I have recently purchased a large quantity of fair trade chocolate. Fair trade means that the people who produce the products will be paid a fair price for their products which will enable them to send their children to school, pay for adequate health-care, etc. Paying a small price premium on products such as coffee and chocolate usually makes no notable difference to the living expenses of someone in a first-world country such as Australia, but can make a huge difference to the standard of living of the people who produce the products. Also fair-trade products are generally of a very high quality, you are paying for the best quality as well as the best conditions of the workers.

I will share this chocolate at the next LUV meeting, hopefully the people who attend will agree that the chocolate is both of a high quality as well as being good in principle and that they will want to buy it too.

The Fair Trade chocolate I bought cost $6.95 per 100g. I went to Safeway (local bulk food store with low prices) to get prices on other chocolate to compare. Lindt (cheaper Swiss chocolate) costs $3.09 per 100g and has a special of $2.54. The Lindt and the Fair Trade chocolate are both 70%, but the Fair Trade chocolate is significantly smoother, has a slightly better aroma, and a better after-taste. So the Fair Trade chocolate costs slightly more than twice as much as Lindt, but I believe that it has a quality to match the price. Then I compared the price of a cheap chocolate, Cadbury Old Gold chocolate is also 70% cocoa and costs $4.29 for 220g, this makes it between 3.5 and 4.4 times cheaper than the Fair Trade chocolate. But if you like chocolate then Cadbury products probably aren't on the shopping list anyway. I believe that the Fair Trade chocolate I bought can be justified on the basis of flavor alone without regard to the ethical issues.

All Linux users know what it's like to have their quality of life restricted by an oppressive monopoly. We are fortunate in that it only affects us in small ways, not in our ability to purchase adequate food and health care. As we oppose software monopolies that hurt us in the computer industry we must also oppose monopolies in the food industry that hurt people in third-world countries. The fair trade programs are the best way I know of doing that. Hopefully after tasting the chocolate many LUV members will want to buy it too.

One new technology for saving fuel in cars is the 6 stroke engine. This is an engine that has two power strokes for every intake of fuel. The first power stroke is from the fuel burning, the second is from water being injected into the cylinder and boiling rapidly using steam for power. A significant amount of the weight of a car or truck engine is the cooling system. With water being injected into the cylinder after every burn the engine will require no other cooling, this can mean a weight reduction of up to 500KG for a truck engine! It is claimed that this technique can "improve a typical engine s fuel consumption by 40 percent". Note that this technique could be combined with the technology in a Prius for even greater efficiency.

Simon Richter wrote an interesting response to my blog about clean energy. I'm guessing that the part of Germany he's from is similar in some ways to Amsterdam (where I used to live).

In Amsterdam tiny cars are used a lot more than they have been in most places. There is the Smart Car but there is also a tiny car that can only seat one person (I'll update this entry with a link if someone provides me one). The tiny car appears to weigh ~200Kg, has a maximum speed of 30Km/h, and is narrow enough to fit in bike lanes. Such cars will take little petrol and can be used for shopping. The short-distance car idea is being used by many people already in northern Europe.

Simon suggests having a standard baggage container that fits in all cars. I don't think that would work as there are many different design factors (parking space, cargo capacity, and aerodynamics) which force designers to choose different shapes.

I think that a better idea would be a standard baggage trailer that could be towed by any small car. It should not be difficult to design a trailer that can be safely towed at 30KM/h behind a tiny car. The supermarkets could rent such trailers to shoppers for a nominal fee. Then most shopping trips could use the cargo capacity of the tiny car, but when buying supplies for a party you could rent a trailer from the supermarket.

Another option is having shops deliver goods to you. I have observed an increasing number of people doing this at my local supermarket. Of course you would still need to take ice-cream home yourself and maybe milk and meat too.

Electric scooters are also a good option for travel. Unfortunately in Australia there are few good options for securing them at the moment. As an electric scooter is light enough to be carried it needs to be chained to something secure. In the Netherlands this wouldn't be a problem as the bicycle infrastructure includes plenty of bike racks to which you can chain your bike, scooter, etc. Of course the Netherlands is entirely flat so there's no need for an electric scooter. Melbourne has a lot more hills and most people aren't fit enough to ride a bike so scooters are needed to replace cars.

Regarding depersonalised cars. That would require a significant social change as currently cars are extremely personalised. One thing that I had been thinking about is the idea of sharing cars with neighbors. For example if you have an apartment building and there are a few people you trust then you could share a tiny car for going shopping. Sharing a car used for driving to work or for entertainment would not work well as the car would spend most of it's time in use (or at least parked somewhere away from home). Sharing a car that's used for small journeys would be much easier as such a vehicle would spend most of it's time at home.

