Yesterday, I had a chance to talk about Extremadura i18n meeting at Tokyo Debian monthly meeting. This meeting was organized by Junichi Uekawa and wonderfully 20 or more people came and filled the meeting room (awesome!), thanks! My paper is included in this PDF [in Japanese]. I picked up and spoke some themes from what we discussed at Extremadura; i18n task force, Pootle system, and language-pack/tdeb. PO-based translation has an advantage and a disadvantage. The tools support PO are mature and PO is very useful for the short messages. But using it for documents, such as manuals or Web pages is not so useful. Especially translating to Japanese sometimes add/delete/reform sentences. Some attendees suggested that we would always use the original XML (or something) format for translating/reviewing and have PO format in the central database. Masayuki Hatta pointed the license of translation. For example, Japanese is completely different from English, both words aren't always correspond 1 on 1... Translators use their creativity power. He said translators would have a copyright for their translation instead of original author. When I talked with Warren Togami was Fedora US leader last month at Tokyo, he said his project asked to agree "translation license agreement" to all translators. If we Debian or Debian-JP apply a central translation system like Pootle and use its translation memories, it's time to consider making similar license. Although current idea of Tdeb is still under the development, most attendees loved that idea rather than language-pack. For me, the goal of this meeting was not only speaking my experience report but recruiting more people for i18n/l10n working also. I'd like to recommend Nabetaro-san for next i18n meeting attendee instead of me, and Noritada Kobayashi for next of next. I strongly suggested attending next Debconf to them also. They are hardly working for Debian i18n/l10n in Japan. I hope attending such meetings expands their personal connections and motivations. There were two other sessions at the meeting. Matsuyama-san demonstrated creating Flash on Debian by using ming, and Junichi talked about profiling apt-get by oprofile tool. Both topics were interesting for me.

When I search for packages, I frequently want to know which one is the most popular. For example, I can easily apt-cache search for a list of CD rippers, but I'd also like it sorted in order of popularity, according to popcon. Although I could easily write a script which does this, I just wonder if this already exists? Is there a Debian package for it?

Today I watched the "An Inconvenient Truth" film which was recommened to us at the foo camp preceeding Euro OSCon. Steve had already blogged about it shortly. While i enjoy the summer evenings at the end of september that I experienced this week, I think we are heading for very serious and even hard times. I would guess that we all will soon have to cut back on many areas of our compfortable lifes: less warm showers, more sweaters in winter, not keeping your computer on 24/7, no more car, no more flights. I have been thinking on where to move, given the delicate position that europe is in with its dependency on the gulf stream.

Incidently i also ran into this cool website today, which makes one consequence of global warming a little bit more realistic. If you are lucky your house in the middle of the city will be beach front property soon.

Yet another example of that positive crisis awareness is needed. Act today and we might just get a major global crisis. Don't act and we might get mass extinction.

Dear Lazyweb!

I would like to find the symbolic solution for XT0, YT0, dSX, dSY, qX and qY to this set of equations, in a numerically stable way:

XT0 + real_X1*dSX*Cos[qX] + real_Y1*dSY*Sin[qY] == own_X1,
YT0 - real_X1*dSX*Sin[qX] + real_Y1*dSY*Cos[qY] == own_Y1,
XT0 + real_X2*dSX*Cos[qX] + real_Y2*dSY*Sin[qY] == own_X2,
YT0 - real_X2*dSX*Sin[qX] + real_Y2*dSY*Cos[qY] == own_Y2,
XT0 + real_X3*dSX*Cos[qX] + real_Y3*dSY*Sin[qY] == own_X3,
YT0 - real_X3*dSX*Sin[qX] + real_Y3*dSY*Cos[qY] == own_Y3


Mathematica seems to not come back at all when asked for a solution, Maxima (in Debian) refuses cooporation, Maple produces a solution by approximating Sin and Cos with polynoms (which is not good enough for the whole range of [-Pi .. +Pi] and furthermore is not numerically stable.

This is for finding the parameters for the transformation between two different coordinate systems of maps. The real_* and the own_* coordinates are three identical points on both maps. A numeric solution (with simulated annealing from the gnu scientific library) exists but seems to be not exact enough. See also http://www.posc.org/Epicentre.2_2/DataModel/ExamplesofUsage/eu_cs35.html

