Contrary to what lucas announced (I don t know where he got this info), we plan to release Squeeze with eglibc 2.11. It is already packaged in experimental and is ready on all architectures except hppa where there are a few major regressions in the testsuite to fix. This is what prevent us to upload it to unstable.

For the first time since I got involved in Ruby maintenance in Debian & Ubuntu, we are seriously at risk of not being able to release working Ruby interpreters in both Ubuntu Lucid and Debian Squeeze, because of two pretty serious issues. Ruby 1.8(.7.249) randomly hangs with eglibc 2.11 That issue was found by Google folks, because Puppet was hanging. After a lot of (quite heated) discussion, it was found that the problem is caused by something in eglibc 2.11: the problem can t be reproduced in a Debian unstable chroot (with eglibc 2.10), but is reproducible if you just upgrade glibc to 2.11 (which is in Debian experimental). It is not clear at all whether it is a glibc bug, or a ruby bug: Ruby has shown in the past that it was making some assumptions on the behaviour of pthread. It is possible that a valid change in glibc conflicts with an assumption made by Ruby. Still, I wonder why Ubuntu chose to release with eglibc 2.11, while Debian still only has 2.10 in unstable, and Ubuntu doesn t really have a lot of people with deep glibc knowledge. (Update: I assumed we would release squeeze with 2.10, but the eglibc maintainers plan to release 2.11 in squeeze.) That issue is tracked in Launchpad as bug 520715 (which was reassigned to eglibc), and in Ruby s redmine as bug 2739. Debian Squeeze isn t affected by that issue, but we are likely to get bitten as well after Squeeze if a solution isn t found by then. As Ruby maintainers in Debian/Ubuntu, we can t do much about this issue, because it requires either a lot of glibc knowledge, or a lot of understanding of the Ruby threading code. Ruby 1.9(.1.37 6,8 ) s test suite hangs on Sparc The development branch of Ruby (declared stable by the interpreter developers, but not considered as such by the third-party libraries developers) also has interesting issues. Its test suite hangs on sparc, but only (apparently) on specific CPUs/kernel versions. Here again, it is not clear whether it is a Ruby issue, or a kernel issue, for the same reasons as above. It is also possible that it is fixed in Linux 2.6.32, but the Debian build daemons run the lenny kernel, so we can t check that. This is tracked as Debian bug 565765, and is not tracked in Ruby s redmine, because Sparc is not supported by the upstream Ruby developers. This issue really requires Sparc knowledge (and access), so as Ruby maintainers, again, we can t do much, besides coordinating and poking the various people that can help.

Daniel, I also recently installed a WRT on the Linksys WRT54GL. But I used DD-WRT instructions went to http://www.dd-wrt.com/site/support/router-database, entered my model number and got direct download links to the firmware along with a README. One very important points in flashing these routers is to clear the NVRAM by doing a hard reset BEFORE and AFTER an upgrade to a different type of software on the device. Also, starting with a micro build is strongly recommended. In any case the hardware looks to be very solid, especially if you don t need gigabit ethernet and n wireless, but might need some advanced networking features.

I finally got a few hours free this morning to check an item off my home system administration checklist: upgrading the wireless router's firmware to OpenWRT. There were a couple motivations for this, including the fact that my SoundBridge Radio couldn't maintain a connection to my firefly server using the built-in firmware, and I had read that OpenWRT would work better. Since this is posted on Planet Debian, I should mention why I didn't use DebianWRT. The basic answer is this text at the top of the DebianWRT homepage:

Currently the most common methods used to run Debian on these systems is to install OpenWRT or a similar firmware, add disk space either by USB storage or NFS, create a debian chroot by either running cdebootstrap from inside OpenWRT or debootstrap --foreign on a PC, and running Debian from this chroot. For example, instructions for the WLHDD.