In Australia most families have two cars. One is used a lot (spends maybe 70 hours a week away from home) and the other is used much less (maybe 10 hours a week). Instead of owning two cars it would be possible for families to own one car and share another.

Regarding the Pebble Bed Reactor, could the people who advocate it please read the Wikipedia article. The limiting factor is not thermal expansion (solids do not expand nearly enough) but the Doppler effect (fast neutrons are not as effective at triggering fission). But in spite of that issue, let's not consider an untested new reactor design to be the savior of nuclear energy. I think that most people who read my blog have a science or engineering background and know from experience that new technologies often don't work too well in the first version. When a new CPU has a bug it's usually not a big deal. When a new OS or application has many bugs it's often expected (expecially when the OS or application comes from a monopolist). But if a new design for a nuclear reactor turns out to have a bug then it will be a more serious issue.

Greenpeace has an interesting article about how IT companies rank in toxic waste problems.

Dell rates quite well, I feel happier about my recent purchase of a large Dell TFT monitor now. HP does reasonably well, that's fortunate as the Green party in Victoria has recently purchased a HP server. But next time we discuss such things I will suggest that more consideration be given to Dell servers because of this issue.

Lenovo does really badly, I'm surprised because I would have expected IBM to do reasonably well and I didn't think that Lenovo would make significant changes. From now on I will refrain from purchasing Lenovo products. I will still purchase second-hand IBM products, but nothing under the Lenovo brand until they clean up their act.

Also it's worth noting that computers manufactured with toxic chemicals will outgas some of the chemicals into the local environment (IE your server room, bedroom, or wherever else you have computers). Avoiding the computers manufactured with toxic chemicals is not only good for the environment, but also good for your health!

When I visit the toyota.com.au web site it does not display any information on the new Camry, instead it displays a message saying "Unfortunately you do not have flash 8".

A well designed web site will display information for all users, including those who don't have flash installed.

The Toyota web site should be aimed at selling Toyota products, however it seems most effective at selling Macromedia products. Anyone who visits the Toyota site is forced to install a product from Macromedia (the Flash viewer) but is not forced to purchase anything from Toyota.

Are your web designers representing Toyota's best interests or the best interests of Macromedia?

http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&c2coff=1&q=flash+security+cve&btnG=Search

If you visit the above URL you will see information on some of the security problems related to flash. Anyone who has security problems on their computer after being compelled to install Flash by the Toyota web site would have reason to blame Toyota for any damage or loss caused by such security problems.

Flash is often prohibited by corporate security requirements (the instructions on the Toyota web site could get a potential customer sacked - and therefore unable to purchase a car). It is not usable by many visually impaired people (while people with extreme vision problems are not able to drive a Toyota cars they should be able to read information about them). It is also disliked by people who want their computer to run all free software, which includes a large number of people who like the Prius.

It seems that Toyota isn't alone in having non-functional web sites. In fact it's better than some, the basic information on the cars is available and it is possible to get contact information for car dealers, also they have a feed-back form on their web site (to which I submitted my previous blog post). Incidentally the Lexus site had much the same problem as the Toyota site (hardly surprising as Lexus is the luxury marque from Toyota). But I expect that if I phoned Lexus to ask about their vehicles I would get a better call-center experience which would make me less inclined to blog about them.

Daihatsu vehicles are sold by Toyota. Their web site doesn't use Flash, but it has so little content that it doesn't count.

I decided to quickly review the web sites of car manufacturers that sell in Australia for a fair comparison. I found three sites worse than Toyota, two sites that were equal (counting Lexus), and six that were better than it.

Holden has the worst site, they don't display any information if you don't have flash, they don't even display a phone number! I wonder how much Adobe pays web programmers to pull this sort of stunt. I can't imagine Holden management saying "if a customer comes to our web site and doesn't have Flash then don't display our phone number or any other contact information, they can use Flash or buy a Ford instead". Obviously some web monkey has run amok and done their own thing without following directions. Probably some people need to be sacked in the Holden web development group.

Volvo Cars has a very bad site. Most of the content is involved with Flash in some way and refuses to load. There is a mailto reference that is broken, and the overview page for the S60 seems to have a JavaScript loop (I aborted the load after it loaded 245 pictures and was still going). The Volvo page for their other business is quite functional although minimal.

