Search Results: "cas"

16 December 2009

Gintautas Miliauskas: Android apps

I've recently gotten myself an Android phone. The Android app market is not as mature as iPhone's App Store, but there is a lot of applications, and plenty of chaff to separate the wheat from. I found most of the apps I use by browsing "top Android apps" lists on the web, so I am putting up a similar list here in case someone finds it useful.

Holger Levsen: Debian Wine soon to be sold out?

In case you want to buy some (more) bottles of wine made for DebConf9, you need to hurry up. Also a bit more hurry is appropriate if you want it to be delivered til XMas :-)



(Picture credit belongs to Chris.)

I'm planing another (offline) sale at the 26C3 congress in Berlin at the end of the year, which might or might not work out. If it does, the number of bottles available for online ordering will be reduced significantly, and basically I'm only waiting for some details to be finalized for announcing this for real, so hurry up and mail order now - unless you have enough Debian wine bottles at home already :-)

Information how to order is available in our wiki at DebianWine. The profit made will be given to DebConf9, and as that has been dealt with finacially successfully, it will be given to DebConf10!

14 December 2009

Jo Shields: FOSDEM 2010

I will be at FOSDEM in February next year. It should hopefully be awesome. Anyone who packages Mono on any distro should definitely come, or does any Mono-related stuff in general, since not only will I be there, but the fabulous Mirco Bauer too and perhaps other wonderful people. Definitely a fine use of your moneycash.

Russell Coker: Nagios and SSL in Debian

I was doing some work on NRPE (the Nagios Remote Plugin Executor) and I noticed bug report #547092 [1] which concerns the fact that the default configuration uses the same SSL certificate for all Debian servers and provides a patch to fix the problem. After building the patched package I followed the advice of the DebianAdministration.org article on creating self-signed SSL certificates [2]. cert_file=/etc/ssl/certs/FOO-cert.pem
privatekey_file=/etc/ssl/private/FOO-key.pem
cacert_file=/etc/ssl/certs/cacert.pem Then I added the above lines to /etc/nagios/nrpe.cfg to instruct the nrpe to use the certificates. For the Nagios server I had the problem that most of the systems I monitor run old versions of NRPE while only a few are recent Debian systems that allow me to easily install a new SSL checking nrpe. So I installed the following script as /usr/lib/nagios/plugins/check_nrpe to run either the old or the new check_nrpe: #!/bin/sh -e
if echo $2 egrep -q server0\ server2\ mail ; then
/usr/local/sbin/check_nrpe -C /etc/cert/cert.pem -k /etc/cert/key.pem -r /etc/cert/cacert.pem $*
else
/usr/lib/nagios/plugins/check_nrpe.orig $*
fi The reason I started working on Nagios was to try and solve bug #560002 [3] which I filed. The bug concerns the fact that applications such as mailq which are run as part of Nagios checks were inheriting a TCP socket file handle from the nrpe. SE Linux prevents such file handles from being inherited, but it does mean that I get audit messages (and this is not a good case for a dontaudit rule). Update:
One thing I forgot to mention is that the SSL key checking requires that the server common name used in the SSL certificate of the nrpe system matches the name that is used by the check_nrpe program. So if you check by IP address then you need to use the IP address in the certificate name which is rather ugly. So I have moved to putting the hostname of each server in /etc/hosts on the NAGIOS system and using the hostname in the SSL certificate. This required using $HOSTNAME$ instead of $HOSTADDRESS$ in the NAGIOS configuration (thanks to John Slee for a tip in that regard). Update2:
I removed some printf debugging from the script. It seems that I included a pre-production version of the script in the first version of this blog post.

