick test indicates that the 1.7GHz Pentium-M CPU in my Thinkpad can decrypt data at a rate of 23MB/s. So to get reasonable speed with encryption from a SAN you might require a CPU which is twice as fast as in my Thinkpad for every client (which means most desktop machines sold for the last two years and probably all new laptops now other than the OLPC machine). You would also require a significant amount of CPU power at the server if multiple clients were to sustain such speeds. This might be justification for making encryption optional or for having faster (and therefore less effective) algorithms as an option.

I believe that the lack of built-in security in the AoE and iSCSI protocols gives a significant weakness to the security of the system which can't be fully addressed. The CPU requirements for such encryption can be met with current hardware even when using a strong algorithm such as AES. There are iSCSI accellerator cards being developed, such cards could also have built in encryption if there was a standard algorithm. This would allow good performance on both the client and the server without requiring the main CPU.

Finally the Peregrine blog entry recommended Counterpane. Bruce Schneier is possibly the most widely respected computer security expert. Everything he does is good. I didn't mention his company in my previous post because it was aimed at people who are on a strict budget. I didn't bother mentioning any item that requires much money, and I don't expect Counterpane to be cheap.

Simon noted that developing a clear threat model is the first step. This is absolutely correct, however most organizations don't have any real idea. When advising such organizations I usually just invent a few possible ways that someone with the same resources and knowledge as I might attack them and ask whether such threats seem reasonable, generally they agree that such things should be prevented and I give further advice based on that. It's not ideal, but advising clients who don't know what they want will never give an ideal result.

One thing that I forgot to mention is the fact that good security relies on something you have as well as something you know. For logging in it's ideal to use a hardware security token. RSA sells tokens that display a pseudo-random number every minute, the server knows the algorithm used to generate the numbers and can verify that the number entered was generated in the last minute or two. Such tokens are sold at low prices to large corporations (I can't quote prices, but one of my clients had prices that made them affordable for securing home networks), I will have to discover what their prices are to small companies and individuals (I have applied to evaluate the RSA hardware). Another option is a GPG smart-card, I already have a GPG card and just need to get a reader (this has been on my to-do list for a while). The GPG card has the advantage of being based on free software.

One thing I have believed for some time is that Debian should issue such tokens to all developers, I'm sure that purchasing ~1200 tokens would get a good price for Debian and the security benefits are worth it. The use of such tokens might have prevented the Debian server crack of 2003 or the Debian server crack of 2006. The Free Software Foundation Fellowship of Europe issues GPG cards to it's members, incidentally the FSFE is a worthy organisation that I am considering joining.

As far as I've understood RSS, you can essentially syndicate any content that can be expressed as XML. So in theory, all that is missing so Debian's bug tracking system can track changes in the respective upstream and downstream BTSes would be an appropriate format and the implementations. Since I'm certainly not a Web 2.0 god, nor do I intend to become one, I have no idea how to make sure that no events are lost (for example when bugs fall off the main RSS feed during a mass filing), so I'd like input here, as well as on which events should be tracked and how to synchronise with multiple upstreams (which may be important for derived distributions).

One of the annoying features of reading several planets, is that you end up reading entries from people you otherwise respect, who seem to have various complexes about nonsensical issues. We all saw the month in which half of Debian decided it was cool to rip on Ubuntu, and now apparently it's the new cool thing to do if you work on Fedora.

According to a particularly obnoxious entry, the quality or otherwise of Ubuntu's kernel[0] does 'damage to the free software community'. Now, they've focussed on binary drivers. Which is fair enough: I am personally quite uncomfortable with binary drivers, and extremely unimpressed with Ubuntu's recent move towards binary drivers by default. While I respect the fact that they still encourage users to install free drivers, providing them by default is not a winning move, in my opinion. But I'm not going to discuss this further right now, because if I do, the terrorists win.

The reason the terrorists win, is because some people like to furiously handwave and make strawmen. Apparently now, everyone who's ever touched Ubuntu is rabidly for binary drivers, but the problem here is the handwave from criticism of Fedora's alleged community into yet another ramble about the kernel tree and binary drivers.