Hyundai has a bad site. The front page works OK, but some of the sub-sites to display information on vehicles redirect to sites such as evolveddriving.com.au which are "optimised for 1024x768" and require Flash and Quicktime while others do strange things like changing the size of the browser window. Overall it's a very bad site, but at least I could find the contact details for my nearest dealer, and it has a feedback form.

Subaru has an OK site. The only thing I couldn't access without Flash is information on their AWD (All Wheel Drive) technology. Unfortunately they provide no email address and no form for sending feedback.

The main Ford web page claims that Flash is required, but their site just works without it. In a quick test I was unable to find any functionality on the Ford site that is missing because of not having Flash. Ford have a well designed site.

The Volkswagen site makes no mention of the fact that I don't use Flash, it does however have some strange unused spaces in the middle of the screen. I guess that it recognised that I don't have Flash and made a semi-successful attempt to work around it. I could get all information I wanted including dealer contact details.

The main Mazda web page displays a message about Flash not being installed and offers a link to a non-Flash version of the site. The Flash section is at the center and the buttons at the sides work if you don't have Flash. This seems to be a well implemented site.

Citroen has an OK site, no flash that I noticed (although there were large blank areas on the screen at times indicating that something was missing), the information was all available and browsing was reasonably easy. One thing that annoyed me was that there were movies available but only through some sort of JavaScript that tried to play them in my browser. I have never bothered setting up my web browsing machine for playing movies (among other things it has no speakers) so this is a problem for me.

Peugeot has a good site. No apparent flash and it's reasonably easy to use. It has more pictures than Kia but the JavaScript navigation stuff is fancy. One nice feature is a single page with pricing summaries for all models. If you have $X to spend on a Peugeot you will easily discover which ones you can afford.

Kia has the best site I saw! Not only is there no flash, but it's well designed, easy to navigate and it loads quite quickly. Please review the Kia site as an example of how to do it properly!

Let me know if I've missed any makes and I'll post an update.

The weekend of the 14th-15th October saw my third BSP in as many weekends, this time in Munich. Andreas Barth was in charge of the organisation, and the LiMux development team were kind enough to host us for the weekend at their offices in the centre of the city. Andi, Zobel and I headed into the office early on Saturday morning, ready to start hitting RC bugs. Others joined us during the morning, and we got to a total of 10 people working on fixing bugs. Personally I looked through many of the bugs listed on Andreas' page. It was heartening to see that a very large number of the RC bugs were already well in hand, with patches available and in lots of cases uploads already made. I spent some time looking into #389287, #392398, #389375 and #262440. I also helped out several other developers with their own bug fixes, giving out accounts on my wide range of machines at home so that they could debug on different architectures.

We worked late into the evening, ordering in pizza and then later cooking in the offices. I moved onto some more debian-cd hacking later on, making real progress and getting almost to the point of having my multi-arch CDs working. As always, there was a lot of discussion about the general issues in Debian, especially the 4 GRs that were due to finish that evening. On Sunday morning, things started slightly later as we took breakfast at the office. There was more discussion of the GRs, and the results were generally well received by the group. We continued looking into the RC list; I investigated #389434, but struggled to make much progress. At lunchtime, we quickly(!) headed into the city to see the famous Glockenspiel at the city hall, and went for a quick tour of the historic city centre so that us non-locals could see something of the city outside of the office. We returned and picked up on the bug-killing for a couple of hours. Then the LiMux guys showed us some of their work, and gave us a demo of the project. More on that later... Unfortunately, I had to head back for my flight comparatively early this weekend so I couldn't stay around for very long after the demo. Despite the last-minute attempt by an S-Bahn ticket machine to delay my trip to the airport, I got back without incident and even landed early at Stansted. The Germans I met this weekend were very serious about getting work done, and their efforts are much appreciated. With more people helping to reduce the RC bug counts, we should have no problem releasing Etch in December. Let's keep up the good work...! As always, my meagre attempts at photography are online now.

Dear Benjamin Seidenberg!
Your account ‘benjamin’ has just been created in the central LDAP
database of the Debian project.  Please note that it needs a bit of time
until this information is synced with all developer-accessible machines.
You should be able to login or upload packages after about 30-60 minutes.
The password for this account can be found appended to this message,
encrypted with your GPG key.
Email sent to benjamin@debian.org will be forwarded to astronut@dlgeek.net,
to change this visit http://db.debian.org/forward.html.