David Welton: File Selector for Java ME

I recently did some work to make Hecl read files, which also means that it can execute Hecl scripts from the phone's memory. This is especially important for environments like Blackberry, where we will be distributing a signed version of the Hecl application. To create your own Hecl applications, instead of simply replacing the script in the .jar file, you can point to a script on the device's file system. This is also available for normal Java ME phones, but unfortunately, for an open source project, the cost of a code signing certificate are prohibitive (on Blackberry, it's only $20, so I bought one with my own money). In any case, as part of this effort, I developed a very simple 'file browser', which is used in Hecl to select a script to execute. The results are, like all of Hecl, available under an Apache license, which means that you can use it pretty much wherever you want: http://github.com/davidw/hecl/blob/master/files/org/hecl/files/FileFinder.java http://github.com/davidw/hecl/blob/master/files/org/hecl/files/FileFinderCallback.java Of course, if you spot any ways to improve it or fix problems with it, I'd appreciate it if you sent patches back.

13 December 2009

Russell Coker: Links December 2009

Dan Gilbert gave an insightful TED talk about our mistaken expectations of happiness [1]. Don Marti has an insightful post about net neutrality and public property [2]. When net access requires access to public property then it should be sold in a neutral manner. Rachel Pike gave an interesting TED talk about the scientific research behind a climate headline [3]. The people who claim to be skeptical of the science should watch this. Mark Peters wrote an interesting article A Happy Writer Is a Lousy Writer about the correlation between emotional state and work quality [4]. Apparently watching a film about cancer will make people more careful and focussed on details. CERIAS has an interesting short article about Firefox security as well as some philosophy on why web browser security generally sucks [5]. Cory Doctorow writes in the Guardian about Peter Mandelson s new stupidity in trying to legislate against file sharing [6]. This is going to seriously damage the economy of every country that implements it. Charles Stross has been blogging a series of non-fiction essays about space colonisation, in The Myth of the Starship he describes how most ideas of space travel are bad and how the word ship is always going to be unsuitable [7]. Brent T. White is an associate professor of law at the University of Arizona who has written an interesting paper about mortgages [8]. He says that anyone who is underwater (IE owing more than the value of their house) should walk away. The credit damage from abandoning a bad mortgage apparently isn t that bad, and there is the possibility of negotiating with the bank to reduce the value of the loan to match the value of the house. Mako is working on a project to allow prisoners to blog [9]. It s basically a snail-mail to web gateway as the prisonsers are not allowed Internet access. PracticalEthicsnews.com has an article about the special status that homeopathy is given [10]. It also notes that homeopathic medicines include arsenic and mercury. Such quackery should be outlawed, a life sentence for homeopathy would be appropriate IMHO. Cory Doctorow wrote an interesting essay about why he is not selling one of his books in audio form (he s giving it away) [11]. He concludes by noting that he wants no license agreement except don t violate copyright law . The fact that he can t get anyone to sell an audio book under such terms is a good demonstration of how broken the marketplace is. Thulasiraj Ravilla gave an inspiring TED talk about the Aravind Eye Care System a program to bring the efficiency of McDonalds to eye surgery [12]. Hopefully that program can spawn similar programs for other branches of medicine and spread to more countries. In many ways they are providing better service (both in quality and speed) than people in first-world countries who pay a lot of money can expect to receive. Scott Kim gave an interesting TED talk about his work designing puzzles [13]. He is also a big fan of social networking, unfortunately (for people like me who don t like social networking) his web site ShuffleBrain.com relies on Facebook. Gordon Brown (UK Prime Minister) gave an inspiring TED talk about global ethic vs the national interest [14], with a particular focus on the global effort required to tackle the climate change problem. Now if only we could get Kevin Rudd to listen to that. Brough has written an interesting analysis of the AT&T network problems that are blamed on the iPhone [15]. His essential claim is that the problem is due to overly large buffers which don t cause TCP implementations to throttle the throughput. This seems similar to my observations of the Three network in Australia where ping times of 8 seconds or more will periodically occur. One particularly nasty corner case with this is when using a local DNS server I can have a DNS packet storm where basic requests time out while BIND uses a significant portion of available bandwidth (including ICMP messages from receiving ports that BIND has closed). To alleviate this I am now using the Google public DNS service [16] (the Three DNS servers never worked properly).

