Search Results: "cas"

11 February 2010

Asheesh Laroia: Google and University email

Should universities switch away from hosting their own email and join the Google bandwagon? Adi Kamdar wrote to the Students for Free Culture discussion mailing list linking us to a Yale Daily News article discussing an "almost-definite" switch for Yale to Google Apps for Education. Adi asked for thoughts, so here are mine.

Privacy One interesting thing about the Gmail option is that, when deployed for all students, students have no choice but to let Google read their official email. Some students might take part in activism that they want to shield from Google, a corporation with its own interests, or the attackers that attempt to break into Google's systems (see the recent attacks from crafty pro-Chinese-government hacktivists). Before a switch to Gmail, each student could choose if Google was the kind of company they wanted to share their email with. After a switch to Google Apps, the choice is made for them. But this highlights a different issue: Before a switch to Google, students have no choice but to let university administrators read their official email. That's not necessarily optimal, either. Others have pointed out in this thread that this option comes with legal advantages with regard to privacy law. At least that's some consolation. It's still true that students can encrypt their email and make it difficult for any eavesdropper to figure out the bodies of their emails. But that's no use for hiding the identities of the people with whom they communicate -- no email crypto I know hides email addresses.

Software freedom and open standards This is juxtaposed against another difficult situation: Matt Senate wrote about the sucky Squirrelmail system that Berkeley uses (used?) for webmail. The fact that SquirrelMail is Free Software is small consolation for Matt. From his perspective, because it's a hosted web application, he has no more freedom than he would have with Gmail. At least Berkeley's IMAP server followed standards! That's more than we can say for the Gmail IMAP server, which is famous for basically supporting just enough IMAP for Microsoft Outlook to work. But standards compliance is small consolation. If the university email server "properly" supports IMAP, but isn't fast or doesn't provide the new extensions that make threading or search speedy, it's not much relief to know that you can use any client you want to slowly read your email.

Internet history Truth be told, University-hosted Internet services are based on what you might call the original Internet perspective. The Internet began as a network of networks. A University was a network island unto itself, running its own email, news, and Ethernet services. When inter-network connection was available, you can email people at other institutions. When it wasn't, well -- the Internet is a useful tool, but it's down right now. "Don't worry," the admins might tell you, "you can still read your email with PINE." It used to be that inter-network connectivity was icing on top of the "real" network a person used. Today, inter-network connectivity is the whole point of a network connection. How embarrassing for each individual network! To test if our connections are working, we skip right over the local content and point our web browsers at a search engine. Users today aren't satisfied to read their email from imap.institution.edu and read USENET news-- they thirst for real-time access resources available beyond the university. Students weren't interested in the J-Stream service I helped set up at Johns Hopkins; instead they mostly posted and watched videos at YouTube. They don't really care if the the student-oriented wiki is based on campus or instead halfway across the globe (say, in Japan). The original Internet was based on autonomous networks and opt-in routing. But eventually, all the networks opted in. Users drive everything, and when they don't get what they want, they vote with their feet. Companies like Facebook and Google stand ready and armed to provide shockingly-efficient services to millions of users who choose them. You could say that with today's network, the autonomy shifted from the network to the users. The nice thing about University-run services is that students can organize and ask for changes, as Fred pointed out. And for people like me, there's something nice about knowing the person who runs your email system. But if your busy university staff doesn't have time to investigate an email server with fast full-text indexing, you might wish for change. Having the university tear down its internal services is a progression toward seeing its network as simply transit. Imagine the loss of pride. It used to be that the university personally ran a system for helping users get what they wanted. As it becomes simply transit, the staff are just greasing the cogs of a larger, invisible machine that's easy for users take for granted. Some netizens like me hold email as sacred, a beautiful institution based on standards and a decision to interoperate. When your university switches to Gmail, I'll be sadder, but maybe what you'll get is professors who can spend more time with students and less time configuring desktop software.

Trade offs Every university has a choice: Pay hundreds of thousands to millions of dollars a year for dedicated staff to run an in-house email system, or let Google do it. Think for a moment of what good could come from those dollars when put to use in other ways for students. Your school could start a switch to all-organic food. It could start paying more of its employees a living wage. Imagine the travel funding for student activities that can come from hundreds of thousands a year well-spent. It could run a massive used textbook clearinghouse to help students avoid pouring their dollars into the textbook industry. And now cry with me. What I've asked you do is to consider sacrificing institutional autonomy for cold, hard cash. That's to say nothing of the ecological benefits or the productivity increases possible from having Google's paid experts run this part of the computing system.

Conclusion Is an official Google email system much different than the reality most students I know live, which is configuring their student email address to forward to gmail.com? For those of us who would be sadder with one more push toward centralizing email with Google -- for those who see it as the behemoth whose size threatens the decentralization that used to be the core of the Internet -- I ask you to think positive. "See the profit from your loss." I have no conclusions for you, just niggling questions.