I'm not sure whether this is because DebianWRT is experimental, or because its goal is to use routers as cheap general computers. Either way, it sounds way too complicated and/or fragile for what I'm interested in (i.e., a wireless router with better software). The goal here is to get something that does a better job than the built-in WRT firmware, but doesn't require too much tinkering to get working or to maintain. I have plenty of outlets for my tinkering urges already. Nothing here was exactly difficult, but it was hard to find all the information I needed to get things working. Hopefully documenting the steps I went through here will save someone else some time. Step 1: acquire the firmware This was trickier than you might think. If you click on the download link at the OpenWRT web site, you end up at the top of an FTP server populated with a vast quantity of stuff. Worse, when you find the actual firmware images, you'll quickly discover that there are piles and piles of them divided between sixteen directories, and no guidance as to which one to pick. And picking the wrong one will turn your beautiful router into a doorstop. Luckily, the OpenWRT documentation contains a section called "Getting Started". Unluckily, that section consists of the following text:

1.1 Getting started 1.1.1 Installation 1.1.2 Initial configuration 1.1.3 Failsafe mode

Whoops, someone forgot to execute on a TODO. Undeterred, I consulted the usual fallback reference, Google. It pointed me at several references, some of which were hidden on other parts of the OpenWRT site. Armed with these, I was able to determine that:

1. My WRT54GL v1.1 probably uses a Broadcom 5352 chipset.
2. The correct firmware, according to multiple sources, is probably in the kamikaze top-level director, the latest version's subdirectory, and the bcrm-2.4 directory under the version (the link is to 8.09.2, which is current as of March 6, 2010). Apparently the bcrm47xx directory doesn't have wireless support; it helpfully contains a file called NO-BROADCOM-WIRELESS to warn you off, but unhelpfully doesn't include any additional information in that file (like what exactly is broken or that you can find a working firmware in a sibling directory) ... oh well.
3. The firmware file that you want is openwrt-wrt54g-squashfs.bin, even though it doesn't match the model number of the router. This directory could use a README file explaining which hardware is supported by each of the dozen or so firmware files it contains.

Step 2: install the firmware After Step 1, this was a real relief. I just used the built-in Linksys firmware installer, pointed it at the .bin file, and it went. Step 3: configure the router The installation guide I followed was pretty much silent about what to do after I got the firmware on. Luckily, this is just a software problem, meaning it's much more familiar territory for me.

1. First things first: I checked that I could still get a DHCP lease. It worked.
2. Armed with that, I tried telneting to the router. I used the resulting root prompt to set a password on the root account.
3. I logged out and tried telneting in. Apparently the router is configured to disallow root logins over telnet if you don't have a password. Good for them (although why allow telnet at all?); oops for me.
4. Luckily, an ssh server was installed by default. I like using keys to log in, so I tracked down the documentation on configuring the server to use public-key authentication; it turns out there's a single global key file named /etc/dropbear/authorized_keys that's exactly like OpenSSH's per-user authorized_keys file. No idea what would happen if I had multiple users, but I won't.
5. The next obstacle: I didn't have an Internet connection. For some reason, my cable modem didn't want to give the router a DHCP lease. On the off-chance that it was remembering too much, I rebooted it and ran ifup wan. That fixed the problem. I still don't know why.
6. Not a step, but a useful note: in the process of figuring the above out, I found readlog. It's basically dmesg for syslog files; it shows the most recent lines written to syslog. This is useful because there isn't a real syslog file, due to the fact that there would be no room to store it on the 54GL.
7. Finally, I had to get wireless working. The documentation is very helpful when it comes to describing the syntax of the wireless configuration. Unfortunately, I read the list of encryption options and missed the section right below where their meanings are explained (although, to be honest, I might not have understood the implications of the explanation without the research I did anyway).

   option encryption none, wep, psk, psk2, wpa, wpa2

   I wanted WPA2 encryption, so I entered wpa2. And nothing worked. After a good hour of trying different options on the client, swapping software components in and out on the router, experimenting with the encryption key syntax, and crawling Google, I finally found my answer. If you just want WPA2 encryption, you must not use wpa2 as the encryption type. Instead, use psk2. It turns out out that wpa2 actually means use WPA2 and also use an external RADIUS server for authentication. psk2 is the system you're familiar with from a typical consumer wireless router.