Debian News: Debian is moving sieve to its IANA allocated port

The IANA port allocated for ManageSieve is 4190/tcp, and the old port used by timsieved and other managesieve software in many distros (2000/tcp) is allocated for Cisco SCCP usage, according to the IANA registry.

Starting with the version 4.38 of the Debian netbase package, the sieve service will be moved from port 2000 to port 4190 in the /etc/services file. This affects to those using Debian Squeeze, and Debian Sid. Debian Etch and Debian Lenny users are NOT affected.

Any installs which used the sieve service name instead of a numeric port number will switch to the new port number as soon as the services are restarted/reloaded, and in some cases, immediately after /etc/services is updated.

This will affect Cyrus IMAP. This may also affect other sieve-enabled software such as DoveCot.

In order to avoid downtime problems, mail cluster administrators using Debian are urged to verify their Cyrus (and probably also DoveCot) installs, and take measures to avoid services moving from port 2000/tcp to port 4190/tcp by surprise in either servers or clients.

It is worth noting that:

  1. /etc/services will only be automatically updated if you never made any modifications to it. Otherwise, you will be presented with a prompt by ucf or dpkg asking you about the changes.
  2. You can edit /etc/services and change the sieve port back to 2000 if you want (this is not recommended, though).
  3. You can edit /etc/cyrus.conf and any other relevant config files for your mail/webmail cluster (e.g. on the sieve web frontends) ahead of time to force them all to a static port number.
  4. You can configure cyrus master to listen on *both* ports (2000 and 4190) at the same time, and thus avoid the problem entirely. This also allows for a much more smooth migration from port 2000 to port 4190.

Henrique de Moraes Holschuh

Julian Andres Klode: MySQL


If Oracle owned MySQL, it would not make a big difference with regards to competition on the database market. Oracle would then own 2 relational databases. But there is also the BSD-licensed PostgreSQL, the world s most advanced open source database with several enhanced products from companies. If Oracle closed MySQL, the community would step in. I truly believe that the free software community is strong enough to support MySQL. There already is MariaDB and I believe that this project could serve as the base in case Oracle closes MySQL or stops MySQL completely. The community was strong enough to build complete operating systems and maintain them, so it should not be that hard to support one database. All in all, I don t see how Oracle buying Sun (and thus MySQL) could negatively influence competition in the database market, and I would therefore recommend the EC to approve the Oracle-Sun deal as it, without imposing any conditions on Oracle. Posted in General