This has definately made my day. I would like to thank my sponsor and advocate, Anibal Monsalve Salazar, the Debian Cyrus Team (especially Sven and Henrique) and especially my AM, Cl ment Stenac (Zorglub). I couldn’t have asked for a better AM; he answered every mail within a day as far as I remember, was extremely supportive and helpful. I remember when I sent him the last T&S response he appologized on IRC that he couldn’t write the recommendation until that evening, whereas some AMs have taken months to do it.
For those interested in the NM queue’s proccessing time, here is an approximate summery of my progress through NM:
Waiting for advocate: 2.5 weeks (This should have been shorter, I had my advocate lined up, but then there was a question about me signing the key of the guy who signed mine, but I hadn t checked his ID).
Waiting for AM: 6 months
Going through the checks: 2.5 months. (This would have been shorter had it not been right around the end of my senior year of high school, with the mad rush to cram everything in before exams)
Waiting for FD: 1.5 Months
Waiting for DAM: 1.5 Months
Waiting for account creation after DAM approval: 2 months.

A security advisory was released today which warns about a severe security issue in the binary-only NVIDIA drivers:

The NVIDIA Binary Graphics Driver for Linux is vulnerable to a
buffer overflow that allows an attacker to run arbitrary code as
root. This bug can be exploited both locally or remotely (via
a remote X client or an X client which visits a malicious web page).
A working proof-of-concept root exploit is included with this
advisory.

The only possible solution (as NVIDIA still hasn't fixed the issue, although they know about it since 2004):

Disable the binary blob driver and use the open-source "nv" driver that is included by default with X.

Yes, you won't have 3D acceleration any more if you do that. Yes, that sucks. Complain to NVIDIA that they don't provide documentation so that free drivers can be written. Luckily I stopped using the NVIDIA binary-blob quite a while ago, and I don't intend to ever use it again. This exploit clearly shows me that that's a good decision. For now, I'll have to live with the fact that I must use software-rendering for 3D (which is slow). When I buy my next computer it won't have an NVIDIA card, that's for sure. But maybe there's hope. Maybe, just maybe, NVIDIA releases proper documentation one day (but don't hold your breath). Alternatively, I just learned about the nouveau project: a project which aims at producing Open Source 3D drivers for nVidia cards. I don't know what the current status is and whether it's usable already, but this is definately a project which is worth trying out and worth supporting! (via Kerneltrap)

Andreas, I am not a nice guy. I am only lazy. If the change to exim4 (it now displays a debconf note to everybody who tries do dpkg-reconfigure exim4, -base or a daemon package telling them to dpkg-reconfigure exim4-config) saves #debian from answering the question “how do I reconfigure exim4, dpkg-reconfigure exim4 does nothing!” twice a day, it is a good change. I basically agree with you that people who not read the minimum basics of documentation are a nuisance, but they’re unfortunately real. You need to hurl the docs into their faces. And even then they’re going to ignore them and google for answers instead. And on google, they’re going to find wrong or outdated docs.

The Massachusetts race for governor has turned very ugly. Even setting my personal partisanship (and professional bias) aside, I’m certain that the blame is not equally shared on both sides. Massachusetts Lawyer’s Weekly says it better than I could, and I reproduce the entire editorial here:

Deval Patrick for governor During the 34-year history of Lawyers Weekly, the paper has never endorsed a candidate for elected office. This practice was borne out of the notion that the political, or societal, issues that dominate races typically outweigh issues that are of distinct interest to lawyers. But the race for governor in Massachusetts in 2006 is suddenly very much about what it means to be a lawyer. On the one hand, we have Democratic nominee Deval Patrick, whose stated policies on judicial independence and appointment of judges (among other issues) reflect a genuine understanding of the legal system. Conversely, Republican nominee Kerry Healey has launched a chilling assault on the practice of law. Healey is running a television ad that takes Patrick to task for his 1985 representation of a defendant accused of murdering a police officer — an ad that borders on the bizarre in its reasoning. “While lawyers have a right to defend admitted cop killers, do we really want one as our governor?” the ad asks. Last week Healey added an ad that references Patrick’s one-time support of convicted rapist Benjamin LaGuer. “What kind of person defends a brutal rapist?” the ad asks. With those misguided questions, Healey has insulted an entire profession. Here’s hoping she does not get away with it. What is Healey’s message? That criminal-defense attorneys somehow should be associated with, or blamed for, the actions of their clients? That protecting important constitutional rights is somehow a seedy business? Healey has resorted to the worst form of pandering, openly inviting voters to think of Patrick as someone who associates with criminals. Her finger-pointing has a flavor of McCarthyism, suggesting that anyone who has spent time in the criminal-defense arena should be identified, called out and avoided. The lieutenant governor proclaims herself a criminal-justice candidate who is tough on crime. Yet nearly everyone associated with the criminal-justice system, be they defense attorneys, prosecutors, police officers or otherwise, understand that the Constitution guarantees the right-to-counsel, and the right to a zealous advocate. Healey no doubt understands this as well, but conveniently ignores it as she paints Patrick a villain. Gov. Mitt Romney knows that diminishing the work of attorneys often makes for good politics. He rarely hesitates to criticize lawyers — or judges — if it suits his agenda. But even Romney has never sunk this low, to this crass sort of demagoguery. Healey has become the bully in the schoolyard, poking fun at the overweight children. Look, he’s a lawyer. He must be a second-class citizen. Deval Patrick, meanwhile, has quietly made it known that he appreciates the key components of the legal system. He favors giving judicial administrators more control over their budgets and pay increases for lawyers who do work for the state, including prosecutors. Patrick says he would devote much attention to selecting judges, returning power to the Judicial Nominating Commission. And the former civil-rights attorney has suggested that he will be careful before criticizing a judge’s decision. “Judges don’t go looking for hard decisions,” he has said. As to the LaGuer matter, Patrick missed an opportunity with a clumsy, disjointed explanation of the matter. Patrick could have simply stated that any efforts he made in helping LaGuer obtain a DNA test were in the pursuit of truth. As former Suffolk County District Attorney Ralph Martin so eloquently put it in an Oct. 8 Boston Globe op-ed article, “I never thought that serving the ideals of the Constitution made you soft or tough on crime. … Respecting the Constitution doesn’t make you soft or tough — it only makes you just and fair.” One need not be defined by one’s profession, of course, and lawyers will have other important matters (i.e., education, taxes) on their minds when they go to the polls on Nov. 7. But attorneys can rest assured that a vote for Deval Patrick guarantees an appreciation for many of the ideals that lawyers deem important — while a vote against Kerry Healey sends a message that lawyers won’t tolerate her unforgivable cheap shots. Do we really want someone who defends accused criminals as our governor? President John Adams, author of the Constitution that Healey swore to uphold as lieutenant governor, defended the accused killers in the Boston Massacre trial. Do you think Adams would have been qualified to be our governor?

Last week the kids were on autumn school break so we took a quick trip to Carlsbad Caverns in New Mexico. Of all the caves we've visited, Carlsbad is certainly the most impressive. Fortunately, it wasn't a busy time of year, so I could pause and do some cave photography. I used the D2X and 17-35/2.8 with one strobe on the camera and sometimes another SB-800 hand-held and manually fired. Average exposure was ISO 100, f/8 at 20 seconds. The gallery is at http://kevin.hypershots.com/gallery/000190ss

There have been quite some comments on the Iceweasel case all over the planets, and I saw several assertions, especially from the Mozilla camp, that I, as the Firefox co-maintainer, the xulrunner maintainer, and (soon) Seamonkey iceape co-maintainer, have to rectify. They broke the –enable-official-branding flag
Half-true. We just replaced Bon Echo/Deer Park with Firefox at the appropriate places in the build tree so that we could have Firefox with the “unbranded” logo instead of the official logo, as Gervase Markham gave us authorization for. You’re still free to enable the official branding, except that since the logos and stuff are non-free, we removed the other-licenses/branding/ directory from the original tarball, thus yes, the flag is half broken. Firefox logos being subject to trademarks, Debian thinks they are not free.
Trademark and copyright are different things. Mozilla has unnecessarily given a non-free license to “clarify” the trademark situation, but that is not required. To make it clear: Debian thinks the logos are not free because they are not free. Period. Debian isn t properly collaborating with Mozilla , sending unusable 100000-lines patches for validation just before releases (as seen on Lucas Nussbaum’s blog)
Let me take the firefox_2.0~rc1+dfsg-1.diff.gz file, strip the debian directory from it (it only contains maintainer scripts, our set of icons and some debian specific searchplugins), and strip the configure diff that is generated by autoconf due to some changes in configure.in… that’s exactly 2654 lines of diff. Very far from the 100000-lines patches they are claiming. The Mozilla people talked about Debian-specific changes that changed frozen APIs, breaking extensions (from Lucas’s blog again).
So, let’s dig into our firefox_2.0~rc1+dfsg-1.diff.gz:

• Changes to disable application upgrade (we want that to happen through apt-get) and change some other default preferences,
• Changes to fix “make distclean” so that it really cleans the build directory,
• Change not to build the “mangle” utility,
• Change not to call netstat to generate entropy, which is useless on linux,
• Changes to make Firefox build and work on architectures such as hppa, mips, mips64, m68k, ia64, sparc64, alpha, and arm, which the Mozilla guys don’t seem to care much for,
• Change to add a preference directory so that users can put their set of customized preferences in /etc/firefox/pref,
• Change to allow to build flat chrome without the zip utility,
• Change to allow to use system library for myspell, instead of statically linking the bundled one,
• Changes to allow to build s390 binaries on s390x host with s390 toolchain (same applies with x86 binaries on amd64 host with x86 toolchain),
• Changes to work around bugs with the hidden visibility pragma on gcc,
• Changes to make the pango backend actually build correctly,
• Changes to avoid some error messages while trying to create Makefiles from inexistant Makefile.in’s,
• Change to install in /usr/lib/firefox instead of /usr/lib/firefox-x.y,
• Change not to build useless chromelist.txt files,
• Changes to make helper applications with parameters work,
• Changes to allow builds against GTK 2.8,
• Changes to work around an Xrender bug,
• Changes to make the Gecko/yymmdddd string taken from preferences instead of being half-hard-coded (you could change it with preferences, but it would still be set to the hard-coded value at start time ; and you could change it again with preferences…),
• Change to allow mice extra buttons to act as something else than a left button,
• Change to allow to build with -Wl,–as-needed to avoid linking against a whole lot of useless libraries, without losing the link on libxpcom.so which is required by some extensions’ components,
• Changes not to shlibsign the NSS modules at build time, since we’re stripping the binaries afterwards, thus breaking the signature. We do build the signatures later, within the maintainer scripts.

That’s not that many changes, and most of them were taken from either some Mozilla CVS trunk or the Mozilla Bugzilla . And most of those that were not taken from there have been sent, except those that really don’t make much sense outside Debian. So, where are these frozen API changes ? And we’re not properly collaborating, huh ? The Mozilla project started by coming to a (admittedly uneasy) agreement with Debian for use of the name, but the Debian version diverged even further from the official version, so the permission was revoked. (from comments on Matthew Garrett’s blog) That one is really interesting, because between the time we got this understanding with Gervase and now, we are actually less diverging from the official version than by then. The main difference by that time was the extensions manager, which, in Debian, needed a lot of changes to actually act as it should, especially with globally installed extensions. I’m not saying the Debian one was perfect, it also had its own problems, but that was a whole lot less than the blatant crap that was the official one, obviously written for Windows without any thoughts for unix, and especially linux distributions. The only main difference now, between the official Firefox and ours, is that our build has the pango backend enabled, which we chose over the Xft backend for several reasons I won’t explain here. The others differences are that we use system libraries where possible, instead of the bundled libpng, libjpeg, libtiff, libmyspell and libcairo. We also build a flat chrome, instead of having everything in .jar files. Now, a little bit about differences the Mozilla guys don’t seem to care about while they really should: distributions build the Mozilla products with gcc 4.x, while the official binaries are built with gcc 3.4, as well as the extensions distributed on addons.mozilla.org. Fortunately, not a lot of extensions make use of binary components, and not a lot are linked against the standard C++ library, but when that happens (like with colorzilla), you get a component linked against libstdc++5 to load on a Firefox that is linked against libstdc++6. You are lucky if that setup doesn’t crash. Little extra from comments in Lucas’s blog:
Is it possible for the Debian Firefox maintainers to create an installer package for contrib which will install the vanilla FireFox from Mozilla s site.
How great would it be to have a package for one architecture instead of 12, and with a dependency on libstdc++5, that almost no other package uses any more. Update:
Debian is going to replace Firefox with a GNU fork called Iceweasel
Half-true. For the etch release, Iceweasel will only be Firefox with a different branding. We are taking the Iceweasel name because it was already know as a possible alternative name for Firefox when the trademark concerns have been raised more than 2 years ago (thanks Nathanael Nerode for this nice name, by the way). It appears that the GNU guys decided to start a fork with this name… that’s quite unfortunate, actually. Anyways, the plan is to get in touch with them to see what we can do together, but with the etch release approaching, we can’t and won’t do more than a rename for the moment. Update 2:
We (Mozilla ) presently have working relationships with most of the major Linux distributions, including Red Hat, Novell, and Ubuntu (As seen in several posts from people of the Mozilla Corporation or Foundation)
Very interesting. Ubuntu uses the same set of patches as Debian, with some more of their own, and even releases beta software in their official releases. But when it’s Ubuntu, it’s fine. Sorry, I forgot Debian is lame, and DDs are frustrated fanatic integrists, on top of being bloody fanatic assholes. Update 3: Added some precisions about other differences with the official binaries, and a small patch I somehow forgot.