Although I like the idea of a tiling and completely keyboard focused window manager, I never fell in love with Ion because the default keybindings weren’t really intuïtive (to me). A few months ago I noticed, that ratpoison is also a tiling and completely keyboard focused window manager, only with much more intuitive usage: If you know screen and it’s keybindings, you also know ratpoison and it’s keybindings: Just exchange Ctrl-A with Ctrl-T. This sounds perfect for usage on my low performance laptops, where I have small screens and usually also no virtual desktops in use. There’s only one thing which annoys me in ratpoison: If I use a mostly mouse driven application like e.g. a webbrowser with ratpoison, I have no problems to click on links, even if the webbrowser is not in the so called “current frame”. But if e.g. click into an input field, I usually notice much too late that while the mouse works fine in the browser, keyboard focus is still in some other window. Currently they all use flwm, the Fast and Lite Window Manager. So what I would need is a tiling and keyboard focused window manager but with “focus follows mouse” politics. And since the laptops on which I intend to use such a window manager, all have a touchpad or thumbstick, the mouse there counts as keyboard focused, too somehow, doesn’t it? :-) I wonder, if an ion3 could be configured to use the same keybindings as ratpoison. That would probably fulfil this desire. On the other hand, there are browsers which are fine without mouse. lynx or links2 for example, so the focus problem I have with ratpoison wouldn’t occur. But what if I need or want a keyboard driven and full blown webbrowser? Ok, Firefox as well as Opera are not that bad in keyboard only use, but they still are focused on the mouse using user. But Gecko wouldn’t be Gecko, if there wasn’t some Gecko based browser with this features: On the ratpoison website I found a link to a very interesting Firefox plugin which makes Firefox a complete new browser, a keyboard driven webbrowser named Conkeror. It has no toolbars at all, no (visible) tabs, no menus, no nothing — it shows only the website in fullscreen, a status line and a multipurpose command line — exactly like the mini-buffer of GNU Emacs. But not only the layout, even the keybindings are very emacsish: C-x C-f opens an URL in a new buffer -eh- tab, C-x 5 C-f opens an URL in a new frame (window), C-x C-v opens a new URL in the current tab (buffer) with the current URL as editable default value, C-x b switches to another tab, C-x k kills -eh- closes a tab, C-x C-b lists all open tabs, l goes back (remember the Emacs info reader, eh?), C-g quits accidently requested dialogs or stops loading a web page, Ctrl-s and Ctrl-r give you forward and backward i-search, C-n, C-p, C-f and C-b scroll, etc. Even M-x works, e.g. will M-x revert-buffer reload the web page. (Unfortunately Esc-x doesn’t work. Yet.) And for vi freaks, there is even M-x use-vi-keys. There’s even one lynxish keybinding: \ lets you view the source. And although it’s one of the strangest webbrowsers I saw yet, I somehow like it and also would like to see it in Debian as package, since it is the perfect companion for ion or ratpoison. Looking through apt’s package cache as well as the wnpp bugs, I haven’t found any hint on somebody already packaging it, so I’ll have a look on it and on how to to package a Firefox extension for Debian. BTW: While looking through the wnpp bugs, I found bug #335459, which is the ITP flock, an also Gecko based browser with a lot of cool features for blogger who like social network tools. Another nice thing I found today in Debian was the xfonts-artwiz package whose small fonts are very suitable for small resolution screens, especially if a tiling window manager is used with a e.g. 800×600 resolution. Unfortunately they aren’t available in a charset with German umlauts. Apropos tiling window managers: Anyone tried pconsole with an automatically tiling and resizing window manager? I wonder if it’s usable. At least on MacOS X with its cascading window positioning algorithm, pconsole is a pain. — But even without cascading windows, MacOS X is a pain for keyboard users. Just think of its default behaviour when using the tab key inside a form mask: It will skip all buttons, all checkboxes, all radio buttons and all select boxes. Argh!