David Welton: Mysql, Oracle and the European Commission

I am a bit of a cynic, and my cynic-sense definitely lit up when I read this: http://monty-says.blogspot.com/2009/12/help-saving-mysql.html He wants to have his cake and eat it too. Or as they say in Italian, he wants to have his wife drunk and the barrel full (really!). He sold Mysql to Sun for a great deal of money - around one billion dollars. Even if his share is only 1% (which I doubt), that is still 10 million dollars, which is enough for anyone normal to live the rest of their life without ever having to work again. If he walked away with 10% of the deal, that's 100 million dollars. Monty writes:
I have spent the last 27 years creating and working on MySQL and I hope, together with my team of MySQL core developers, to work on it for many more years.
Since it's under the GPL, he can do that himself for as long as he wants - he doesn't have to worry about making a living, after all. If he took away something closer to the 100 million number, he can also fund several of his friends to work on it for years and years, without worrying much about income. They could always do consulting if they wanted to make a few bucks, in any case. Now, what he's worried about is that Oracle will no longer put money into Mysql. I agree that that's a real risk. However, I also think that since it's Oracle's money that is being spent, they have the right to do as they see fit, within certain limits, and this case is well within those limits. My view is that there are plenty of cases when governments should intervene. For instance, if Mysql were the only competitor to Oracle in the database market, it might be quite unhealthy to let them buy it. But that's not the case - not at all. There are numerous competitors, both closed and open. So the risk to 'the public' is relative: people bought into a product that may now stagnate, but if they really want, they have plenty of other places they can jump without too much pain (SQL is a standard, after all). It's like if FreeBSD disappeared tomorrow: you could switch to OpenBSD or Linux or something else. Perhaps not painlessly, but it wouldn't be the end of the world, either (let's hope FreeBSD has a long and happy future ahead of it, though). We're back to wanting to both have and eat the cake: Monty seems to want the EC to force Oracle to divest itself of Mysql or impose various restrictions on its development. If he had imposed those conditions on Sun when that sale was made, they might not have done the deal, or placed a smaller value on it. He didn't, but now he is back and trying to impose them on a deal in which he is not a participant (although I suppose he may have some Sun shares). That doesn't strike me as being entirely fair: if he really wanted to ensure the future of Mysql, he would not have sold the company. In terms of open source, keep in mind that Mysql was not released under the GPL until 2001: http://www.mysql.com/news-and-events/generate-article.php?id=23 For many years it was under a "sort of open" license that was not proper open source. Then there's the Richard Stallman angle: that somehow, Mysql "deserves" to have developers funded to work on it. I don't buy that, either. Mysql is a nice project, but I don't think that there's any moral imperative that the government should step in and fund some open source projects. Should the EC step in and say that Oracle should also fund Postgres development while they're at it? There are plenty of deserving projects that could use some cash to fund their development. For instance, my friend Salvatore is looking for donations for Redis development. It's not as big or "important" a project as Mysql, but it's good code and already being taken up by various companies. For that matter, I'd like to keep working on Hecl full time. In short: I hope that the EC approves the sale "as-is". I also hope that Oracle continues to take good care of Mysql, but if they don't, that is ultimately their decision as long as there remain plenty of competitors in the market. I think that our time as "the open source community" is better spent fighting for more important things: against bad software patents, for open standards in governments, and that sort of thing, that will benefit everyone, rather than trying to wrest control of Monty's code back from Oracle after he's already been paid handsomely for it.

Clint Adams: Sanjana Kumar goes to the movies

I have an imaginary automobile. It is the finest hybrid of German and Japanese engineering. It has a peppy little engine and a turning radius so small it would make a baby camel cry, and a six-speed manual transmission, and it is powered by the urine of vegan bears. My imaginary father asked me why I would possibly want to buy an imaginary car with a manual transmission. Obviously, whichever marketing campaign brainwashed him in the first place wasn't strong enough on the memetics, because after borrowing my imaginary car, he shut the hell up. You see, it's considerably more fun to drive than an automatic. There are other benefits as well, of course. The primary one is that the transmission does what I want. An automatic transmission is configured for maximum comfort , so it wastes a lot of power when shifting. With a manual, you can slip from gear to gear with minimal clutch time, or in some cases, if you're feeling sassy, without using the clutch at all. You can control your engine speed so that your shift will be just as smooth as an automatic without the egregiously long clutch disengagement or shift overlap. You also can see the road in front of you, so you're always going to be smarter than an automatic transmission, unless you don't understand how slopes work or what collisions with other cars mean to your well-being. Now some NRA member is going to point out that you can get a shift kit and tweak your automatic to be less awful. While spending money on this type of thing sounds like a great idea, a shift kit is not going to bring an automatic into the same league as my car. I can still start the car when the battery's dead. I can get higher fuel efficiency (vegan bears don't exactly urinate for free). I can shift into fifth gear, and coming from a full stop, drive up a hill without stalling (this is particularly useful when a squirrel has gnawed the teeth off of all your other gears). Furthermore, shift kit or not, an automatic is absolutely no fun. Someday, when transmissions have advanced into the realm of liquid hyperspace buckminsterfullerene cones that commune with the unicorns, and they'll have cameras and radar feeding the car's computer with useful information about its surroundings so it can make intelligent shift decisions faster than a human. Then I'll have to choose between saner and more fun. That era has not yet arrived. This is a lousy metaphor for debhelper.