I certainly hope the Fedora community is more mature than this, both in general, and in their ability to have a constructive debate about the level of its community involvement. Right now, it is not even disputed that there is effectively none. At first glance, they may appear similar, but if you look further, the similarities vanish. Anyone can come in and get involved in the decision making in Ubuntu, but more important than that, the process is at least completely transparent, so you can see what's going on, on public lists, at every step. Fedora does not have this: decisions magically appear On High from RHEL types. This is not necessarily a bad thing, and does not necessarily result in a lower-quality distribution, but if everyone could just accept this as being true and move on, rather than bitterly baiting a successful community distribution about it, I think everyone would be a lot happier.

The biggest difference is -- yes, basically all the Ubuntu core developers are employed by Canonical. These people were handpicked from the Debian community originally, and now a great deal of them start as Ubuntu community members, and are employed by Canonical because having them work full-time on this stuff would be awesome. The process is still entirely transparent: being employed is a mark of recognition (sorry), and a request to continue working on this even more, rather than a pre-requisite to being able to do anything. Witness Fedora Core vs. Fedora Extras, for example: there are quite a few packages that non-Red Hat employees are prevented from meaningfully contributing to.

So, the summary in a nutshell: binary drivers bad (and Ubuntu moves towards promoting same even worse), Fedora 'community' not at all, handwaves bad, refusal to get involved with a meaningful debate about community governance and structure without engaging in petty mudslinging and pointless handwaves inexcusable.

(Disclaimer: I am not involved with any distributions, nor do I have any professional affiliation with them either. I'm just an irritated observer.)

[0]: I don't claim to have any insider knowledge here; the only point at which its quality or otherwise has become an issue for me lately, is a random hang in gettimeofday() in a corner case recently, which I've been too lazy to isolate and report as a proper bug; I worked around it in the X server anyway.

I m a fan of statistics, so I created a small perl script that reads your gaim message history and, for the top 10 contacts, creates graphs: One for the total bytes chatted, one for the bytes chatted on each day, and two with weighted averages, over one week and one month timespan. You need the perl modules in libgd-graph-perl and libxml-xpath-perl, and my script. Run it and it will output the four png s in the current directory.I don t have examples, as the output is far too private to put up here, and I m too lazy to create interesting test data. There is a lot you can discover in these graphs: When you got to know someone (or when he started IMing), when you were not good terms with someone etc.

I’ve been working on archive rebuilds lately (rebuilding all etch packages inside etch). It generates a lot of data to analyze (failed build logs), and the work could easily be split between several developers. For each package which fails to build, I add a line in a Gnumeric spreadsheet with the package name, the version I tried to build, the output of a script which tries to guess the reason for the failure using regexps, and the “resolution” (was a bug filed ? a new package not yet in testing ?) (example here) Instead of doing this locally in Gnumeric, I’d like to do that online, using wiki-like editing, so other people could investigate different failures concurrently. My ideal piece of software would:

• be efficient to use (something AJAX based would be great)
• allow for line-based locking, so people can just lock the line they are working on
• allow for CSV-export/import, so I could fetch the whole data, add new failures using a script, and import it back

Does this exist ?

We are fortunate in Massachusetts to have fairly simple paper ballot voting machines (rather than electronic touch-screen voting machines, see, e.g. Ed Felten’s comprehensive critiques of electronic voting). When I voted this morning, however, the machines were not feeding the ballots. Instead, the poll workers were piling the ballots up on top of the machines, apparently to be fed into the machines when they figured out how to get them to work. When I left (about 90 minutes after the polls opened), they had gotten to the point of triple-checking whether the machine was plugged in. I felt a bit uneasy leaving my secret ballot in a big open pile. It was somewhat reassuring that a police officer seemed to be in charge of watching the ballots, but I still will always have a slight reservation as to whether or not my vote was actually counted. Don’t they get to work early to test the machines? Perhaps do a few dry runs, kick the tires, etc.? Other industries seem to have figured out most of these problems a long time ago — for example, I can’t remember a single instance in my entire life of encountering a paper jam (cash or receipt) with an ATM. (I’m sure it does happen, just rarely enough that it’s never effected me). If a system is mission critical, it should be possible to get the failure rate down to something more acceptable.