Many moons ago, when I started my project on F/OSS I imagined that it would stay within the purview of anthropology, hacking, science and technology studies to bleed only a little bit into legal studies and only because I was dealing with the fraught politics of intellectual property law. As it turned out, the Law, with a capital L, as on object of analysis and site for the production of cultural value, turned out not to be peripheral but utterly central… And since, I have pretty much stayed within the territory of legal studies, vastly interested in the more invisible cultural and political effects of the law. Recent obsessing on this topic has led to a nascent thesis about law, discrimination, politics , and civil rights that I am looking to substantiate (so if anyone has any citations or helpful hints, do pass along) and it is this: When there are positive changes made in the law, it can come with various political costs. And the one I am interested in, is how, given other conducive conditions, legal changes that look awesome on paper, can work to undermine its potential by breeding a type of complacency of (in)action, largely because it seems as if the worst of the problems have been fixed. So if we look to the American legal context of 1960s and 1970s as a prime example, it is clear there was a heck of a lot of turmoil in the arena of civil rights, much of which, many liberals and progressives would say, led to positive legal transformation. During this period the content of many laws were purged of overt discrimination that, for example, which led a lethal blow to segregation and started to dismantle some of the worst pieces of scaffolding of mental health law (just to cite a few examples). At one level while we may easily recognize these changes as laudable and even perhaps “progressive,” the effects of it may be less so. Once legal content is purged of the ugly, this can breed an ugly form of complacency, in which the problem seems (re)solved, so people no longer feel guilt and attention is diverted away from any number of things, like: 1) new problems not necessarily addressed in the law 2) the rise of new laws or 3) the fact that the law is empty unless actively applied. I have yet to read anything directly related to this theory or apply it myself but it is something that has been on my mind for a couple of years now. But after talking about this topic from a friend, I decided to finally take crack at The Law in Shambles a Prickly Paradigm Press pamphlet by Thomas Geogheghan, a labor lawyer from Chicago. While it did not specifically address the issue I am raising (though it got pretty close in a number of places) I got more than I had bargained for; it is truly incisive (though frighteningly depressing) look at the current state of the law, and also, like so many of the PPP’s, much more fun to read than any most academic book or articles. For those who don’t know the PPP publish a series of short pamphlets and it was started by the legendary anthropologist, Marshal Sahlins, who is also known to be a little prickly himself (but it softened by his humor). They are often written by academics on contemporary topics of political interest (read: very biased) in a manner that is a lot looser and free wheeling than any article or book that would come out of an academic journal or publishing house. The PPP allows its authors to unbuckle a few notches off the sometimes uptight, constraining academic belt of writing and the result is often impassioned, funny, and yet remarkably astute essays. If Montaigne were around today, he would surely be proud of his essayistic legacy. The title of the book sums up the the topic at hand. His explanation as to why the (American) law is in disarray has not to do with the law in the abstract but with the total disintegration of a certain class of institutions and a specific class of law (namely unions , the law of trusts etc.). As institutional supports from the New Deal have been thrown out the door, it is the individual, largely through tort law, who has had to wield the fury of the law, in defense of a slew of individual rights and to defend themselves against new forms of attack (the worst being lawsuits brought forth by “charitable institutions” like hospitals). While the law is conceived as something we are all equal under, of course, it is access to the law, which makes all the difference in terms of making it a viable (or not) as social tool. With the demise of the unions, he argues, came the death of certain type of contract law in employment, and the stellar rise of tort law, which conceives of wrongful acts not as breaches of contract (which would apply to all persons under the contract) but as matters of personal injury. Whereas in the past unions would arbitrate contract law, wielding the power of numbers so that individuals were not burdened and burned with the expense (of time and money) of the law, with tort the law becomes formalized, conceived, and imagined in highly individual terms (even when grouped into class actions, it becomes a matter of proving personal injury), the effect of which, he argues is meaner and more complex than contract for four reasons 1) The name of the legal game is to discover motive, which is about as confusing as it can get and thus more arbitrary 2) It is more expensive than old contract law 3) Cases rarely go to trial (didn’t really get the importance of this point) 4) Because its focus is on motive and intense and subjective states, everything is open to scrutiny, so that I can force you to tell me everything what is in your secret heart. Not to mention in your tax returns. The result is torts produced a bitter, dog-eats-dog Hobbesian, legal world, which in turn makes for experiencing the law as an arbitrary force. This individualization of the law through tort also intersects with many other changes such as the demise of regulatory power that add more fire to the disintegration of the law and the subsequent experience of law and life as arbitrary. And it is this chapter (From Administrative Law to No Law, The Rise of the Whistleblower and Trail Lawyer) which got me a little closer to my own point that I brought up above. For example, he writes:

Once, when I filed suite to get the Labor Department to enforce the child labor laws for 16- and 17-year olds, kids whom they do not even pretend to protect, I got nowhere. I met with the Solicitor who told me: Look, suppose I agree with you. How would I ever get the money to enforce it? He was right. If I had won and they had issued regulations, it would have only been worse. In Labor, as in agency after agency, we have a vast complex body of law which would take mandarin to learn that no one enforces.. The law is there. On paper. Indeed, it is a lot of paper. How much paper? Fifty volumes, in paperback in total. I know because I counted. But as to big chunks in these volumes, there is no one there to enforce it. p. 48

Lots of paper I think can make people comfortable in thinking that famous Virginia Slims Slogan, We’ve come a long way, Baby, when it fact, it can often just means what it literally looks like, “Damn, that’s a buttload of paper.” There is a lot more packed into this tiny book, covering the deep gulf between left and right, the stagnation of an old constitution that is impossible to revise, the loss of accountability in all branches of government, the redrawing of districts, and the slight expansion and curbing of of majoritarian voting in the last hundred years. It gets a little shrilly by the end, but you know, it is all pretty upsetting stuff and it is good to shrill from time to time. Though he never refers to neoliberalism, capitalism, or postmodernism, this book is also a great companion to a class of this literature on the rise of fragmentation and instability in social and cultural life brought forth by changes in the economic system (thinking here of David Harvey, Fredric Jameson, etc). In fact, I think it does a much better job than at relaying how it is that vast sectors of society experience fragmentation, instability, and frustration.