Step 4: enjoy And with that, it works. Unfortunately, contrary to what I wrote here originally, my Roku still doesn't work. On the other hand, having a real Linux installation is helpful for debugging it. Currently my suspicion is that the router isn't passing multicast packets between the wired and wireless interfaces (broadcast works fine, multicast doesn't). That said, it seems like if I restart Firefly just before I start playing music, I can play reasonably reliably -- as long as I don't stop, because if I do, the Roku forgets that the music server is there. Either way, I've spent about as much time fighting this as I can afford. One lingering worry I have is security; unlike Debian, which has both a security mailing list and tools to inform me when I need to install a security update, the OpenWRT firmware doesn't seem to have any mechanism for distributing security notices. True, there is an openwrt-security-announce list, but it appears to be entirely unused, as is openwrt-announce. Something to keep an eye on, then. Also (file under note to self), I need to remember to verify that the router isn't exposing services to the outside world. The default iptables configuration is hideously complex; with just a quick glance, it could be setting up a floral shop for all I can tell. I'll need to test this empirically and maybe analyze the rules in more depth.

Blogger has no feature to highlight code syntax in blog posts. But google-code-prettify comes to rescue.

The information in their README are quite generic, and treat the situation where you're directly managing the website files, which is not the case for Blogger.

Luka Marinko wrote a very nice blog post describing how to use google-code-prettify on Blogger; I'm going to follow his advices right away!

Global trends For some time I have been trying to pinpoint what it is that is brewing in Italy and risks spreading elsewhere, like it happened in the past. I don't need to be decent to stay in power While following a train of thought during a political/philosophical lecture I figured that a current growing trend is to have public figures that are more and more indecent. In Italy it is very hard to find a public figure you can look up to. It is hard to name a politician that is not involved in some shady exchange of favours or some abues of their powers, and we got used to seeing people in power implicated in major corruption scandals, perverted prostitution affairs, or dealings with international criminal organisations. They do not normally end up in jail, and in fact they keep being very firmly in power, because they manage to stretch or change the laws to get away, or at least to delay trials in order to trigger some statute of limitations. Is there a pattern here that, although maybe not as clearly defined as in Italy, can be found more or less globally? Yesterday I thought that this could be such a pattern:

I don't need to be decent to stay in power

If I think of it like that, then it is most definitely not just an Italian phenomenon. If you tell "one doesn't need to be decent to stay in power" to a British, or to a French, I would not expect them to see anything strange with it. We all find it depressing, but we are all used to it. It is a pattern with repercussions, though: once that becomes normal in a society, it means that people who get to be in power are free to abuse their power much as they want, as long as they are careful enough not to end up in jail. Because, well, nowadays one doesn't need to be decent to stay in power. I don't need to follow the law to stay in power That first pattern is already quite well accepted in Italy. So much well accepted, that I think we are starting to see what comes next. At the end of March we are going to have elections for some regional governors. Funnily enough, in Lazio, the very important region around Rome, the centre-right coalition failed to submit the paperwork on time, and is out of the elections. It is not just red tape: at some point someone will have to print out the ballots and dispatch them to the voting booths, so one expects to have the coalition logos and the names of the candidates submitted in time, together with signatures supporting the candidates and whatever else the election process needs. Well, they missed the deadline, they got there after closing time and the building was, well, closed. It was a fantastic opportunity for a laugh. Memes blossomed on the Italian intarwebs and we now have 2 or 3 new expressions to mean "stupid". However, now it's hard to tell what is going to happen. On one hand, you can't exclude one of the two major coalitions because of some bureaucratic detail like an office closing time. But on the other hand, several minor coalitions have been excluded in all sorts of past elections because of similar things, and it really would not be fair to start making exceptions now. But Lombardia, the region around Milan and Emilia Romagna, the one around Bologna, both very, very important, are having similar kinds of problems. In both regions the previous governors are running again, for the 3rd time in a row, and most likely they legally can't do it, and if elected one can sue and force them to resign, because they have been in power long enough. Lots of paper is being shuffled at the moment to figure if they can get away with it or not. Oh, and the lawyers of the candidate for the Milan region also managed to get to the tribunal after closing time, but apparently there was still someone inside and they managed to shout loud enough, or somesuch. Anyway, the situation is getting hot. The Lazio coalition that has been excluded because of their incompetence is now hard at work pushing their potential voters to mount a fracas. Chances are that eventually they'll get away with it, and manage to take part to the election. If that happens, they will likely get close to winning it. So this seems to be a new pattern that is emerging:

I don't need to follow the law to stay in power

Which, again, is a pattern with quite some repercussions. It is something much more radical than just an issue with morality: it means feudalism, it means we are culturally ready to accept dictatorship. So, please do me a favour: do not think for a moment that Italy is just a funny place with lemons and tomatoes, and watch out for these patterns emerging around you.