12 December 2009

Russ Allbery: Peter Watts attacked by US border guards

Signal boost. While returning from a trip to the US (in other words, going to Canada) on December 8th, Canadian SF author Peter Watts was attacked, beaten, pepper-sprayed, and imprisoned without access to legal counsel by the US Border Patrol. See also his post on the subject. The government's case has obviously not yet been presented. However, given the past behavior of the US Department of Homeland Security, I find Watts's description of the event entirely credible. This is an outrage. This is the kind of thing that happens in third-world dictatorships. See also Making Light and Boing Boing. John Scalzi's post has information on how to donate money to Watts to get through this legal fight. I will be giving him money. I also plan on calling my US Representative and Senators when I'm no longer at work, as this sort of treatment of a Canadian citizen warrants a Congressional investigation and heads rolling, not only at the agent level but at the Homeland Security management level. Even apart from basic questions of human rights, Homeland Security is going to systematically destroy the tourist industry in the United States if this sort of behavior is not stomped on immediately and severely. There are border patrol guards who are probably still on duty today who are common criminals and belong in prison for assault. ETA: The government's side of the story. This is pretty much what I expected, and with the data available so far, I feel confirmed in my initial reaction. This level of force is completely disproportional and flatly unacceptable short of Watts pulling a weapon on the agents, which they are not claiming that he did and which therefore he clearly didn't do. I'm highly skeptical of this supposed "choking" of a police officer after they pepper-sprayed him. This reads like the standard cover-your-ass charges filed by the police after they beat someone up. Once they've provoked the struggle by grabbing you and have done something as painful and disorienting as pepper-spraying you, chances are you're going to physically react in ways that they can conveniently misinterpret and use as the basis for charges. People elsewhere have pointed out that contacting Congressional representatives is probably better done Monday morning since nothing will happen during the weekend.

11 December 2009

Yves-Alexis Perez: PDF Presenter Console

For some reasons, I had to create some slides, and it's been some time I wanted to do some latex/beamer, so I jumped in and created them using vim (hating latex/beamer a few times in the process, but that's expected. At least, I didn't have to hate OpenOffice this time). Now, when presentation time comes, I started missing the nice Presenter Console extension for OpenOffice. It's a nice extension which (a bit like Keynote) (and maybe other) enables you to seperate the beamer and laptop screens. So you put on the beamer the presentation itself, and on the laptop one you can put you notes, the next slide preview, a nice countdown etc. Really useful, but it's only for OpenOffice (or PowerPoint) slides, not for pdf ones. So I started looking at PDF readers which could do that, and found multiple solutions: So in the end, I was almost ready to submit a bug report to epdfview (which I already maintain in Debian) asking for that new feature, when I found PDF Presenter Console which does exactly what I want. I'm not sure the project is really active at the moment, and I had some problems with the tool not detecting one of the screen (so it only appears on the beamer, or only on the laptop). It might be related to xfwm4 or something, I already contacted the developer about that. In the end, it's not 100% reliable (so I'm not yet packaging it for Debian) (especially since it uses CMAKE) but once it started, it does the job pretty fine. That's just something I wanted to share in case people would be interested.

John Goerzen: Graduating and what now?