10 February 2010

Bernd Zeimetz: caching issues in django

Yesterday I stumbled upon an interesting and broken behaviour of Django: Running two instances with the same memcached as cache backend might result in displaying the wrong template from the cache in case we have template files with the same name but a different content. This behaviour is also visible in all django applications which use the cache backend without taking care of settings.CACHE_MIDDLEWARE_KEY_PREFIX. As mentioned in the bug report a design decision is necessary here, as the setting was only supposed to be used in middlewares. On the other side not honouring the setting everywhere makes it impossible to use different (unrelated) Django instances with one memcached. While this is not such a big issue for template data, it should be - for example - possible to insert faked django CMS user permissions into memcached as they are cached there, too. One possible solution is to ensure that settings.CACHE_MIDDLEWARE_KEY_PREFIX (or a similar setting with a better name) is used for every access. Using the following snippet as custom cache backend ensures this. Additionally it is much harder to insert faked cache content by using a md5 hexdigest as key. Although you should never store sensitive data in memcached - if you need to cache such data, use locmem, file or db as cache backend, as they allow to limit access to the data properly.
from django.conf import settings
from django.core.cache.backends.memcached import CacheClass as DjangoMemcachedCacheClass
from django.utils.hashcompat import md5_constructor
class CacheClass(DjangoMemcachedCacheClass):
    def __init__(self, server, params):
        self.key_prefix = settings.CACHE_MIDDLEWARE_KEY_PREFIX
        super(CacheClass, self).__init__(server, params)
    def _genkey(self, origkey):
        return md5_constructor("%s:%s" %(self.key_prefix, origkey)).hexdigest()
    def add(self, key, value, timeout=0):
        return super(CacheClass, self).add(self._genkey(key), value, timeout)
    def get(self, key, default=None):
        return super(CacheClass, self).get(self._genkey(key), default)
    def set(self, key, value, timeout=0):
        return super(CacheClass, self).set(self._genkey(key), value, timeout)
    def delete(self, key):
        return super(CacheClass, self).delete(self._genkey(key))
    def get_many(self, keys):
        return super(CacheClass, self).get_many(self._genkey(key))
    def incr(self, key, delta=1):
        return super(CacheClass, self).incr(self._genkey(key), delta)
    def decr(self, key, delta=1):
        return super(CacheClass, self).decr(self._genkey(key), delta)

Lucas Nussbaum: Debian Squeeze, Ubuntu Lucid and Ruby 1.9.2: NO!

Apparently, there s some hype in the Ubuntu community about Ruby 1.9.2, so let s clarify: it would be totally irresponsible to try to ship Ruby 1.9.2 in Debian Squeeze or Ubuntu Lucid. Ruby 1.9.2 has not been released yet: That s where we stand now. Even if surprises are possible, it s very unlikely that Ruby 1.9.2 will be released before Lucid s release (or, what the real requirement is, before Lucid s freeze). So we are sticking with 1.8.7 and 1.9.1 (1.9.0 will go away before the release). If you can point to specific commits that fix real bugs in 1.9.1, and could be backported to the Debian package, feel free to notify the Debian Ruby maintainers.

Aigars Mahinovs: USB 3D Sound

Want a sound card? Want a cleared sound that is not contaminated by electromagnetic interference in you computer s case? Want that all to work in Linux? I did. So I got me one of theseUSB sound cards. It arrived today in a tiny padded envelope. USB sound card And it works with Linux. Just plug and play. PulseAudio makes it all trivial. The device ID as reported by lsusb is 0c76:1607 JMTek, LLC. The text on the back of the device says Model HY544 USB 3D Sound Pnp FC CE Made in China .

9 February 2010

Martin F. Krafft: Baffling Exchange

I found out yesterday that my university s Microsoft Exchange Server account stopped forwarding my mail on 8 December 2009. As a result, mail accumulated there and remained unseen. Dear examiners, paper authors, supervisors, sponsors, participants, and peers who responded to my calls and cries related to my PhD thesis. I am terribly sorry that you were subjected to this. You replied usually within a few days, but I still sent you reminder after reminder in the weeks to follow. You must have thought that I was a real dork. Please forgive me. I really appreciate your patience! I filed a ticket with my university s IT service provider, which got closed the next day with it should now work again . That wasn t going to cut it for me, so I reopened the ticket, asking for an explanation. Next, I received an apology with a bit of speculation. After a bit of research, it seems that the reason was to be found in the inconsistency of being an external staff member (i.e. an e-mail address outside of the Active Directory domain), but still having an account on the server. On 8 December 2009, the server was upgraded with a service pack. This caused Exchange to go a little manic on the housekeeping. After all, why would anyone ever want to forward their e-mail elsewhere, and still have an account? Well, I certainly don t want an account, and yet I have to have one: Microsoft has bought their ways into the university and spread their germs all across, I need credentials to be able to access shared files, print, browse the library, or search the phone book. However, considering that UL s Outlook Web Access instance does not let users of decent browsers search their mailboxes (a premium feature reserved for users of Internet Exploder), one cannot manipulate more than a page-full of e-mails at a time, bounce messages, or do many of the other operations that make dealing with large amounts of e-mail possible, and because Exchange mail if it doesn t get lost in the first place sucks in so many other ways, I certainly prefer my mail to be handled by a real mail server with a proper mail filter (writeup in progress). Maybe the Exchange service pack was simply designed to get rid of outcasts like me who don t buy into the low-Microsoft-quality vendor lock-in? We ll never know, thanks to the proprietarity of their software (and the fact that the university service provider apparently does not keep logs of changes). NP: AC/DC: Back in Black

Lucas Nussbaum: Slides from my FOSDEM talk on Debian and Ubuntu

I ve just put the slides of my talk on Debian and Ubuntu online. Don t hesitate to post comments to ask for clarifications where needed (it might be difficult to understand some parts of the slides without being in the room). Clarifications:

Aigars Mahinovs: Debug and optimization do NOT mix!