All mozilla-based browsers have a feature called "userContent.css". It was designed to allow you to override page CSS with your own, e.g. for accessibility reasons. It has mostly been used by people to remove ads, and I'll share two examples with you. Create ~/.gnome2/epiphany/mozilla/epiphany/chrome/userContent.css (you'll probably need to create the chrome directory, too; other browsers use similar path names) and put these two rules in there:

a[href$=".pdf"]:after  font-size: 10px; color: red; content: " [PDF]"; 
iframe[src*="devart.adbureau.net"]  display:none !important; height: 0;  
@-moz-document domain("mail.google.com")   button#ac_tr   color: red !important;   button#ac_dl   color: red !important;    

The first one will postfix a red [pdf] to any link going to a PDF file. This is very valueable especially with Google scholar. The second rule is an example on how to hide elements. This example hides some ads on deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the ">deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the ">deviantart. You can easily pick a wider term or grab some of the existing rulesets. The third rule will color the "delete" button in Gmail red, so you find it easier. Since it moves around (UI hazard; "delete forever" replaces "archive" button in spam and trash folders.) this is quite nice to have. But if you want to go for default ads filtering, I'd suggest to use some of the adblock extensions. These userContent tricks are mostly useful for adding rules that the extension didn't catch.

2.6.18-4 was uploaded on Sunday and should be soonest available after dinstall run for most archs. The ia64 build failure is fixed in svn thanks to Thiemo Seufer (ths). alpha is waiting for an updated gcc (see patch in #397139). s390 is currently broken by vserver, patch is awaited soon. linux-latest will be updated tomorrow and expect soon a 2.6.18-5, once those issues are cleared.
linux-image-2.6.18-2- is the Debian kernel team stabilized kernel. Please install it and report eventual bugs. If you know a patch from Linus git tree that fixes your problem even better name it. Thanks for your testing!
We had been quite busy to feed stable with patches that fit the Documentation/stable_kernel_rules.txt. Goodies like Xen, drm-i965 or ahci backport are shared with Fedora Core 6 release. Beyond that for example the r8169 patch series or ccisss support for 2 TB volumes got backported. Out of reach are destabilizing patches like the new 2.6.19 ACPI patches. Further backports are planed for the SUSE reiserfs 2.6.19 patches and vorlon has a fix in the pipe for the vga console driver on alpha.

I have just read the news about Saddam finally receiving the death penalty (it did not seem likely that his case would have any other outcome) and have been thinking about the death penalty in general.

Firstly I think that in a jury based system every jury member should have a hand in the execution. If they vote for the death penalty (if you use a jury then it should decide whether the death penalty is acceptable) then they should all be involved in carrying out the sentence. It would be quite easy to fit a room with a dozen switches that control an electric chair. If the jury members are unable to pull the switch then that should result in the sentence being commuted. I am against people voting for actions which they lack the courage to perform themselves.

One problem I have with the death penalty is the poor quality of justice in most courts. The US is a good example of this where poor people are the ones who get the death sentence. A pre-requisite of having penalties such as the death penalty should be that there is a reasonable chance of convicting the person who committed the crime!

In the case of someone like Saddam Hussein there is an additional problem of creating a martyr. I think that a solution to this would be to give him a life sentence and put him on TV on shows based on the Jerry Springer Show. Show him for what he is and let the audience pass judgement on him, I'm sure that he would not do well on such a show.

Another possibility is to have a glass prison where the lights are always on and web-cams show everything he does (including the toilet and shower). That might fall into the category of cruel and unusual punishment, but really the cruel and unusual stuff is what happens in Abu Ghraib (under the command of Saddam Hussein and more recently under the command of George Bush).

Having spent the better part of two days provisioning my new MacBook Pro’s OS X, Debian, and Windows XP instances, I am keenly aware of how much the Debian distribution’s package management system and its volume of packages have spoiled me. In that two days, the amount of time required to provision Debian was negligible, even though it is configured to completely match my Lifebook’s Debian Sid instance. In fact, the sum total of time to set up Debian, including every application I use, was about 45 minutes of my involvement. Those who know Debian (and Ubuntu, Linspire, Xandros, Mepis, or any other Debian derivative) are coolly nodding their heads, while others are probably thinking I am a lying, biased Linux zealot. It’s no lie; here are the steps I had to take:

• Run the Debian Installer business card image and perform a stock Sid installation, choosing Desktop and Standard System options in the task selection step. If you weren’t wanting to run Sid, the netinstall image would be fine as well.
• Generate a package list on the current Debian installation via # dpkg --get-selections > dpkg-selections.txt
• Copy the package list file to the new installation; I have copied it to my home directory in this example.
• Set the package selections for the new installation via # dpkg --set-selections ~/dpkg-selections.txt
• Run aptitude or synaptic and choose the install action, then go do something else. Thousands, literally thousands of software packages are being installed for you. Everything from your email client to your office suite to your software development tools are being pulled down from package mirrors. In my case, this was over 850MB of compressed package files.
• After the package download, answer any configuration questions aptitude (or synaptic) poses.
• Copy your /home directory contents to the new installation.