I've been thinking about something for a while, and to be honest, still haven't reached any firm conclusions: what to think about self-published "e-books"? I'm curious to hear your opinions. For instance:

• http://gettingreal.37signals.com/
• http://www.railsupgradehandbook.com/
• http://createyourproglang.com/

These are all: electronic, in that they aren't distributed as real, paper books, have no ISBN number, and are generally only available via the author's web site (you won't find them on Amazon.com). They aren't simply on-line, PDF versions of real books. They're certainly a departure from the traditional model of having a publisher, editor, and real, physical books that could be purchased from book stores. They don't appear to have been through any kind of formal editing or quality control process. The prices seem to differ quite a bit; the first one is $19, the second one is $12, and the last one is $30.77. For the authors, the appeal is obvious: they get to keep all of the money, and don't have to fool around with a lot of "process". Consumers, on the other hand, have to consider different aspects: with a "real book", the bureacracy and process exist to guarantee some minimum standards of quality. If you buy an O'Reilly book, you know that it's probably like many of the other books they sell: perhaps it won't stand the test of time like something written by Knuth, but it'll be a pretty good guide to the technology it describes, most likely be someone who is indeed an expert in that area. If I buy some random PDF on the internet, it may come from someone who really knows their stuff, or it may be junk. On the other hand, were this market to grow, theoretically prices could come down. Since the people who are authoring the book don't have to fool around with editing, printing, and so on, and get to keep all the money themselves, they could in theory keep their prices significantly lower than someone creating a more 'traditional' book with a lot of overhead. That is, of course, if the book is one where there is competition in its niche. Right now a lot of these books that pop up on my radar are written by domain experts. However, what's to prevent a lot of people from jumping in and attempting to make a quick buck with a flashy looking web site? Buying books based only on reputation? That might lead to people who are really good authors, but perhaps not well known as "doers" (they didn't invent the technology in question) being left out in the cold. Also, there is something of an unknown quantity about "pdf books". For instance, after raking in a bunch of cash with theirs, 37signals put it on their web site, completely for free. That had to leave the guy who bought it the day before it went free feeling like a bit of a chump. At least with a 'real book', even if the contents are posted on the internet, you have a physical object that belongs to you. I wonder how bad piracy is, and how bad it might be were these to become more popular? Another thing worth noting is that, via services like Lulu.com, it *is* possible to print these out. In any case, I think things are likely to change with time, as we aren't dealing with a static situation, but rather one where a changing landscape maylead to different outcomes, as the key variables... vary. I am honestly unsure of what to make of this development. How do you see the market for "home brewed" pdf ebooks evolving?

From RFC3164, which is otherwise about syslog formats:

6. Security Considerations An odor may be considered to be a message that does not require any acknowledgement. People tend to avoid bad odors but are drawn to odors that they associate with good food. The acknowledgement of the receipt of the odor or scent is not required and indeed it may be the height of discretion to totally ignore some odors. On the other hand, it is usually considered good civility to acknowledge the prowess of the cook merely from the ambiance wafting from the kitchen. Similarly, various species have been found to utilize odors to attract mates. One species of moth uses this scent to find each other. However, it has been found that bolas spiders can mimic the odor of the female moths of this species. This scent will then attract male moths, which will follow it with the expectation of finding a mate. Instead, when they arrive at the source of the scent, they will be eaten [8]. This is a case of a false message being sent out with inimical intent. ... Along the lines of the analogy, computer event messages may be sent accidentally, erroneously and even maliciously.

This smells more like "I bet nobody ever really reads this RFC, let's put some stuff in the middle to see if they do!".