This has robbed me of several days of my life, so I want to bring Google juice this this problem. IF you have a Pylons or TurboGears application or anything else that uses the fantastic EvalException WSGI middleware for web debugging of you web program and have the following symptom: * on a crash the traceback page shows up, but it has no css style and no images
* http://127.0.0.1:5000/_debug/media/plus.jpg returns a 404 (where 127.0.0.1:5000 is the path of your application) with Nothing could be found to match _debug The problem that you are facing in this case is the enviroment variable PYTHONOPTIMIZE or apache_wsgi option WSGIPythonOptimize. Unset them both or you debug environment will not work!

Russell Coker: Web Site Validation

Over the last few days I ve got this blog and my documents blog to conform to valid XHTML according to the W3C validation service [1]. One significant change that I made was to use lower-case for HTML tags. For about 15 years I ve been using capitals for tags to make them stand out from content and my blogs are the latest in a long line of web sites with that. Naturally I wasn t going to correct 900 posts manually so I ran a series of SQL commands such as the following on my database server (where X is the Wordpress table prefix): update X_wp_posts set post_content = replace(post_content,'<PRE>','<pre>'); But make sure you have a good backup of your database before running SQL search and replace commands on your blog data. After running such commands about 90% of my blog posts conformed, so I only needed to edit about 90 posts to correct things. This process gave some real benefits. One issue is that an apostrophe in a URL must be quoted, otherwise some browsers will link to the desired URL and some will link to a truncated URL. Fixing a couple of variations of this problem resulted in some broken links being fixed. Another issue is that you can t have paragraphs (<p> tags) within list items, fixing this made some of my posts align correctly it was a tricky fix, in some cases I had to use <br/> to break up text in a list item and sometimes I replaced lists with different sections delimited by <h3> headings (which apparently is rumored to give better SEO). It would make a really nice Wordpress feature to be able to do W3C validation as part of the publishing process, ideally an attempt to publish or schedule a post would result in a message saying saved as a draft because it s not valid XHTML if the checks failed. The source to the W3C validation software is significantly larger than Wordpress [2], but it seems to me that there are two main types of Wordpress installations, small ones for personal use (which tend to be on fairly idle servers) and big ones that have so much traffic that the resource usage of validation would be nothing compared to the ongoing load. As there seems to be no way of validating my posts before publication my best option is the W3C button I now have on my blog. This allows me to validate the page at a click so while I can t entirely avoid the risk of publishing a post with invalid XHTML I can at least fix it rapidly enough that hardly anyone will notice. It also seems like a useful feature to have aggregators like Venus [3] check for valid HTML and not display posts unless they are valid. It s not a feature that could be enabled immediately (I m sure that if you click on this link to the W3C validation service [1] from a Planet feed you will see lots of errors and warnings), but once bloggers have time to fix their installation it would allow preventing some of the common annoyances of Planet installations. It s not uncommon on popular Planets to have unmatched tags in a post which results in significant amounts of the content being bold, underlined, in italics, or for the greatest annoyance struck-out. I know that this may be a controversial suggestion, but please consider why you are blogging if you are blogging for the benefit of your readers (which seems to be the case for everyone other than sploggers) then it seems that the readers will benefit more by not having a broken post syndicated than they would benefit from having it syndicated and thus messing up the display of many following posts. The next thing on my todo list in this regard is to do some tests of accessibility. The work that I have done to pass the XHTML validation tests has helped to some degree if nothing else the images now all have alt= descriptions, but I expect that it will be a lot of work. The Wordpress Codex has a page about accessibility, I haven t read all of it yet [4]. Does anyone have any recommendations for free automated systems that check web sites for accessibility? What would be ideal is a service that allows different levels of warnings, so instead of trying to fix all problems at once I could start by quickly fixing the most serious problems on the most popular posts and finish the job at some later date.

Martin F. Krafft: Sign me up to social networking!

I do not like it when people tell Web 2.0 sites to send me invitation e-mail. I won t enumerate the reasons here. But there is one reason for why I don t like you passing on my address to those sites, which is subject of this article: Unlike popular belief, the Web 2.0 is not a money-printing machine. It s a long road until you can actually generate real money with user content. Therefore, some shadey sites are probably selling contact details to advertisers to make ends meet while hoping for the big cashflow. I don t have any data to back this up, and I want to change that:
Please tell all your Web 2.0 sites to send me an invitation! Please use an address in the signmeup.madduck.net domain for that, and make sure to include the domain name of the service to which you sign me up before the @ symbol. Also append a hyphen/dash and a random, short string. More on that in just a sec. For instance, if you are one of those people that believes that letting people know where you are (and have been) at any point in time, tell Foursquare to send an invitation to:
foursquare.com-ponies@signmeup.madduck.net
The reason for the random, short string ( ponies ) is simply so that I can later cross-check that a message receiving spam actually went through a social networking site I intend to catalog the invitation messages.
Thank you for your time. Keep in mind: the more, the merrier. I ll make sure to report back on the outcome of this little experiment right here, so watch this space. NP: Billy Joel: Cold Spring Harbor

8 February 2010

Vincent Fourmond: The java packaging nightmare...