I guess I ve never been one to do things a certain way just because that s how they re normally done. I took my first college class pretty young, back in 1995, just after my freshman year in high school. By the time of my junior year in high school, I was well on my way through the computer science curriculum at Wichita State, and would probably have graduated from WSU at about age 20 had I not moved to Dallas, and then Indianapolis, for jobs. I did so because I (correctly) thought that in my line of work, experience was more important than a degree. However, playing into that was the incorrect notion that an education was useful primarily as a means to a career a notion that colleges and universities unfortunately have been promoting themselves. After moving back to Kansas, I started work to finish my degree I had effectively one year left had I been a full-time student. But it was difficult doing so, living almost an hour from Wichita, having a full-time job, and then when Jacob was on the way, I stopped classes entirely. Having online classes available to help me finish out the degree has been great. A year ago, I re-thought the value of education to me, concluding that there is a lot of value in education for its own sake. Looking at education as little more than a means to a career is the wrong way to approach it. Since I have had that re-evaluation, I ve adjusted my path even at this late point, and have enjoyed my classes more than I ever had before because of it. Graduating! So anyhow, here I am, graduating in a few days, 14 years after I started. I ve had some good news this semester, too: I ll pass the requirements to be a graduate of the WSU honors program, and also to graduate magna cum laude. So it may have taken me 14 years to do finish college, but at least I ve done it well . It feels weird to be about to be done with college, after so many years of being almost done, except for And a question I ve been thinking about a lot is: What next? Obviously I ll start by taking a break from college stuff. I want to be able to spend more time with Terah, Oliver, and Jacob, and there are things around the house that need attention. But after that? I figure I have a few options: No more college, but some reading. I do enjoy reading, and especially reading older works that are nicely out of copyright and thus free. I ve read few of the classics, but I enjoy reading them, and want to be better informed about them too. That could be fun. But sometimes it s hard to know how to place things in context. For instance, I don t think I could have gotten as much out of reading some famous philosophers as I did by doing so in a class that put them all in context and discussed criticisms of different positions. I also wouldn t necessarily have the ability to discuss and debate ideas with my classmates. Take the occasional undergraduate class in a topic that interests me. I m especially interested in history and literature, and haven t had much exposure at the college level in either. Various online courses are available from universities in Kansas on those topics. I could take a course or two each year and become a better-informed, more well-rounded person, and study an interesting topic at the same time. Maybe this would eventually lead to a degree, and maybe not. It would be fine either way. Graduate studies. It s a lot of work, and I m not sure it would be all that interesting to me. I ve looked some at curricula. I don t think that I m interested in computer science as a graduate program; I enjoy coding more than theorizing and analysis. But I also don t think that a graduate MIS or some such degree is for me; most of them appear to either focus on Windows or cover things that I ve already known how to do for years, and thus I wonder just what the point of them is (in addition to questioning how rigorous the curriculum is). I could also, down the road, pursue a graduate degree in something like English, philosophy, or history, but it seems a natural path to that would be to take more undergraduate classes in those topics first. So for now, I ll sit tight. I ll see how I feel by summer, how pressed for time I feel at home, and if I still feel the desire to take more classes. If so, I suspect I ll try to take some undergraduate classes in whatever sounds interesting to me at the time. In a way, that is quite freeing take a class on whatever topic I like, without a defined degree in mind. I ve never been free to do that before, and I like the idea of it.