The Opera-Mini Dispute I have just read an interesting article about the Opera browser [1]. The article is very critical of Opera-Mini on the iPhone for many reasons most of which don t interest me greatly. There are lots of technical trade-offs that you can make when designing an application for a constrained environment (EG a phone with low resolution and low bandwidth). What does interest me is the criticism of the Opera Mini browser for proxying all Internet access (including HTTPS) through their own servers, this has been getting some traction around the Internet. Now it is obvious that if you have one server sitting on the net that proxies connections to lots of banks then there will be potential for abuse. What apparently isn t obvious to as many people is the fact that you have to trust the application. Causes of Software Security Problems When people think about computer security they usually think about worms and viruses that exploit existing bugs in software and about Trojan horse software that the user has to be tricked into running. These are both significant problems. But another problem is that of malicious software releases. I think that this is significantly different from Trojan horses because instead of having an application which was written for the sole purpose of tricking people (as is most similar to Greek history) you have an application that was written by many people who genuinely want to make a good product but you have a single person or small group that hijacks it. Rumor has it that rates well in excess of $10,000 are sometimes paid for previously unknown security vulnerabilities in widely used software. It seems likely that a programmer who was in a desperate financial situation could bolster their salary by deliberately putting bugs in software and then selling the exploits, this would not be a trivial task (making such bugs appear to be genuine mistakes would take some skill) but there are lots of people who could do it and plausibly deny any accusation other than carelessness. There have been many examples of gambling addicts who have done more foolish things to fund their habit. I don t think it s plausible to believe that every security flaw which has been discovered in widely used software was there purely as the result of a mistake. Given the huge number of programmers who have the skill needed to deliberately introduce a security flaw into the source of a program and conceal it from their colleagues I think it s quite likely that someone has done so and attempted to profit from it. Note that even if it could be proven that it was impossible to profit from creating a security flaw in a program that would not be sufficient to prove that it never happened. There is plenty of evidence of people committing crimes in the mistaken belief that it would be profitable for them. Should We Trust a Proprietary Application or an Internet Server? I agree with the people who don t like the Opera proxy idea, I would rather run a web browser on my phone that directly accesses the Internet. But I don t think that the web browser that is built in to my current smart-phone is particularly secure. It seems usual for a PC to need a security update for the base OS or the web browser at least once a year while mobile phones have a standard service life of two years without any updates. I suspect that there is a lot of flawed code running on smart phones that never get updated. It seems to me that the risks with Opera are the single point of failure of the proxy server in addition to the issues of code quality while the risks with the browser that is on my smart-phone is just the quality of the code. I suspect that Opera may do a better job of updating their software to fix security issues so this may mitigate the risk from using their proxy. At the moment China is producing a significant portion of the world s smart-phones. Some brands like LG are designed and manufactured in China, others are manufactured in China for marketing/engineering companies based in Europe and the US. A casual browse of information regarding Falun Gong makes the character of the Chinese leadership quite clear [2], I think that everything that comes out of China should be considered to be less trustworthy than equivalent products from Europe and the US. So I think that anyone who owns a Chinese mobile phone and rails against the Opera Mini hasn t considered the issue enough. I don t think it s possible to prove that an Opera Mini with it s proxy is more or less of a risk than a Chinese smart-phone. I m quite happy with my LG Viewty [3] but I wouldn t use it for Internet banking or checking my main email account. Also we have to keep in mind that mobile phones are really owned by telephone companies. You might pay for your phone or even get it unlocked so you can run it on a different network, but you won t get the custom menus of your telco removed. Most phones are designed to meet the needs of telcos not users and I doubt that secure Internet banking is a priority for a telco. Update: You can buy unlocked mobile phones. But AFAIK the Android is the only phone which might be described as not being designed for the needs of the telcos over the needs of the users. So while you can get a phone without custom menus for a telco, you probably can t get a phone that was specifically designed for what you want to do. The Scope of the Problem Mobile phones are not the extent of the problem, I think that anyone who buys a PC from a Chinese manufacturer and doesn t immediately wipe the hard drive and do a fresh OS install is taking an unreasonable risk. The same thing goes for anyone who buys a PC from a store where it s handled by low wage employees, I can imagine someone on a minimum income accepting a cash payment to run some special software on every PC before it goes out the door that wouldn t be any more difficult or risky than the employees who copy customer credit card numbers (a reasonably common crime). It s also quite conceivable that any major commercial software company could have a rogue employee who is deliberately introducing bugs into it s software. That includes Apple. If the iPhone OS was compromised before it shipped then the issue of browser security wouldn t matter much. I agree that having the minimum possible number of potential security weak points is a good idea. They should allow Opera Mini users to select that HTTPS traffic should not be proxied. But I don t think that merely not using a proxy would create a safe platform for Internet banking. In terms of mobile phones most things are done in the wrong way to try and get more money out of the users. Choose whichever phone or browser you want and it will probably still be a huge security risk. Harald Welte is doing some really good work on developing free software for running a GSM network [4]. But until that project gets to the stage of being widely usable I think that we just have to accept a certain level of security risk when using mobile phones.