... or why I mutilated your java package in Debian This post is especially addressed to what we Debian Developers refer to as upstream maintainers, that is the people who write/maintain the software that we package for Debian. It is meant to explain why, in some cases, Debian Developers prefer to mutilate your work rather than upload it to Debian Archives in a state that gives it proper credit. And to apologize. These opinions are my own, but I have a faint feeling that I'm not the only Debian Developer working like that, and that this few words could help soothe the relation betwenn Debian Developers and Upstream Maintainers, which can be quite tense some times... It happens unfortunately quite often (too often!) that I disable (or don't enable) features in programs I package. Exact reasons vary, but they essentially fall into two categories:
  • A feature requires code that does not comply to Debian Free Software Guidelines, which Debian cannot distribute. This is a no-go.
  • A relatively minor feature depends on other software that are not packaged yet, and in which I don't have specific interest, which means I would not be able to maintain them properly (or it would require too much packaging work and so on...).
When a program has features which falls in one of these categories, I have two choices: either I give up packaging the software or I give up some of the features... For packages for which I care, obviously the second option looks better from my point of view as a Debian Developer. Java packages are especially affected by this problem, for a very simple reason. Java is one of the few (I don't say only because I'll probably be flamed to death) programming languages which allows very easy distribution of binary platform-independent libraries, in the form of JAR files. Many projects simply reuse and embed JAR files published for other projects in their own JAR files, often without precise references to where the source code can be found. Packaging a moderately-sized Java application often rely on dozens of embedded JARs, which we need to remove from the packages we build (as Debian does not distribute binaries without sources for many reasons), and for which we need to hunt down the original source code and often packaging the original project, which might pull in yet other dependencies and so on... A true nightmare ! That's why it is so tempting some times to simply drop some of the code, possibly write patches to disable references to removed libraries, and be done with it. Therefore, I would wish to publicly apologize to any upstream developer I've offended by stripping down apparently carelessly their beautiful software before uploading to the Debian Archives; I hope they now understand why I've done that. Note to users: it is not because one of the features of your favorite software has been disabled by its (Debian) maintainer that you need to turn away from Debian ! Rather, file a bug report against the package. You'll get the reasons why the feature was disabled, and you have a chance to convince the maintainer to switch it back on.

Biella Coleman: Hacker and Troller as Trickster

trickster If you read the literature on tricksters, you will confront a string of words that capture the moral quality and sensibilities of these figures, figures scattered across time and place and largely enshrined in myths and stories:
Cunning, deceit, lying, provocateur, mischief, audacious, thief, play, shrewdness, audacity, grotesque, over the top, appetite, shocking, fun, delight, wit, trap, subversive, ability, wanderer.
These figures, which include Coyote, Loki, Hermes, and Eshu, among many more, push the envelope of what is morally acceptable and in so doing, argues Lewis Hyde (in his tome on the subject), renew and revitalize culture, especially the moral stuff of culture. They are not only boundary crossers, they are boundary makers. As the title of his book so succinctly and masterfully broadcasts Trickster Makes this World. Or as he suggests with a bit more elaboration:
I want to argue a paradox that the myth asserts: that the origins, liveliness, and durability of cultures require that there be a space for figures whose function is to uncover and disrupt the very things that cultures are based on p. 9
At the opening of the book, Hyde asks whether there are tricksters in modern industrial societies. His answer is a plain no. The con man who might share some similarities does not qualify. For in fact what is needed is either a polytheistic system or lacking that, he needs at least a relationship to other powers, to people, to instructions, and traditions that can manage the odd double attitude of both insisting that boundaries be respected and recognizing that in the long run their liveliness depends on having those boundaries regularly distributed p.13 He does locate the spirit of the trickster in spirited individuals: in Picasso, in Frederick Douglass, in laudable figures who push certain boundaries and renew our world for the better but nonetheless fall short of the archetypal trickster. I bet it is pretty obvious where I am going with all of this given my object of study: phreakers, hackers, and trollers. The trickster does exist across America, across Europe, really across the world and it is not in myth but in embodied in group and living practice: in that of the prankster, hacker, the phreaker, the troller (all of whom, have their own unique elements of course, but so does each trickster). Their relationship to other powers are many and can be located in terms of information, intellectual property, the government, language itself, institutions of power like the FBI and AT&T. The list is not short. For a few years now I have been thinking about the linkages between the trickster and hackers as well as the troller but it was only in the fall when I found myself trapped in a hospital for a week that I finally cracked open the book by Hyde and devoured it. Within a the first few pages, it was undeniable: there are many links to be made between the trickster and hacking. Many of these figures, push boundaries of all sorts: they upset ideas of propriety and property; they use their sharpened wits sometimes for play, sometimes for political ends; they get trapped by their cunning (which happens ALL the time with tricksters! That is how they learn); and they remake the world, technically, socially, and legally and includes software, licensing and even forms of literature (think textfile, the Jargon File or most dramatically, ED). But if the trickster generally resides in myth, and the trickster of the information age resides in practice, myth matters everywhere because there is a mythos created around these figures. Sometimes the mythos is propagated these groups (take a look of ED for example or Phrack in the past) and of course the media has played an undeniable role. And yet, unlike what is represented in the pages of Hyde, there are living, actual bodies in motion, in conversation, in transformation, a group that goes far beyond the other more controlled and bounded tricksters we might be able to locate in society, such as artistic/political groups like the Yes Men. But the most shocking (or hard to think through) element lies less in the many associations one can make, but in the following curious fact. For the most part the trickster is enshrined in myth and stories but the tricksters I am referring to are in fact full-bodied, full-blooded groups of people who are actually engaging in all sorts of acts of trickery. This is culture not in the sense of art and myth but people and practice and this of course makes an (ethical) difference. What happens when you are the recipient not of a story offered an elder, but the recipient of trickery, an act of pranking or trolling, for example? What happens when you can trace all sorts of instances of boundary re-shifting and remaking, as with the GPL? I think this, even more than the linkages, is what makes this connection so remarkable and I trying to think through what it means to have a figure that we can find and talk to, as opposed to one embodied in myth and story. For now I am going to leave this post short and in the next installment, will start raising some of the connections between trickery and variants of hacking and trolling.