Morning! I know, cyrus-sasl2 is a horror for some people because its lack of documentation. So I decided to write this little tutorial. In my example I will use “pam” authentication, I use exactly the same pam rules as I use for the system login, which means pam_ldap. It’s also possible to authenticate directly on LDAP with cyrus-sasl2, but I don’t want this because the “normal” users which I haven’t in LDAP should also be able to use my postfix. Only the users which have access on all machines in my network are stored in LDAP. Ok, first of all: apt-get install postfix-tls (you need -tls, because only this one is compiled with SASL support) apt-get install libsasl2 libsasl2-modules (in -modules is the “pam” module included, for special ones there are other modules, for example -modules-kerberos-heimdal). Then go ahead… add the following lines into /etc/postfix/main.cf which enable authentication: smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = no # (this is optional, but I want to be able to authenticate without encryption) smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination # (means that all machines in mynetworks and the external clients may relay over the server, the external ones have to authenticate) Ok, postfix is now more or less ready. Because postfix on Debian runs in a chroot (/var/spool/postfix) and cyrus-sasl “works” in /var/run/saslauthd you have to make a binding which enables postfix access from the chroot to saslauthd, the following line in /etc/fstab solves the problem: /var/run/saslauthd /var/spool/postfix/var/run/saslauthd auto bind 0 0 Then you have to specify the sasl options to postfix, create a directory “sasl” in /etc/postfix and edit /etc/postfix/sasl/smtpd.conf, there you could enable sasl with mysql, sasl with kerberos, ldap whatever, but as I said I just use pam for it: saslauthd_path: /var/run/saslauthd/mux
pwcheck_method: saslauthd
mech_list: plain login
Last but not least you have to specify the pam rules when used by smtp (because I use pam ), for this you have to edit /etc/pam.d/smtp, because I have LDAP and local users enabled in the /etc/pam.d/common-* files I just include them: @include common-auth
@include common-access
@include common-password
Yes, and that’s already all, not so difficult, is it?

I believe that adding blogging technology to bug tracking systems (such as the Debian BTS and the Red Hat Bugzilla) offers significant benefits for users and developers.

It seems that there is only one significant difference between the features offered by blog software and the features required by bug trackers, blog entries are owned by the person making the post (the owner of the blog) and BTS entries are owned by the package owner. This is a minor technical difference, adding the ability for anonymous users (or users who have authenticated via an email address or other method) to create new entries in a blog owned by someone else is a minor feature change. Once the entry is created only comments would be accepted, and comments could be made in the usual manner with moderation etc.

The benefits of using blogging software (or extending current BTS systems) would be to have RSS feeds of bug reports and comments on bugs, include a single feed of all bug reports (IE blog entries) and updates (IE comments on blog entries) for a single blog (IE package) - this functionality doesn't seem to be common in blog software but surely will be soon.

This would allow Planets of recent bug reports in distributions or in areas. EG a SE Linux planet installation could syndicate the bug feeds for packages in Fedora and Debian as well as other sources of SE Linux information. The SE Linux bug feeds could include all bugs with the selinux tag in all blogs on the BTS, thus a single Planet configuration could easily cover all new development and debugging.

Another configuration possibility would be to have a single blog for all bugs in a distribution and to have tags for each package, this would become messy though as tags have to be used for issues that are not specific to packages (EG a "selinux" tag would list bugs in all packages that relate to SE Linux).

Tags could be changed by any user (possibly with some restrictions), and there could be special tags for release-critical bugs or for bugs in different stages of QA (for example the Red Hat Enterprise Linux approval process could be managed by adding certain restricted tags to the bug - this would also allow getting a feed of all bugs that have passed certain approval milestones). This would make it easy to get a list of all bugs in a certain approval category.

Current BTS systems such as the Debian BTS and the Red Hat Bugzilla could be extended to syndicate content. As they already have web interfaces and support automatically sending updates by email it should be easy to add the basic level of such support to them. But it might give a better result to go the other way and modify a multi-user blog system such as Wordpress-MU to have extra features for bug management.

BTS systems typically have bug ID numbers that increase sequentially while blog software typically gives something like http://blog.example.com/YYYY/MM/blog-entry-name.html when it's often more convenient to have something like http://bug.example.com/number. Of course it would not be difficult to have a little database that allows creating sequential numbers to map to arbitrary URLs in a similar manner to tinyurl.com. This could be either integrated into blog software (so that it says "bug #1234 has been created" or be available on demand (click a link to get a sequential number assigned). Incidentally using characters and digits for the short name of the bug (as done by tinyurl.com) would allow four characters to represent 1679616 bugs, this is enough for all bugs in the Debian and Red Hat bug databases combined. With tinyurl type technology there is nothing preventing us from having a single system creating unique IDs for all bugs in all distributions of Linux with a four character index (which is easier to remember than the 6 sigit numbers used in Debian and Red Hat at the moment).

I realise that most blog software will store the entries in a database which has sequential numbers assigned. So doing a database lookup to convert a human-readable URL into a sequential index when we have just done another database lookup to convert a sequential index into a human readable form is inefficient, but that's the way of things, computers do things inefficiently so that humans can work in ways that are efficient for them.

Note that throughout this post I refer to the Planet aggregation system, but really any of the aggregation systems can be used. One of the benefits of this is that people can use mailing lists, Google's reader, Planet, or any other reader they wish with the feeds. RSS feeds can be read by many programs and the user gets to choose which works best for them.

As promised yesterday in my report about the Munich BSP, I'd like to talk some more about LiMux, the project being run within the City of Munich to replace all of their desktop Windows systems with Linux. The team kindly offered us the use of their offices in central Munich as a base for the BSP last weekend, and on Sunday afternoon they gave us a demonstration and answered lots of our questions. The following is from my (known-faulty) memory...