• [1] http://counternotions.com/2010/02/18/mini/
• [2] http://www.faluninfo.net/
• [3] http://etbe.coker.com.au/2009/05/31/lg-u990-viewty/
• [4] http://laforge.gnumonks.org/weblog/2010/02/13/#20100213-six_weeks_to_bcch

I spent the day working with Daniel. He has been trying to get the correct runes for a GCC build in a strange environment. Turns out all he needed was me to throw stupid ideas at him until one caused him to examine some of the generated intermediate symbol maps...

(This has ended up longer than I intended, largely because I felt I should then get into why. I'm aware I haven't got into all the nuances, so I hope readers familiar with the area will appreciate this is the compact version.)

Thorsten had a rant last week about PGP keysigning problems. He apologises for his tone, but that's not the issue I take with his rant.

It starts "Keysigning is useless". And yet his complaints seem to be:

• Dealing with the private half of your GPG key securely involves some faff (in this case booting with a live CD and having to set things up ready to keysign).
• He doesn't get on with caff.
• People reject email from machines with invalid HELOs and perform other anti spam measures on ISP access ranges (I'm not clear if it's just greylisting or outright rejects as that's not made clear).
• PGP/MIME is a protocol violation (yes, but it's much better than inline OpenPGP. Unless you have to deal with RT, which mangles it. *sigh*)

None of these seem to actually be about keysigning being useless. The process of doing it, maybe, though he misses the main valid rant about this I'd have, which is that most mass keysignings don't actually allow you to accurately verify the identity of other participants unless you already know them reasonably well. (The LCA2010 keysigning and DebConf5 in Helsinki spring to mind as 2 good examples of bad keysignings I've attended, but speaking to others suggests it's far from an isolated thing.)

Torsten does say that he'll continue to do keysigning on a per-person basis, so it doesn't sound like he's completely given up. I'm posting this largely so other Debian related people don't get the idea that it's not important to think about keysigning.

Why should we care?

Firstly, let's clarify what I mean when I sign someone else's key. If I sign your key then I think that I believe you hold the private part of a key that has your name and an email address I believe I can use to contact you on it. It means I have seen government issued ID that matches that name. It also means that I have interacted with you (and watched others interact with you) under that persona. In short I am happy that the key is a reasonable digital representation of your identity - something signed by it either comes from you or has involved the key being compromised or you coerced into using it against your will.

Why is this useful?

It gets useful thanks to the web of trust; ie the idea that there are a bunch of people I trust partially to sign other keys, and if enough of them have signed a key then I can have a reasonable expectation that the key belongs to the person I want to talk to. Which means I might be prepared to send private data to them. Or Debian might be prepared to accept an upload from them. Which, when you're dealing with a community that spans the planet and where most of the contributors haven't met each other, is pretty freakin' useful - I, as part of Debian's keyring team, don't need to personally be able to identify every Debian developer. All I need to do is be able to trust other DDs to be able to do so. (Though maybe I'm missing out on something here - perhaps Debian should be paying for Gunnar and me to travel the world verifying fingerprints. \o/)

(I still do mass keysignings btw. I'm picky about which keys I actually sign - this is in no way intended as a slight against those I don't, but a mass keysigning at least lets me know that the people involved are happy to exchange fingerprints. Though, FWIW, I normally have ID on me and frequently have fingerprint slips, so if you know me and want me to sign your key/want to sign mine then by all means ask me when you see me!)

I have recently gone about opening a "Partita IVA" ( http://it.wikipedia.org/wiki/Partita_IVA ) so I can act as an independant consultant here. Like everything here, it's a pain in the neck, but opening it wasn't all that bad, compared to other close encounters of the bureaucratic kind that I've had. When it came time to send out my first bill, of course I had to get the accountant to help me put it together (simply sending a bill with the amount to be paid would be way too easy). The crowning touch, though, was that I had to go to the "tabaccheria" and purchase a 1.81 (one Euro, eight-one cents) "marca da bollo" ( http://en.wikipedia.org/wiki/Italian_revenue_stamp ) to affix to the aforementioned bill. This is only necessary, however, in cases where the bill exceeds 77.47 (seventy-seven Euro, fourty-seven cents). The end result was that between asking the accountant for help, going over to the store to get the stamp, and so on, I probably wasted in excess of a half an hour of my life for something that really isn't that complicated. Who dreams this bullshit up, anyway?