Compare that to what it takes with either Mac OS X or Windows XP to get all of your applications installed and configured. Even if you don’t know a thing about Linux or even the more technical side of those operating systems, you can tell from the brevity of that set of steps that the Debian setup is remarkably simple. Now, some will already be keying in their comment posts with exclamations of “Hey! There’s DarwinPorts/Fink/Cygwin!” Yeah, each of those is a nice start; however, they pale in comparison. Fink at least has the robust apt/dpkg foundation, but even it has a relatively meager package selection. I am sure I’ll be writing more on life with Fink and DarwinPorts in the near future. I still don’t have half the stuff installed on XP that I plan to use. I get tired just thinking about the installs. 8^)

When writing LaTeX documents I usually just edit the plain text in vim, and in another xterm I type make && xpdf foo.pdf to regenerate the PDF output and view it in xpdf. This is tedious and slow if you do it often. A much better way I found out about now, is to use latexmk. apt-get install latexmk This tool autogenerates a PDF or PostScript file out of your *.tex file(s), so it would make my Makefile obsolete. But the much better thing is that it has a preview mode: latexmk -pvc -pdfps foo.tex This generates a PDF out of foo.tex (and its dependencies, if any), and refreshes the PDF every time the foo.tex file gets updated (i.e., every time I type :w in vim). So I can now leave the xpdf instance open all the time, and it'll be refreshed automatically to show the latest version of my document. Caveat: in xpdf you have to press (for example) "next page" and then "previous page" (SPACE, BACKSPACE) to refresh the screen. Leaving out the "-pdfps" makes the regeneration process a bit faster and uses xdvi for previewing as dvi (instead of PDF) which does not require the above SPACE+BACKSPACE hack. But I like xpdf better than xdvi, so I'll stick with it.

I was too busy to read my favourite tech news the last few weeks. This sunday I finally started working on the backlog. Parts of it - I'm not going to try to catch up with Slashdot... And most of the time, I'm only reading the headlines, too. Most of the stuff here will be in German; since I'm also interested in the politics surrounding technology here in germany, a local ticker such as Heise is most useful for me.

• If you're living in germany, please sign the Petition against the use of voting machines in germany. Read my german blog post on it for the reasons why voting machines undermine democracy (short version: most citicens can't verify their vote was counted, or that the system is fair)
• Nvidia closed-source drivers had a security issue. German article on it. Another example why closed source drivers are bad - they don't get the security verifications and support that opensource software has. Apart from being badly integrated and less reliable.
• Google bought YouTube. IMHO a bad idea. YouTube is full of copyright violations, and there is not that much original content or community, actually. Having the financial background of Google, it's now much more interesting to actually sure YouTube.
• Buchpfade.de a community platform created by friends of mine, centered around books. Don't ask me about details, I havn't used it yet. I think you can see what your friends have been reading, and get some book recommendations based on the reading habits of others.
• Kiss or Diss
. Like Hot or Not, but with video. (aka: "totally better"). Though not too interesting for the tech crowd, it actually is quite addictive. The official launch should happen sometime the next few days.

the Novell and Microsoft deal: I wonder if it's mostly to show an act of good will, to calm Europe in preparation of the Vista release. This and the new API for third party security software may get them to launch Vista on time in Europe, too.

Contact information on web pages. May now be reachable with two clicks from the first page, if the wording is obvious. Germany used to require contact information to be reachable with a single click for commercial web pages.

Flash 9 for Linux. Beta. Closed source, and it frequently locks up my browser. Probably has a lot of security issues, too; so better use it only with flashblock, and load flash only from somewhat trusted sites. But it works, and it finally allowed me to see that I don't care about MySpace videos and similar crap.

New Ubuntu release. Congrats, but I havn't tested it yet. I considered going Ubuntu for some of my computers, but ended up with Debian on all of them. I just feel more at home here, and there is not much that Ubuntu has in extras for me that I really need.