Today I released version 0.60 of randomplay, my command-line shuffle-recall-swiss-army-knife music player. It will never make Winamp users happy, but it’s a good substitution for complex combinations of find/grep/xargs/sort that people sometimes use to pick tracks to play. If you can’t see why you’d use it, you probably don’t need it. The latest version adds two new command-line options, —older-than and —newer-than. These can be used to limit the songs included in the shuffle on the basis of the file modification date. The syntax is fairly flexible, and resembles that used by rdiff-backup for restoration commands. For example:

  Randomly play music under the ~/music directory that were added in the past week:
      randomplay --newer-than 1W ~/music
  Play in order music that is from before this year:
      randomplay --norandom --older-than '1/1/2006'
  Give a list of filenames of music that were added in the past 6 months, but haven't been played in the last three months:
      randomplay --names-only --newer-than 6M --days 3M 
  Play, but don't record in the playing history, music added in the first three months of 2004:
      randomplay --noremember --newer-than '1/1/2004' --older-than '4/1/2004'

Unfortunately, this new feature is pretty slow, because it stats each file individually on the initial spidering of the directories to be played. In fact, the startup is always fairly slow if you are searching a large directory hierarchy, since randomplay does not preserve any file index but checks anew on each execution. If you are searching tens of thousands of tracks over NFS (as I do), this can take a minute or so. Suggestions for improving the perfomance of the file modification time detection or of the whole startup are welcome. At some point, I will probably implement an indexing feature, but I like the simplicity of it now where it works basically like the shell find command. Version 0.60 should show up in Debian unstable shortly.

Dear Bubulle, I am afraid that you do not know what you are talking about. Because you aren’t the only one in this case, here’s a short explanation of what happened. The existence of the IceWeasel fork is a reality that the Mozilla people need to accept and, optionally, understand (they also need to remember what Free Software is and how it all works). Unfortunately, some of the Mozilla people at the JDLL yesterday obviously couldn’t bear a little reminder about IceWeasel, but they were the minority. We hung the two posters in the morning, and they did not even notice them for something like 45 minutes. After what, somebody came and asked, in what can be described as an angry manner, if we knew why the IceWeasel fork got started. The answer was a plain and simple “I don’t care why the fork started. We’re going to rename Firefox in Debian so you people stop annoying us with your fucking trademark.” (which was obviously as rude an answer as their original question). At which point they just went away and never came back. They proceeded to fix the Firefox poster by adding a “TM” on it and, I think, fixing the capital “F” in the middle of the “FireFox” name, then stroke the “IceWeasel” line on the other poster. At this point, photos were taken and posted to one, then two blogs. Sam, for the sake of completeness, added the missing and markings to the Firefox poster, which the Mozilla people forgot to add. The whole thing could have stopped at that point, but Daniel Glazman, the famous Daniel Glazman, thought it’d be wise to link the first two blog posts on his blog, vomitting on Debian while he was at it. This was an extremely bad idea. His blog being syndicated on Planet Mozilla, he and the other Mozilla people are just helping spread the IceWeasel name and publicising the whole Mozilla trademarks debacle. I’m just not going to comment on the behaviour of the most vocal Mozilla supporters (no, dear Daniel Glazman, I’m not going to use the term “fanatics”, I leave that up to you), it’s just not worth bothering. Josselin linked the first blog post on his blog, so the thing made it to Planet Debian, too. This is no big news for Planet Debian readers, as the IceWeasel situation has been discussed at length on various blogs already. Now, what you Christian do not know, is that we have had several discussions about the Mozilla trademarks problems at the JDLL. Many people here were not aware of this problem and asked both the Mozilla people and us about it. We explained at length, several times, what happened, what their position was, what our position was, what had been proposed by both parties, why their proposals weren’t acceptable to us. Most of the people were quite astonished to learn that Mozilla Corporation refused the “Community Edition” idea, and most of them got our point. At the end of the day, one of the Mozilla people came and apologized for the blog posts and comments (although he isn’t the author of any post or comment, I believe), telling us that it wasn’t nice from them. Thanks for that, really. Overall, all of this is very positive for the Debian Project. We are doing the Good Thing. To everybody in Debian involved in the renaming of the Mozilla products: thanks, and good luck. Mozilla Corporation now has to face the Free Software community. It’s up to them to either come up with something that is acceptable for the community or stop whining about people complying with their trademark policy. Internet Explorer still has something like 82% of the market. You aren’t done yet, and you’re not going to progress without community support. So you’d better not lose this support now. Up to you.