Jan-Marek and Florian talked us through their setup. They're using FAI to automate installation of systems, along with LDAP to store lots of configuration information and GOsa as a user-friendly front-end to that configuration. They've integrated these to enable some very clever management features so that all aspects of the city-wide system can be maintained from one central point. As new machines are introduced onto the network, they can be configured into one class or another: simple desktop clients up to so-called "depot" servers, used as seeds for further clients. Individual user profiles can be tweaked, giving users access to new applications as they are needed. Shared resources like network storage and printers are set up automatically from the LDAP database. Access to USB storage devices can be controlled on a per-device, per-user basis for security. That's quite an impressive feature list. Most of the work has been in configuration and systems work rather than custom packages on the clients themselves - the vast majority of the packages installed come straight from the standard Debian archive, with some backports (like a newer version of KDE). Building on top of standard packages means that they have access to a huge amount of Free Software without having to do all of the work themselves. A small team (10-ish at the moment, growing to 100 or so in the future) can effectively deploy and manage desktops and associated servers for a huge number of users - they're expecting to be supporting on the order of 30,000 systems 2 years from now. The team have just recently made their first stable release and are starting to roll it out across the city, one department at a time. There are the familiar issues involved in the deployment, of course. For example, users don't want to help test pre-release versions to help nail bugs, but then complain loudly when they find bugs in the first release. And in such a large project to migrate from predominantly Windows (NT4!) desktops to KDE on Linux, a major part of the effort needed is in user training. There is quite a bit of support and custom work needed to convert people's MS Office macros over to working on top of OpenOffice. And there are still quite a number of users who will remain using Windows for specific applications that still don't have Linux equivalents yet. Apparently the "Wine Cellar" group will help on that front. *grin* In terms of collaborating with Debian, the LiMux team are expecting to help in a few ways. As bug reports are filed against their applications (apparently very few so far), they'll be pushed upstream along with (hopefully) fixes for them. They will also be devoting some full-time developer effort to security work; it would be good for both sides if this effort can be shared.

It was quite striking to see Tux, the Linux penguin, as a visible logo in local government offices! The team have clearly made some excellent progress on this exciting project, and I'm sure that I can speak for all of Debian in wishing them the best of luck in the future. I'll be watching with interest...

The recent news from the UK gives us an example of invasive security. Preventing passengers carrying on any hand luggage (even wallets) and frisking all of them is the type of treatment you expect for criminals and visitors to maximum security prisons. It's not what you expect for people who are involved in routine (or what used to be routine) travel.

The security measures offered by SE Linux are sometimes described as invasive. I don't believe that this is an accurate description. I admit that sometimes minor tweaks are required (such as setting the correct context of a file). But for most users (corporate users and typical home users) the distribution takes care of all this for them. A default Fedora install should just work for the typical home user and a default Red Hat Enterprise Linux install should just work for the corporate user.

The main reason that it's so easy to use is that the default domain for user sessions and for daemons that are not specifically configured in the security policy is unconfined_t. This means that programs for which there is no policy and programs run from a user session do not have SE Linux access controls. The default configuration of SE Linux only restricts programs that are known to be at risk.

The most common case of SE Linux access controls causing inconvenience is the policy for Apache (the daemon with the most configuration options). There are a set of configuration options (known as booleans) that can be used to determine what aspects of Apache will be confined, generally it only takes a few minutes to determine and specify the correct settings to support the desired operation.

Next time you are being frisked at a UK or US airport and are facing the prospect of a long flight with books and all other forms of entertainment banned keep in mind that airlines have invasive security and should be avoided if possible. SE Linux offers security that is at most a minor inconvenience (usually not even noticed) and should be embraced.

An anti-spam measure that is used by a very small number of people is that of verifying the sender address by connecting to the sending mail server. For example when I send mail from russell@coker.com.au the receiving machine will connect to my mail server and see whether it accepts mail addressed to russell@coker.com.au and will reject my mail if that isn't the case.

The problem with this is that if I try to send mail to someone who has their mail server listed as a SPAM source then their efforts to verify my email address will fail and then my message to them will bounce with a confusing error message. This means that if one of the two mail servers involved in the communication is listed in a DNSBL or RHSBL service then all communication will be impossible. There will not be an option for one person to say "please phone me on this number if you can't send me an email".

This happened recently when someone from Italy asked me a question about SE Linux. So I will answer here (maybe they read my blog). In any case the answer might be of general interest:

Firstly I have to note that I have a B.Sc degree and no post-graduate qualifications, so it is not accurate to address me as Dr. Coker.

The question is: Let's imagine a user acquire root rights. Especially on Fedora Core, which modify su command to map it to sysadm_r role, couldn't he/she simply disable SELinux, delete logs, and so on?

If a user obtains ultimate privileges then they can do all things including deleting logs etc.

One thing to note is that there is no need for any process other than kernel threads to have ultimate privs, it would be useful in some situations to make log files append-only for all processes and the SE Linux policy language supports this.

The nearest any release policy comes to implementing such things is the separation between sysadm_r and secadm_r in the MLS policy in recent versions of Fedora.

Also note that it is possible to configure a SE Linux policy that does not permit any process to request that a new policy be loaded, the policy files be changed on disk, or the use of programs such as debugfs. Using SE Linux to enforce a policy that can not be bypassed by anything less than booting from installation media is quite easy to achieve.