My new laptop has harddrive encryption, and encrypted swap. Suspend works, thanks to David Härdemann for helping me with that.

I missed the Debian bug squashin party, which was kindly hosted by the LiMux team, responsible for the Debian Linux installation at the city of Munich. This deployment may become one of the most prominent examples of good Debian use: customized, to offer the best end user experience.

Debian renames firefox and thunderbird. Welcome iceweasel and icefox. The official mozilla stuff is somewhat written for Windows, and needs modifications for proper Linux integration. This violates Mozilla trademark policy. In fact, Ubuntu and other Linux distributions would have to do this renaming, too!

BenQ Mobile crash in Germany. IMHO this was planned by both Siemens and BenQ to get rid of "liabilities". Reminds me of the famous un-word "Kollateralschaden"...

Firefox 2.0 - does this mean it has more features I do not need? I'm using epiphany; it has almost all the features I need, but a much nicer, less cluttered UI. Some say it's also faster, and it's Gnome integration definitely is better. The only thing I sometimes use firefox for is the web developer extension, which is a really nice tool when you have to fight HTML and CSS.

Java to become OpenSource. Well, I hope they use a sane license... but at least that should finally clear up the licensing issues many people still see with current Debian Java packages. But I fear it might already be too late - Mono support has been better than Java for some time now.

I had an exhausting and stressing weekend. We had a long long holiday this week in Mexico. Some people had the week until Tuesday and had from Wednesday to Sunday off, because of the Day of the Dead celebration (being Nov 1st and 2nd, and taking Friday 3rd also). I didn’t have any classes, but the Superior Algebra teacher made us attend an exam on Friday and Saturday (9 am and 8 am, respectively). Some of my friends were high and drunk from Tuesday afternoon and will remain that way until tomorrow, while I had to stay at home and work stressing for my poor understanding on the class, trying to study with tons of things on my head, etc. This so much sucks. Anyway, last week, Raquel, Tato, Javier and a friend of Tato managed to go to Yeah Yeah Yeahs‘ concert, which was fucking amazing. I love Karen O, her sex appeal and the way she does to put people in the mood is great and lovely. Unfortunately, Rach hasn’t put the pics (we got her digital camera inside the building but was discovered by the staff and forced to put it on a stuff hold table, fuckers) yet, I hope she does soon The best moment of the concert: Date with the Night. Next weekend, the Corona Music Fest will take place in the Azteca stadium, which has me anxious. I can’t wait to watch The Mars Volta on stage. Other nice bands I’m expecting to watch are NOFX, Clap Your Hands Say Yeah, Resorte, La Gusana Ciega and the Nortec Collective. Here’s the flyer:

Following Joey’s lead, here’s some DWN-style comments on some of the stuff I’ve been involved in or heard of over the past week… A future for m68k has been planned on the release list, after being officially dropped as a release architecture in September. The conclusion of the discussion seems to be that we’ll move the existing m68k binaries from etch into a new “testing-m68k” suite that will be primarily managed by m68k porters Wouter Verhelst and Michael Schmitz, and aim to track the real testing as closely as can be managed. In addition the m68k will aim to make installable snapshots from this, with the aim of getting something as close as possible to the etch release on other architectures. A new trademark policy for Debian is finally in development, inspired by the Mozilla folks rightly pointing out that, contrary to what we recommend for Firefox, our own logos aren’t DFSG-free. Branden Robinson has started a wiki page to develop the policy. The current proposal is to retain two trademark policies – an open use policy for the swirl logo, that can be used by anyone to refer to Debian, with the logo released under an MIT-style copyright license, and left as an unregistered trademark; and an official use license for the bottle-and-swirl logo, with the logo being a registered trademark, but still licensed under a DFSG-free copyright license. The hope is that we can come up with at least one example, and hopefully more, of how to have an effective trademark without getting in the way of people who want to build on your work down the line. Keynote address at OpenFest. Though obviously too modest to blog about this himself, Branden Robinson is currently off in Bulgaria, headlining the fourth annual OpenFest, speaking on the topics of Debian Democracy and the Debian Package Management System. New Policy Team. After a few days of controversy following the withdrawal of the policy team delegation, a new policy team has formed consisting of Manoj Srivastava, Russ Allbery, Junichi Uekawa, Andreas Barth and Margarita Manterola. Point release of sarge, 3.1r4. A minor update to Debian stable was released on the 28th October, incorporating a number of previously released security updates. Updated sarge CD images have not been prepared at this time and may not be created until 3.1r5 is released, which is expected in another two months, or simultaneously with the etch release. Debian miniconf at linux.conf.au 2007. While it may technically not be supposed to be announced yet, there’s now a website for the the Debian miniconf at linux.conf.au 2007, to be held in Sydney on January 15th and 16th (with the rest of the conference continuing until the 20th). This year derived distributions are being explicitly encouraged to participate, so competition is likely to be high, and it’s probably a good idea to get your talk ideas sorted out pretty quickly if you want them to be considered!