Biella Coleman: Hacker and Troller as Trickster

trickster If you read the literature on tricksters, you will confront a string of words that capture the moral quality and sensibilities of these figures, figures scattered across time and place and largely enshrined in myths and stories:
Cunning, deceit, lying, provocateur, mischief, audacious, thief, play, shrewdness, audacity, grotesque, over the top, appetite, shocking, fun, delight, wit, trap, subversive, ability, wanderer.
These figures, which include Coyote, Loki, Hermes, and Eshu, among many more, push the envelope of what is morally acceptable and in so doing, argues Lewis Hyde (in his tome on the subject), renew and revitalize culture, especially the moral stuff of culture. They are not only boundary crossers, they are boundary makers. As the title of his book so succinctly and masterfully broadcasts Trickster Makes this World. Or as he suggests with a bit more elaboration:
I want to argue a paradox that the myth asserts: that the origins, liveliness, and durability of cultures require that there be a space for figures whose function is to uncover and disrupt the very things that cultures are based on p. 9
At the opening of the book, Hyde asks whether there are tricksters in modern industrial societies. His answer is a plain no. The con man who might share some similarities does not qualify. For in fact what is needed is either a polytheistic system or lacking that, he needs at least a relationship to other powers, to people, to instructions, and traditions that can manage the odd double attitude of both insisting that boundaries be respected and recognizing that in the long run their liveliness depends on having those boundaries regularly distributed p.13 He does locate the spirit of the trickster in spirited individuals: in Picasso, in Frederick Douglass, in laudable figures who push certain boundaries and renew our world for the better but nonetheless fall short of the archetypal trickster. I bet it is pretty obvious where I am going with all of this given my object of study: phreakers, hackers, and trollers. The trickster does exist across America, across Europe, really across the world and it is not in myth but in embodied in group and living practice: in that of the prankster, hacker, the phreaker, the troller (all of whom, have their own unique elements of course, but so does each trickster). Their relationship to other powers are many and can be located in terms of information, intellectual property, the government, language itself, institutions of power like the FBI and AT&T. The list is not short. For a few years now I have been thinking about the linkages between the trickster and hackers as well as the troller but it was only in the fall when I found myself trapped in a hospital for a week that I finally cracked open the book by Hyde and devoured it. Within a the first few pages, it was undeniable: there are many links to be made between the trickster and hacking. Many of these figures, push boundaries of all sorts: they upset ideas of propriety and property; they use their sharpened wits sometimes for play, sometimes for political ends; they get trapped by their cunning (which happens ALL the time with tricksters! That is how they learn); and they remake the world, technically, socially, and legally and includes software, licensing and even forms of literature (think textfile, the Jargon File or most dramatically, ED). But if the trickster generally resides in myth, and the trickster of the information age resides in practice, myth matters everywhere because there is a mythos created around these figures. Sometimes the mythos is propagated these groups (take a look of ED for example or Phrack in the past) and of course the media has played an undeniable role. And yet, unlike what is represented in the pages of Hyde, there are living, actual bodies in motion, in conversation, in transformation, a group that goes far beyond the other more controlled and bounded tricksters we might be able to locate in society, such as artistic/political groups like the Yes Men. But the most shocking (or hard to think through) element lies less in the many associations one can make, but in the following curious fact. For the most part the trickster is enshrined in myth and stories but the tricksters I am referring to are in fact full-bodied, full-blooded groups of people who are actually engaging in all sorts of acts of trickery. This is culture not in the sense of art and myth but people and practice and this of course makes an (ethical) difference. What happens when you are the recipient not of a story offered an elder, but the recipient of trickery, an act of pranking or trolling, for example? What happens when you can trace all sorts of instances of boundary re-shifting and remaking, as with the GPL? I think this, even more than the linkages, is what makes this connection so remarkable and I trying to think through what it means to have a figure that we can find and talk to, as opposed to one embodied in myth and story. For now I am going to leave this post short and in the next installment, will start raising some of the connections between trickery and variants of hacking and trolling.