I don't know if anyone else has been tracking this recently, but a while back I got curious about the relative proportions of dh(1) and CDBS in the archive, and started running some daily analysis on the Lintian lab. Apologies for my poor graphing abilities, but the graph is here (occasionally updated): Although dh is still a bit behind CDBS, the steady upward trend is quite striking - it looks set to break 20% soon, up from under 13% in September - compared with CDBS which has been sitting within half a percentage point of 25% the whole time. Incidentally, was that an ftpmaster trying to sign his name in the graph over Christmas or something? :-)

Today, I arrived at the CeBIT conference in Hannover, and had a first look around. I find trade fairs like that quickly boring, and I was glad to meet some some other Debian folk and listen to some of the talks at the CeBIT Open Source Forum in hall 2, including tolimar s talk about Debian GNU/kFreeBSD. Tomorrow (Wednesday), I will talk at the same place at 13:45, explaining some basic stuff about patches and bug tracker. The target audience are users of Free Software who modify it for their private or company-wide use and would like to see their changes included in the official project. There will be a live stream of the talk, which I am officially holding as an employee of the ITOMIG GmbH.

The Debian Packages Tracking System has a great feature: you can subscribe to packages that matter to you, and be informed of all uploads, bugs, testing migrations, etc. However, when (co-)maintaining a lot of packages, it is easy to forget to subscribe. And then you might miss important information about your packages (uploaders don t receive bugmail by default, for example). Since PTS subscriptions are now imported into Ultimate Debian Database, it is easy to find out if you missed some subscriptions. It s just a matter of going to http://udd.debian.org/cgi-bin/pts-check.cgi and entering your email! And for those concerned with privacy, it should be noted that the unauthenticated access to UDD only gives you the hash of the subscribers emails. You need to be a DD, and use the guestdd account to see the email addresses (which DDs can already see on master.d.o).

For my research at the university, I've become a lead developer for ELKI, a framework for developing data mining algorithms along with index structures, to be able to one one hand quickly implement new algorithms (by being able to reuse a lot of code, in particular index structures, parsers, ...), but also on the other hand to evaluate the interaction of index structures with different algorithms, distance functions, and so on. The new version 0.3 which adds a lot of new outlier detection methods will be published beginning of April at DASFAA 2010. (Note that this is designed for research and teaching use; code extensibility, readability etc. instead of maximized performance. You might want to do a rewrite in C for maximum performance, since Java does give you quite a memory and performance overhead in these setups.)After this release, we will be doing a major redesign of the database and index layer, to allow better comparison of different index structures in parallel; right now it's hard to use more than one at a time, and building e.g. a combined index structure is a larger effort than we'd like it to be. During the process of redesigning the database layer, I'll also be improving the database update or "streaming" API.If you know of a nice API for streaming databases, please send me an Email to erich -at- debian -dot- org.Note that I'm looking for a programming API, i.e. "interfaces". Not for random data sources such as Twitter. Also I really need an API able to model data changes, not just "events" aka "instances". So please don't point me to what Twitter calls a "streaming API". What I'm looking for is a nicely-designed API to allow programmers to react to Database changes, such as insertions, deletions, updates, bulk operations etc. and update their index structures and algorithm results accordingly. An example would be the "oracle streams" API I believe; MySQL probably has a logging (used in their replication hacks) which can also be seen as a database stream. But these are designed around a RDBMS view, and not so much for data mining. Weka/MOA Streams seems to be just event/instance streams, where there is no such thing as a bulk insert or even a deletion. Of course there are many use cases where you will be happy with working on just the previous n instances. The more general case however handles arbitrary inserts and deletes, instead of having just inserts (and implicit delitions by an expiry strategy). And yes, of course you can in turn wrap database events as instances into an event stream (with "insert", "update", "delete" events) ...Yes, I'm aware that this kind of setup was abandoned for what is called a "stream processing engine" (SPE) in many use cases, that do not care about "old" data or deletions in general. We'd like to be able to support both approaches, also to be able to do fair comparisons.Of course you can also point me to badly done APIs, and explain me where they fall short for you. We're not so much interested in copying some API, but we'd just like to design a good API for people to do research on stream processing in a database context (e.g. index support for streaming data, online algorithms, ...) Or you can write me a mock-up API that you would deem useful.