I've been trying some stuff with the Turbogears application I worked on a bit during the last two weeks. First thing was that I looked into using postgres as DB backend for Turbogears. Which turned up a bug in sqlalchemy (an ORM, mapping objects to database rows and back). I was passing a unicode string to the getBy function (to retrieve an object by it's primary key), and it went into the SQL statement without any quoting. Since my keys are all ascii, I could just cast them into regular string objects, and getBy worked then. Performance with postgres is worse than with sqlite; this is not too surprising. However this might change once I enable multithreading. Performance numbers: with SQLite: 8.30 trans/sec, with Postgres: 7.52 trans/sec These performance numbers are still very bad, and I guess we won't be keeping Turbogears on the long run, unless I find some documentation on improving the speed. One of the hints I got was to avoid py:match in kid, the templating engine used. I started by not using turbogears "sitetemplate" default template. This would automatically insert javascript and css files when needed. Since I don't use their widgets and such, I havn't been using this feature anyway. Not using the template - which contains one py:match for the 'head' tag and one for the 'body' tag - improved performance to 9.01 trans/sec (or 8.32 trans/sec) Now I can't explain why the improvements in the postgres run were better; both are a 10 minutes siege run. But 8.5% improvement is a start. I'll look into getting rid of the other py:match instances in our templates. (If I'd only find a good example with py:def - guess I'll instead "precompile" pre-templates into the actual templates or so instead with some self-written tool.) P.S. No, I'll probably not use turbogears for my next similar project. Rapid development is nice, ORMs are fancy and such, but sometimes good old plain SQL can be very easy to use, too. And more performant.

The correctness of an optimiser in a conforming C++ implementation is defined by the "volatile" keyword, that is, an optimisation is correct if it does not reorder, add or remove volatile accesses. However, people have come to rely on non-volatile accesses to be finished before a call to a function in another translation unit, even if you hand over a buffer which is then passed on to some external entity (syscall or hardware). Technically, this is undefined behaviour, since the compiler is free to identify the writes to the buffer space as dead stores and optimise them away. The correct way to fix the program is to declare the buffer volatile, but in a lot of cases, this requirement is too strong, for example in the case of TCP checksumming, where it is neither desired to force reading back the data, nor to build up the data in a temporary buffer and write in one go. What we'd need is something in between, that is ordered with respect to volatile accesses, but not internally.

R.K. Mulholland, author of Something Positive, one of my favorite web comics, writes something that seems pretty relevant to Debian:

People assume most Debian developers are heavy-handed, pushy, intolerant bigots bent of dominating any other culture or idea and supplanting it with their own whims because, for the most part, the ones who speak up the most ARE heavy-handed, pushy, intolerant bigots bent on dominating any other culture or idea and supplanting it with their own whims. It sucks. It's horrible. And it's the what everyone of any faith, political idea, or lifestyle has to deal with. People always focus on the loud minority who ruins everything. And like any other group, the only way you can combat this is making your views and, in this case, your kindness and actual testimony louder than the hateful prattle of those hurting your beliefs.

Mulholland actually writes about Christians, but I took the liberty of substituting the words "Debian developers" instead. I wonder if I should reconsider my policy of shutting up and going away when people start quarreling or otherwise behaving badly inside Debian. Perhaps participating more actively in such a situation would be helpful, if only to make it clear that those most vocal do not always represent the majority. Mostly such participation should be to do constructive things: offering solutions to technical problems, pointing out good things others do. Sometimes it would have to be to help Debian make some of the very difficult decisions it needs to do. For example, what should the project do in the case of Sven Luther? This is a good example of a problem that Debian as a project is very ill equipped to handle. I'm not sure I will do anything about this, but now that it's two hours past midnight, I feel I should. When I wake up, I expect to regret this.