Olivier Berger: Working on standard forge exchange format

As part of COCLICO, we re working on an exchange format for forges, that should help dump, restore, export and import from different software forges. There are various use cases for this, like moving a project from one forge to another, but also as backup/restore feature for forge admins. More about the rationale here. We d like this format to be a standard some day, so it should have good properties so that it s generic enough and at the same time easy to adopt. Thus it would be relatively easy to contribute new exporters or importers to an framework (for which we ll implement basic core tools), while having a long-lasting format that can still be used in the future. A lot of work ahead of us, and this is just a short notice in case you re interested and you d like to know more ;) Stay tuned, and if interested, join discussions@planetforge.org to discuss this topic. P.S.: yes, it s a rebirth of CoopX, somehow (see the coopx tag in my blog for more details)

7 February 2010

Marco d'Itri: Advances in networking for virtual machines

So far the networking of virtual machines has usually been managed by configuring a Virtual Ethernet Bridge (VEB) in the host, i.e. the good old implementation of 802.1D in the Linux Kernel:
A Virtual Ethernet Bridge (VEB) is a capability within a physical end station that supports local bridging between multiple virtual end stations and (optionally) the external bridging environment.
While this works well and in some cases is the best solution, in other setups performances or policy needs dictate that the traffic between virtual machines is forwarded to an external bridge (the Ethernet switch connected to the host) and back without having in the host a real bridge learning MAC addresses from its ports and implementing the STP. Enters the VEPA:
A Virtual Ethernet Port Aggregator (VEPA) is a capability within a physical end station that collaborates with an adjacent, external bridge to provide bridging support between multiple virtual end stations and external networks. The VEPA collaborates by forwarding all station-originated frames to the adjacent bridge for frame processing and frame relay (including "hairpin" forwarding) and by steering and replicating frames received from the VEPA uplink to the appropriate destinations.
Support for VEPAs has been added to Linux 2.6.33 with a simple change to the macvlan driver. The next step will be to use the macvtap driver (available in 2.6.34), which exposes a tap character device usable by kvm-qemu and "connected" to a macvlan-like interface.