One idea that I had was to have GPG implemented in the system BIOS and have GPG checks performed on the kernel before it's loaded (to verify that the kernel had not been modified). The kernel could be passed a decryption key for the root filesystem by the BIOS, and SE Linux would be enabled as soon as the root filesystem was mounted. Thus nothing less than disassembling the BIOS would allow a hostile person to access the data on the disk. This is all possible with technology that has been common for many years. I almost convincced a BIOS author to implement this in about 2002.

I'm currently working for a company that in the past has not embraced new technology. One of my colleagues recently installed a wiki which did a lot of good in terms of organizing the internal documentation.

The next step is to install some blogging software. What I want is to have every sys-admin run a blog of what they are doing and have an aggregation of all the team's blogs for when anyone wants to see a complete list of what's been done recently. The security does not have to be particularly high as it's an internal service (probably everyone will use the same account). The ability to store draft posts would be really handy, but apart from that none of the advanced features are really needed.

Also it would be handy to be able to tag posts. For example if userA did some work on the mail server they would tag it with SMTP and then at some future time it would be possible to view all posts with the SMTP tag.

I've done a search on google for this topic and there are many pages comparing blog software. But all the comparisons seem based on Internet use, they talk about what versions of RSS are supported etc. But I don't need much of that. An ancient version of RSS will do as long as there is a single syndication program that can support it. Performance doesn't have to be great either, I'm looking at less than a dozen people posting and reading and a fairly big Opteron server with a decent RAID array.

For the minimal requirements I could probably write blog and syndication programs as CGI-BIN scripts in a couple of days. They wouldn't support RSS or XML but that's no big deal. But I expect that if I use some existing software that someone recommends in a blog comment it will be faster to install and have some possibility of future upgrades.

One new technology for saving fuel in cars is the 6 stroke engine. This is an engine that has two power strokes for every intake of fuel. The first power stroke is from the fuel burning, the second is from water being injected into the cylinder and boiling rapidly using steam for power. A significant amount of the weight of a car or truck engine is the cooling system. With water being injected into the cylinder after every burn the engine will require no other cooling, this can mean a weight reduction of up to 500KG for a truck engine! It is claimed that this technique can "improve a typical engine s fuel consumption by 40 percent". Note that this technique could be combined with the technology in a Prius for even greater efficiency.

Simon Richter wrote an interesting response to my blog about clean energy. I'm guessing that the part of Germany he's from is similar in some ways to Amsterdam (where I used to live).

In Amsterdam tiny cars are used a lot more than they have been in most places. There is the Smart Car but there is also a tiny car that can only seat one person (I'll update this entry with a link if someone provides me one). The tiny car appears to weigh ~200Kg, has a maximum speed of 30Km/h, and is narrow enough to fit in bike lanes. Such cars will take little petrol and can be used for shopping. The short-distance car idea is being used by many people already in northern Europe.

Simon suggests having a standard baggage container that fits in all cars. I don't think that would work as there are many different design factors (parking space, cargo capacity, and aerodynamics) which force designers to choose different shapes.

I think that a better idea would be a standard baggage trailer that could be towed by any small car. It should not be difficult to design a trailer that can be safely towed at 30KM/h behind a tiny car. The supermarkets could rent such trailers to shoppers for a nominal fee. Then most shopping trips could use the cargo capacity of the tiny car, but when buying supplies for a party you could rent a trailer from the supermarket.

Another option is having shops deliver goods to you. I have observed an increasing number of people doing this at my local supermarket. Of course you would still need to take ice-cream home yourself and maybe milk and meat too.

Electric scooters are also a good option for travel. Unfortunately in Australia there are few good options for securing them at the moment. As an electric scooter is light enough to be carried it needs to be chained to something secure. In the Netherlands this wouldn't be a problem as the bicycle infrastructure includes plenty of bike racks to which you can chain your bike, scooter, etc. Of course the Netherlands is entirely flat so there's no need for an electric scooter. Melbourne has a lot more hills and most people aren't fit enough to ride a bike so scooters are needed to replace cars.

Regarding depersonalised cars. That would require a significant social change as currently cars are extremely personalised. One thing that I had been thinking about is the idea of sharing cars with neighbors. For example if you have an apartment building and there are a few people you trust then you could share a tiny car for going shopping. Sharing a car used for driving to work or for entertainment would not work well as the car would spend most of it's time in use (or at least parked somewhere away from home). Sharing a car that's used for small journeys would be much easier as such a vehicle would spend most of it's time at home.

In Australia most families have two cars. One is used a lot (spends maybe 70 hours a week away from home) and the other is used much less (maybe 10 hours a week). Instead of owning two cars it would be possible for families to own one car and share another.

Regarding the Pebble Bed Reactor, could the people who advocate it please read the Wikipedia article. The limiting factor is not thermal expansion (solids do not expand nearly enough) but the Doppler effect (fast neutrons are not as effective at triggering fission). But in spite of that issue, let's not consider an untested new reactor design to be the savior of nuclear energy. I think that most people who read my blog have a science or engineering background and know from experience that new technologies often don't work too well in the first version. When a new CPU has a bug it's usually not a big deal. When a new OS or application has many bugs it's often expected (expecially when the OS or application comes from a monopolist). But if a new design for a nuclear reactor turns out to have a bug then it will be a more serious issue.