Joey Hess wonders if the Debian Weekly News are still a useful thing, and whether the planet has not taken it's place. In my opinion, that is not the case. I always looked forwared to Wednesday evening when the new DWN would come out. I enjoyed the nice overview of what's going on in the different corners of Debian and eagerly read the recently added or orphaned package lists. DWN was a nice news digest, just the right size, and seemed to me more balanced and a tad more objective than just the random blog entry.Unfortunately, the DWN are most useful for those who are currently not aware of all the things going on, who are not on all the high-traffic mailing lists (or don't read them), and these are of couse not the people who can run the DWN (I count me to that group). And those who are suitable to write the weekly letter are not those who need it...I still hope that someone and maybe some more can pick up the task and keep this institution running. <sarcasm>Maybe dunc-tank can sponsor them...</sarcasm>

Joey Hess wonders if the Debian Weekly News are still a useful thing, and whether the planet has not taken it's place. In my opinion, that is not the case. I always looked forwared to Wednesday evening when the new DWN would come out. I enjoyed the nice overview of what's going on in the different corners of Debian and eagerly read the recently added or orphaned package lists. DWN was a nice news digest, just the right size, and seemed to me more balanced and a tad more objective than just the random blog entry.Unfortunately, the DWN are most useful for those who are currently not aware of all the things going on, who are not on all the high-traffic mailing lists (or don't read them), and these are of couse not the people who can run the DWN (I count me to that group). And those who are suitable to write the weekly letter are not those who need it...I still hope that someone and maybe some more can pick up the task and keep this institution running. <sarcasm>Maybe dunc-tank can sponsor them...</sarcasm>

1) I'm not attractive (OK - so less learned, more reaffirmed) 2) Not all hills lead back to the flat 3) See 2. (OK - so I left $club which I can't remember thinking "tired, home time", wished people good byes, and looked for a hill, usually any going up are back to the flat... wandered up the hill, carried on wandering, discovered pizza shop that I normally order from, said "Oh bollocks" and started heading in the right direction, down the hill, across the road, back up the other hill. Sucks to be on the wrong side of London Road.) 4) Sleep is good. That's what I'm just about to do.So, what have I learned today? EDIT: OK - writing an entry in vim at nearly 3am when you've been to a club results in the unfortunate side effect of somehow managing to put several copies of the post in the entry - BAH!

Today I discovered a bug in one of my programs, it called system() and didn't correctly escape shell eta-characters. Fortunately I had written custom SE Linux policy for it which did domain_auto_trans(foo_t, shell_exec_t, very_restricted_t) so there was no possibility of damage.

The log files (which were not writable by the daemon by both SE Linux access control and Unix permissions) indicated that no-one had attempted to exploit the bug.

The kernel team, or should I say, Sven Luther, as the rest of the kernel team hasn't been remotely as visible as him on this topic, is now trying to spam debian-devel-announce, assuming the average Debian developer isn't able to read the proposals. Fortunately, the mail was redirected to debian-devel thanks to clever filtering.

I still think, for the moment, that Choice 2 of the proposal currently being voted (Special exception to DFSG2 for firmware as long as required) is still the best of all proposed choices, and I'll try to explain why.

1. This proposal doesn't only address firmware issues. It clarifies DFSG 2 for other works often found without source, acknowledging current practice for fonts or pictures.
2. Granting an exception only for etch is dishonest. The real reason behind the exception is that we don't yet have any means to ship these firmwares in a way that complies with our principles. We're violating them in the testing and unstable distributions as well, and that has nothing to do with a release.
3. Granting an exception for etch may not be sufficient. I don't want to see these endless discussions again for the next release, and this is what is probably going to happen if an etch-only exception is granted.
4. The proposal frees the hands of people working on stripping the firmwares out. Their patches would have to be accepted straight away, not two months before the release when someone says "Hey! there are non-free firmwares in the kernel!".
5. By principle. I'm fed up with people splitting hair on debian-vote for weeks, to end up reaching a formulation that's close to the one I wrote in a few minutes a month ago.

Everyone should make up his own opinion. You're welcome to read the proposals themselves rather than the propaganda I'm writing, but I hope I've made clearer the rationale of Choice 2.

After restarting my i386 buildd some days ago, H ctor Garc a lvarez asked me where he could find a howto to setup a buildd. Unfortunately, I never found any clear doc about that. Today, I have setup a new sparc buildd which is also rebuilding the whole archive, thus it will take something like... 2 or 3 months I think (UltraSparc II @ 360 MHz with 256 MB RAM). But this time I clearly took notes on what I did, and there's now a mini-howto. I'm sure it's not really complete, but that should help you to have something working. As usual, do not hesitate to send me feedbacks.