Ben Armstrong: Eee PC care at 2 years

In November 2007, we bought two of the first Eee PC netbooks available in North America: the model 4G in pearl white, one for me, and one for my wife. My plan was to start the Debian Eee PC project and get Debian working on them both which, thanks to the work of everyone on the team, has been a great success. Fast forward to February 2010, and they are still serving us well. Here is a list of hardware enhancements and issues over the past two years of continuous use: Battery life Asus claims 3.5hrs for the model 4G, though I don t think we ever experienced anything better than 2.5 hrs with wifi in operation. Today, I m down to something short of 2 hrs. If you consider the Lithium ion battery article on Wikipedia to be accurate, it is typical to permanently lose 20% capacity per year, so this sounds about right for the age of the battery. Touchpad The touchpad itself is fine. The buttons are not. They are hard to push and prone to become less responsive after a while, or to fail entirely. I now really have to bear down hard on my left button to make it work. Because the buttons are soldered to the motherboard, they would be hard to replace. Configuring the synaptics driver for tap-to-click is an acceptable workaround. Also, one of the first purchases we made was the Logitech VX Nano, one for each Eee, so most of the time now, we use our mice, falling back to the touchpad only when using a mouse is inconvenient due to space constraints (e.g. on the bus). Keyboard After two years of continuous use, both of our keyboards needed replacing. Some of the keys had been pounded flat and needed surgery (rubber springs sliced out of a scavenged Acer netbook keyboard and grafted on) to make them usable again. And aesthetically, the keyboards have really suffered, with a good percentage of the markings on the keycaps partially or completely eroded off. Fortunately, for $3 plus $10 shipping each, new keyboards can be ordered from a Chinese e-Bay seller. But with the new keyboards, there is still the problem with excessive flex in the keyboard making some keys less responsive than others. I m considering trying this hack to solve the problem. Display I have no complaints about the matte finish displays of either Eee. Both have stood up well. People tell me they don t care for a 7 display, but I find it bright, crisp and easy to get along with, so long as you maximize windows and increase font size as needed (e.g. for reading PDF books and magazines). When I really need the extra real estate, I just hook up an external monitor. Fan Some people complain about the noise of the fan, from the otherwise silent 4G (due to the lack of a hard drive) and seek ways to limit the amount of time the fan runs. We ve never had that problem. However, if any plastic bits break off inside the Eee, they will eventually find their way to your fan and get wedged. This has happened twice: once in my wife s Eee, and once in mine. Disassembly of the Eee to clear the blockage and get the fan running again was relatively painless both times. Plastic bits About those plastic bits: In my wife s case, I think the bit was some extruded plastic from the molding that had broken off. In my case, it was a deteriorating plastic post which was holding the hinge in place. More about this later. Sound Unfortunately, the integrated sound seems to be particularly sensitive to heat. During both fan failures, sound cut out. On my wife s system, it never fully recovered, and now only works on alternate Tuesdays, whereas on mine, after I unwedged the fan and brought the heat down, sound has functioned properly ever since. (Update: see my comments below on power adapters for an alternate theory about what killed sound.) We are waiting now for the delivery of a cheap ($1.42 including shipping, again from China) 3D Sound USB device which is reported to work on Linux. While some users complain about hum with this device, we re cautiously optimistic that on the Eee it won t be an issue. If it is, oh well, a buck and a half is a small gamble. Display hinge The plastic posts that hold the anchors for the machine screws for the hinge are fragile. Three out of four of these posts in my Eee have shattered, leaving the left hinge to float freely. For the past two days I was distressed about how I could fix this. Based on some helpful suggestions from #eeepc @ irc.freenode.net, I had worked out a plan to rebuild one of the posts with two-part epoxy, sand it and the fractured stub of the post, and use cyanoacrylate glue to affix it to the case. It sounded like fiddly work for which I didn t hold much hope of success. But this morning, I realized that the plastic in the bottom of the case was still sound, and that I could drop a screw into that hole, and with pliers, line up the anchor on the other side. This appears to work! I ll handle that hinge with care, but it should do me until I eventually repurpose the machine to some daily use that is less stressful on the hinge than daily travel on the bus. SSD and SDHC Some people were initially worried that the limited write life an SSD meant that you needed to take special measures to avoid its premature death, which I have always regarded as a myth. Our 4G SSDs each have no swap space, and ext3 filesystems. At the two year point, there are no problems. I expect our SSDs to outlast the other components. We did, however, eventually find the 4G to be a bit on the small side. We now each have Kingston 4G micro-SDHC cards for a bit of extra capacity for large media files and for some extra space for the apt cache. I recently priced the Lexan version of this card at $19 for a two-pack at Wal-mart, and these seem to work in the model 4G just as well (which seems to be an issue with this model not all SDHC cards work). Memory We found the 512M that came with the 4G somewhat constraining. Without any swap space (so we could maximize the space available on the small SSD) we decided our systems really needed a memory upgrade. At the time, 2G didn t seem overly expensive (though I no longer remember the exact price) so we splurged on 2G for each system, even though that was probably more than we needed. Power adapter When I first wrote this article, I forgot to mention the power adapter. The model 4G uses an unusual 9.5V power adapter for which it is hard to find a generic replacement. This unit is prone to fail in two places: in rare cases, (one out of 6 units that I have in some way assisted with: 3 of them mine, 3 belonging to others,) it will break at the wall plug end. The plug swivels into the unit for easy storage, but this adds a point of failure. More commonly, (in 3 out of six of the units,) the wires at the netbook plug end will fray due to stress on the non-angled cord, leading either to no connect, or to a short. In fact, since in the case of my wife s adapter, the netbook end of the cable shorted, making the cable heat up and the system spontaneously shut down after a little while, we can t say for sure whether the overheating of the Eee took out integrated sound, or whether this short did. On the one hand, I know for certain my own system, which never suffered a short, has responded to overheating by making the sound flaky, but it has never taken out sound completely. On the other hand, shorting the power cable can t be very good for the Eee, so who knows, maybe that s what ultimately killed my wife s Eee s sound. This is where it helps to have soldering skills, or a friend who can do the repair for you. In my case, it was the latter. While I was waiting for a replacement adapter I had ordered, we also found on eeeuser.com part#s for replacement plugs and sleeves from Digikey, total cost $20 including shipping, 10 pieces each. Cutting off the bad plugs on three units and attaching the new was a quick, straightforward operation, and succeeded in two out of three cases. Having carefully checked the failed repair, we deduced that the failure in that unit was at the wall end, and we judged there was nothing further we could do to try to save it. Even the unit that had previously shorted was returned to perfect health and has been in operation trouble-free ever since. Conclusion After over two years of continuous use, the model 4G has held up well for a $400 system. We definitely feel we have received our money s worth of value over that time. All of the problems we ve experienced so far have been fixable at very little expense, and we expect them to last at least another year before we seriously consider replacing them. In the next several months, I plan to order a high capacity 8-cell 10400mAh battery for my own system so that I can enjoy a 5-6 hr run time. The purchase will be roughly $55 including shipping, the most expensive purchase for my system to date, but still well worth it to extend the 4G s lifespan for another year or more.

Asheesh Laroia: Cosmetic carbon copy: The opposite of blind carbon copy

I propose a new feature for email software: Cosmetic carbon copy. CCC works very similarly to today's carbon copy feature: If you put an address in the CCC: list, when the recipients open the message, they can see the address. The one difference is that with "cosmetic" carbon copy, the CCC:d address never recieves the message. An example might illustrate the situation. Let's say someone (Alice) wants to invite Bob to a movie but doesn't want Charlie to come. She might send this email:
From: alice@example.com
To: bob@example.com
CCC: charlie@example.com
Subject: MOOOVIEEE!
Hey all my friends, join me for a movie tonight!
When Alice sends the email, Bob recives a copy. Bob thinks that Charlie received a copy, as he will be in the CC list. But Alice's mail software never sent Charlie a copy. So Alice can relax, knowing that Bob won't forward a copy to Charlie, since Bob thinks he already received it. Alice and Bob will meet up without Charlie, and Alice will quietly sigh in relief.