It seems that Toyota isn't alone in having non-functional web sites. In fact it's better than some, the basic information on the cars is available and it is possible to get contact information for car dealers, also they have a feed-back form on their web site (to which I submitted my previous blog post). Incidentally the Lexus site had much the same problem as the Toyota site (hardly surprising as Lexus is the luxury marque from Toyota). But I expect that if I phoned Lexus to ask about their vehicles I would get a better call-center experience which would make me less inclined to blog about them.

Daihatsu vehicles are sold by Toyota. Their web site doesn't use Flash, but it has so little content that it doesn't count.

I decided to quickly review the web sites of car manufacturers that sell in Australia for a fair comparison. I found three sites worse than Toyota, two sites that were equal (counting Lexus), and six that were better than it.

Holden has the worst site, they don't display any information if you don't have flash, they don't even display a phone number! I wonder how much Adobe pays web programmers to pull this sort of stunt. I can't imagine Holden management saying "if a customer comes to our web site and doesn't have Flash then don't display our phone number or any other contact information, they can use Flash or buy a Ford instead". Obviously some web monkey has run amok and done their own thing without following directions. Probably some people need to be sacked in the Holden web development group.

Volvo Cars has a very bad site. Most of the content is involved with Flash in some way and refuses to load. There is a mailto reference that is broken, and the overview page for the S60 seems to have a JavaScript loop (I aborted the load after it loaded 245 pictures and was still going). The Volvo page for their other business is quite functional although minimal.

Hyundai has a bad site. The front page works OK, but some of the sub-sites to display information on vehicles redirect to sites such as evolveddriving.com.au which are "optimised for 1024x768" and require Flash and Quicktime while others do strange things like changing the size of the browser window. Overall it's a very bad site, but at least I could find the contact details for my nearest dealer, and it has a feedback form.

Subaru has an OK site. The only thing I couldn't access without Flash is information on their AWD (All Wheel Drive) technology. Unfortunately they provide no email address and no form for sending feedback.

The main Ford web page claims that Flash is required, but their site just works without it. In a quick test I was unable to find any functionality on the Ford site that is missing because of not having Flash. Ford have a well designed site.

The Volkswagen site makes no mention of the fact that I don't use Flash, it does however have some strange unused spaces in the middle of the screen. I guess that it recognised that I don't have Flash and made a semi-successful attempt to work around it. I could get all information I wanted including dealer contact details.

The main Mazda web page displays a message about Flash not being installed and offers a link to a non-Flash version of the site. The Flash section is at the center and the buttons at the sides work if you don't have Flash. This seems to be a well implemented site.

Citroen has an OK site, no flash that I noticed (although there were large blank areas on the screen at times indicating that something was missing), the information was all available and browsing was reasonably easy. One thing that annoyed me was that there were movies available but only through some sort of JavaScript that tried to play them in my browser. I have never bothered setting up my web browsing machine for playing movies (among other things it has no speakers) so this is a problem for me.

Peugeot has a good site. No apparent flash and it's reasonably easy to use. It has more pictures than Kia but the JavaScript navigation stuff is fancy. One nice feature is a single page with pricing summaries for all models. If you have $X to spend on a Peugeot you will easily discover which ones you can afford.

Kia has the best site I saw! Not only is there no flash, but it's well designed, easy to navigate and it loads quite quickly. Please review the Kia site as an example of how to do it properly!

Let me know if I've missed any makes and I'll post an update.

Dear Benjamin Seidenberg!
Your account ‘benjamin’ has just been created in the central LDAP
database of the Debian project.  Please note that it needs a bit of time
until this information is synced with all developer-accessible machines.
You should be able to login or upload packages after about 30-60 minutes.
The password for this account can be found appended to this message,
encrypted with your GPG key.
Email sent to benjamin@debian.org will be forwarded to astronut@dlgeek.net,
to change this visit http://db.debian.org/forward.html.

This has definately made my day. I would like to thank my sponsor and advocate, Anibal Monsalve Salazar, the Debian Cyrus Team (especially Sven and Henrique) and especially my AM, Cl ment Stenac (Zorglub). I couldn’t have asked for a better AM; he answered every mail within a day as far as I remember, was extremely supportive and helpful. I remember when I sent him the last T&S response he appologized on IRC that he couldn’t write the recommendation until that evening, whereas some AMs have taken months to do it.
For those interested in the NM queue’s proccessing time, here is an approximate summery of my progress through NM:
Waiting for advocate: 2.5 weeks (This should have been shorter, I had my advocate lined up, but then there was a question about me signing the key of the guy who signed mine, but I hadn t checked his ID).
Waiting for AM: 6 months
Going through the checks: 2.5 months. (This would have been shorter had it not been right around the end of my senior year of high school, with the mad rush to cram everything in before exams)
Waiting for FD: 1.5 Months
Waiting for DAM: 1.5 Months
Waiting for account creation after DAM approval: 2 months.