• Interesting software updates in unstable:
  • reprepro 4.1.0
  • sylpheed 3.0.0
• Linux Kernel 2.6.33 is available in experimental. Special kudos to Ben Hutchings.
• Debian Installer Team has released the first alpha of the Debian Installer 6.0
• It is that time of the year again, the DPL election process begins this week.
• The Debian Qt/KDE Maintainers are already working in KDE 4.4.1. However, for uploading it to unstable Qt 4.6.2 will need to go in first.
• In case you missed the New Developer of the past month post, there were no new Developers in February.

not many closed RC bugs in the last two weeks. it seems we're running out of easy-enough-for-me bugs does this mean the freeze is near? :)

• #564384 src:libpoe-component-ikc-perl: "libpoe-component-ikc-perl: FTBFS: tests hang"
  make build dependency versioned and upload (pkg-perl)
• #566271 publican: "publican: Undefined subroutine &File::Copy::Recursive::rcopy_glob called at /usr/share/perl5/Publican/Builder.pm line 310"
  make (build) dependency versioned and upload to DELAYED/2
• #566562 liblicense-dev: "fails to install"
  fix postinst and upload to DELAYED/2
• #566583 src:librrdtool-oo-perl: "FTBFS: tests fail"
  upload new upstream release, prepared by carnil again (pkg-perl)
• #568339 mgp: "mgp segfaults on existing mgp files and all the supplied examples"
  apply patch from BTS and upload
• #568892 libnice: "FTBFS with new libgupnp: Test failure"
  add comment to the bug report
• #568940 libswt-gtk-3.5-java: "symlink /usr/share/java/swt.jar missing"
  add comment to the bug report
• #570590 src:ogre-contrib: "FTBFS: checking for cgCreateProgram in -lCg... no"
  report new FTBFS while looking at #566671 *cough*
• #571358 src:libgearman-client-async-perl: "libgearman-client-async-perl: FTBFS: tests failed"
  add comment to the bug report (pkg-perl)
• #571368 src:text-bidi: "text-bidi: FTBFS: private.c:1458: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'void'"
  send a versioned close (pkg-perl)
• #571423 src:libpoe-loop-tk-perl: "libpoe-loop-tk-perl: FTBFS: tests hang"
  add comment to the bug report (pkg-perl)
• #571425 src:libio-socket-multicast6-perl: "libio-socket-multicast6-perl: FTBFS: tests failed"
  add comment to the bug report (pkg-perl)

The video of our talk at FOSDEM 2010 didn t come out great, so I ve made a slidecast of the RDF beginners guide that I gave as part of that talk. Enjoy below! At FOSDEM we also announced a competition for the coolest hack using RDF, SPARQL and Tracker with the prize kindly sponsored by Codethink. The prize is a Google Nexus One. After some discussion we ve decided to open up the competition to everyone and extend the deadline to the 15th of March. So if this tutorial inspires a great idea, get it coded up and submitted! On #tracker on GIMPNet there are great bunch of hackers who can help you get your idea up and running. There are no hard rules for the competition, we just want to see implementations of cool ideas. The code doesn t have to be perfect, the only requirement is that the judges can check it out and run it on their systems. All entries should be submitted to tracker-competition@codethink.co.uk by the deadline. <object height="300" width="400"><param name="allowfullscreen" value="true"><param name="allowscriptaccess" value="always"><param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=9848513&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1"><embed allowfullscreen="true" allowscriptaccess="always" height="300" src="http://vimeo.com/moogaloop.swf?clip_id=9848513&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" width="400"></embed></object> RDF Beginner s Guide from Rob Taylor on Vimeo. Update!
Looks like I hit a bug in PiTiVi that caused the render to get mangled. I ve rerendered and it should all be good now. If Vimeo is being slow for you , you can download the ogg here. Edward, I promise to log a repro as soon as I can!