How can this work? Cosmetic carbon copy works on the same principle as blind carbon copy: the contents of the message are fundamentally independent from the recipients. Saavy email users have used the "blind carbon copy" feature for years. When you place an address in the BCC list, that address will receive a copy of the email even though other recipients won't see the address listed. This allows for a form of privacy between the sender of the email and that hidden recipient. This works because, like postal mail, email messages are delivered using an "envelope" that contains the actual recipients. When you compose a message in Alpine, Gmail, or Thunderbird, you are writing the contents of the envelope. When you hit send, the mail software looks for email addresses that should receive a copy. It creates one envelope per address, stuffs the letter inside, and sends the whole thing on its way through the Internet using a protocol called SMTP. When the recipient (Bob)'s email system receives it, the letter is pulled out of the envelope and placed in an inbox. Which means the envelope is entirely invisible to Bob, the recipient. Most mail software puts information about the envelope in email headers. Since each email recipient gets a separate envelope, In the case of cosmetic carbon copy, Alice's letter claims that Charlie was on the CC: list. But Bob can never learn that Charlie's copy was never sent. So to implement cosmetic carbon copy, Alice's mail program must understand this rule:
  • For each address in the CCC list, copy the message to the CC: list in the email message.
  • Create no new envelopes when sending the message.
Because of the last bullet point, this "carbon copying" is purely cosmetic rather than functional.

A possible privacy problem You might wonder, what happens when Bob hits reply-all to say "Yes, I'm coming"? Then (oh no!) Charlie might see the invitation. Not a problem: Most of my friends use Gmail, and Gmail users almost always hit Reply instead of Reply-All. Gmail used to have an experimental option called "Reply All by Default", but thankfully they removed that option. A future version of this specification might suggest mangling the last "." in the BCC:d email addresses with the ONE DOT LEADER character, which looks like "." but isn't one. That way, even if Bob clicks "Reply all," Charlie's email address is subtly incorrect and will bounce.

Future work The story I've told here is marginally simplified so it's understandable to a less-technical audience. Those who want a more technical version can request I submit an RFC. Perhaps in two months? (File under "games to play with email.")

6 February 2010

John Goerzen: The Big-Publisher Ebook Scam

There s been a lot written about the Amazon vs. Macmillan dust-up. I ve seen a lot of posts by people that work for publishers saying that there are costs to making a book, and that $9.99 just won t cut it for an ebook. They say that publishers invest in typesetting, editing, selection, art, and various stages of quality control. All of that is true. Too bad they aren t doing it with ebooks. I ve had some books published, and while the process varies from publisher to publisher, the editing process usually involves technical editors (people that check my facts), copy editors (people that help the writing and grammar), cover designers, and QC staff. Often I will see PDFs or printed pages at the final stage, and at that point can catch things like bad table formatting or lines split at inopportune places. My point here is that there s a lot of editing going on, and there are many pairs of eyeballs looking at the printed page before it goes to the presses. In the year or so since I ve owned my Kindle, I can absolutely guarantee you that this process is not happening with ebooks. Most of the time, it is quite obvious that nobody has even looked at the finished product. Some intern has whipped up a quick conversion from whatever typesetting software they use, give it a quick glance, and call it good. One of my own books, Real World Haskell, is available in Kindle form. O Reilly took better than average care of that process, but even so, I certainly didn t approve screenshots before it went out like I did for paper (not that I d have had time after the paper project was done anyway.) From memory, some of the flaws I m aware of: In some of these cases, it is quite obvious that a human didn t even bother to look at the result. Harper Collins got a huge black eye after their LOTR fiasco, and still took quite a long time to fix it. Now, if the publishers were actually going to put as much care into the quality of their ebooks as they do into the quality of their paper books, then sure, I d pay almost the cost of a paperback. But very few of them are doing that. It is quite obvious to me usually by the end of the first chapter of a book whether anybody even looked at the result of their conversion. Bottom line: If they re going to sell me an inferior product, don t expect me to pay near full price. If they can get their act together on quality, only then would they have room to start arguing for higher prices. If all you re going to do with the ebook is run the paper version through some buggy filter, you haven t incurred much additional cost, and it is plainly visible to all. Note: I would like to say that Lonely Planet and O Reilly have done good jobs with the tools available, and while their results aren t perfect, they have done a good job working with rendering their sometimes very complex print layouts for a Kindle.

5 February 2010

Lucas Nussbaum: Going to FOSDEM

I'm going to FOSDEM, the Free and Open Source Software Developers' European Meeting Yes, I m going to FOSDEM. And this year, I decided to innovate by starting the obligatory FOSDEM flu before leaving to FOSDEM. I m doing a talk on Sunday, on Debian and Ubuntu (Distributions room, H.1308, 13:45). It might not be on your schedule (but is on the printable schedule) since it was decided quite late.

Michael Casadevall: 1984

It's been awhile since I last posted, but I felt the need to do so after my recent flight through ATL. While I was waiting for my connection the loudspeakers announced that we were at threat level "Orange" and that we, the people, had to be on guard for threats to our country.



Does this remind anyone of anything? If your answer is 1984, then you win. When did we get to this point that our government is feeling more and more like the Party; I am just waiting for the day when we have telescreens constantly watching for terrorism and other threats ...



I hope this day never comes but given the path we have been on since 9/11, I fear for the future ...

Carl Chenet: python-jabberbot 0.9 in Debian


The new upstream version of python-jabberbot was uploaded yesterday in unstable (thanks Piotr!). Python-jabber is a Python library which makes easy to write your own Jabber bot. /usr/share/doc/python-jabberbot/examples/broadcast.py is a good example of a *really simple* Jabber bot and could be a good start if you need one.

Next.

Previous.