One issue that has been the topic of some pointless discussion is whether a mail server should have an A record or an MX record. Mail can be delivered to a domain that has no MX record but simply an A record pointing to an IP address. But the most common practice is to have an MX record pointing to the name of the machine that serves the mail. A common use for this is to have a bulk mail hosting machine with multiple MX records pointing at it, which then allows you to have matching forward and reverse DNS entries for the machine name.

If you have no MX record for a domain then Postfix will do the following DNS requests:

IP postfix.34245 > DNS.domain:  3448+ MX? example.com. (32)
IP postfix.34261 > DNS.domain:  50123+ A? example.com. (32)

If you have an MX record then it does the following:

IP postfix.34675 > DNS.domain:  29942+ MX? example.com. (32)
IP postfix.34675 > DNS.domain:  33294+ A? mail.example.com. (37)

Now if there are multiple domains on a bulk mail hosting system then the A record might already be in a local cache on the sending machine, so having bulk mail hosting with MX records may reduce the number of DNS lookups, with the minumum number of lookups being half plus one.

If there is no bulk mail hosting then an MX record would still offer some slight benefits if the positive responses are cached for longer than negative responses. This would mean less lookups which gives faster and more reliable delivery of mail plus being more friendly to the net. I don't know what the cache behaviour is in this regard so I'm not sure if this would actually give a benefit (I'm sure someone will comment with the answer).

Now regardless of these issues I think that using an MX record is the better option. It's what most software expects and saves you from the excitement of discovering corner case bugs in various software that's out there on the net.

After asking the lazyweb on how to seek on gzip streams I got a very useful and comprehensive reply by Paul Sladen. As my previous searches on this topic didn't turn up to much useful things I'd like to publish Pauls reply (with his approval) here to help other people having the same problem as well: In a later mail Paul also added the following: Thanks Paul!

Running a vote usually is a bad signal. It often means someone is trying to push an issue which is doesn't have wide enough support. Ideally, we would have consensus. Anyway, the results for the votes are in, and most are pretty clear results. For example the recall vote with 48:277 - the proponents would have barely made the quorum (48 is the minimum quorum). At the Google Summer of Code, there was a talk on "Poisonous people" (blogged about by others before) - and while many big voices in this discussion clearly are top contributors, they show a couple of signs for "poisonous people" (which often are just drop-bys). So if you're now leaving the project because of the vote - so be it. The discussion is over. We'll just go on doing our Debian work as before, because we're still Debian, and Debian is still us. That hasn't changed. So if you thing we've changed radically (which I doubt we have), you're as free to leave as you've always been. If you think we're still the same, please remain with us, and help making Debian what it has always been: a volunteer effort. [Update: there was one vote 2-, which is the same as 12, but maybe he meant it to be 21 instead? Then the 'recall' people would even have missed the quorum!] [Update #2: I'd like to share this quote with you (from LWN comments):

Debian is indeed a more balanced 'organisation' than it appears to be from its mailing lists. That doesn't actually surprise me, but it's nice to have it affirmed.

Yes, many of us don't just care this much about politics, but about our users and Debian itself. Being free is a highly valued ideal; getting a release "as free as possible while still being useful" is the real goal we're after. On an somewhat related note, icedove just replaced thunderbird.]

Today I released version 0.60 of randomplay, my command-line shuffle-recall-swiss-army-knife music player. It will never make Winamp users happy, but it’s a good substitution for complex combinations of find/grep/xargs/sort that people sometimes use to pick tracks to play. If you can’t see why you’d use it, you probably don’t need it. The latest version adds two new command-line options, —older-than and —newer-than. These can be used to limit the songs included in the shuffle on the basis of the file modification date. The syntax is fairly flexible, and resembles that used by rdiff-backup for restoration commands. For example:

  Randomly play music under the ~/music directory that were added in the past week:
      randomplay --newer-than 1W ~/music
  Play in order music that is from before this year:
      randomplay --norandom --older-than '1/1/2006'
  Give a list of filenames of music that were added in the past 6 months, but haven't been played in the last three months:
      randomplay --names-only --newer-than 6M --days 3M 
  Play, but don't record in the playing history, music added in the first three months of 2004:
      randomplay --noremember --newer-than '1/1/2004' --older-than '4/1/2004'

Unfortunately, this new feature is pretty slow, because it stats each file individually on the initial spidering of the directories to be played. In fact, the startup is always fairly slow if you are searching a large directory hierarchy, since randomplay does not preserve any file index but checks anew on each execution. If you are searching tens of thousands of tracks over NFS (as I do), this can take a minute or so. Suggestions for improving the perfomance of the file modification time detection or of the whole startup are welcome. At some point, I will probably implement an indexing feature, but I like the simplicity of it now where it works basically like the shell find command. Version 0.60 should show up in Debian unstable shortly.

At least where “you” is “me.” Search Keys:

Search Keys lets you go to search results by pressing the number of the search result instead of clicking. For example, pressing 1 takes you to the first result. Hold Alt (Windows/Mac) or Ctrl (Linux) to open results in new tabs, or Shift to open results in new windows.

This is a great example of the sort of feature you never even knew existed before, and then you can’t live without.