10 December 2009

John Goerzen: Being a Dad at Thanksgiving

Over Thanksgiving this year, we took a train trip to visit Terah s family in Indiana. Here s the story of the trip. The Train to Indiana Our last train trip (to Chicago) was in May, before Oliver was born. Jacob always has enjoyed the train, but this time wow. We told Jacob about the trip the day before we were to leave. Several times in the day, he d get a sly smile, and ask, What are we going to do? Terah or I would spell out the day s activities, and when we d get close to the part where I d wake him up at night and we d go to the train station, he d have a big smile. The big hour (2AM) arrived and Jacob woke up while Terah was putting his shoes on. I was there a moment later. Normally Jacob is terribly grumpy after waking up, even more so if somebody else woke him up. That day, I saw a very groggy-looking boy. I asked him, Jacob, are you ready to go to the train station? He answered, YEAH! while rubbing his eyes. Dad, let s go! We had Amtrak s family bedroom for the first time this trip, and it worked out great. Jacob actually slept, despite his extreme excitement. He d been talking about eating in the diner car for quite some time, and was really excited when breakfast time rolled around. We sat down, and he pressed his nose up against the window right away. He counted the freight trains the he saw, pointed out train tracks and crossing guard lights , noticed barns and trucks, and gave us frequent updates on how fast we were going. His voice was high-pitched from excitement, and sometimes we d have a running commentary we could barely interrupt, and other times he d sit there silently just soaking it all in. But he didn t eat. He didn t want to turn his head away from the window for a second to take a bite. I kept reminding him to take a bite, and finally, fearing he d be really hungry as soon as we went back to our room, fed him a few bites for the first time in ages. I don t believe he realized that happened. He just opened his mouth by reflex and once I had to tell him to close his mouth around the fork that was in it. It was much the same story for lunch, and for dinner on the train though less so for dinner since it was dark outside. At dinner, a man sitting across the aisle from us said, If you weren t getting your meal free [since we're in the sleeper], I d buy it for you. Your boys are amazingly well-behaved! I thanked him politely Jacob and Oliver both were doing well but didn t really think it was that unusual. Oliver and Jacob were both big hits on the train. They got smiles from so many people on board and in the stations. Several of the dining car staff seemed to linger at our table longer than elsewhere, looking at them (and especially Oliver). Oliver slept well on the train: img_2240.jpg And here are a couple of typical Jacob photos: img_2244.jpg img_2241.jpg In Indiana I ve got to start this out with one of the family gatherings at Terah s aunt s house. They have a large kids area in their basement, and a swingset with a slide outside. Jacob loved all of this, and spent hours playing with me. Sometimes if I d go upstairs with the adults, I d hear Jacob s voice from the basement a few minutes later: DAAAAAD!!!! Shall you come back downstairs? DAAAD! And, of course, it s hard to resist a 3-year-old that wants to play with me, so I inevitably would. We played air hockey Jacob shrieked with delight whenever anybody scored a goal in any way. At one point, he stood up, looked around, and said, Hmmm. Where are all the trains? Apparently he expected every home to be stocked with toy trains, and this one wasn t. A few seconds later, he was all excited. He ran over to a toy semi, and said, I will use the semi train! Outside the short slide had a ladder going up to it. I held Jacob s hands while he climbed up the first few times, but I knew he could do it himself. I started helping him less and less, and eventually refused to help him at all. He was rather frustrated with that for a moment, but a couple times later, climbed up and said, Dad, I got up here all by myself! A few times later, it looked like he was having trouble, so I tried to help, and got shooed away with, No, dad! I can do it. The best moment of the weekend came during the drive back to Terah s mom s house where we were staying. Terah was driving, and I heard Jacob say, Shall you come closer? Not sure how to do that from the front seat of the car, I reached my hand back there and he held it. He held one or the other of my hands for 20 minutes until he fell asleep in the car. It s funny what feeling needed by a 3-year-old makes a person feel, but that was surely a happy day. Jacob got to see all of his Indiana grandparents on this trip, and loved playing with them. He especially liked using a perfect red train (his words!) he drug home from the nursery at church on Sunday, and a child-sized tent in the basement. I m not sure how many times I heard Gampa Mike! Shall we go to the basement? that weekend. One point he wanted me to come down to see it and play with him, so I did. Then he decided we all needed to be down there, and told me I ll go pick up mom. I ll be right back. Stay downstairs, dad. Fearing that Terah wouldn t know what to do when Jacob attempted to pick her up , I tried to discreetly follow at a distance. That was no match for a 3-year-old. He looked back at me from the top of the stairs, pointed an accusing finger at me, lowered his voice, and said, Dad. Stay. Terah and I spent a day in South Bend and stayed at the Oliver Inn while Jacob and Oliver got some time to themselves with their grandparents. We had dinner at the beautiful Tippecanoe Place, just next door. The Trip Home We had a few hours in downtown Chicago on our way home. We went and ate at a small Indian restaurant. Jacob kept alternating between three things: This food is very spicy! I like spicy food. I need another drink! A little while later, Terah decided we should have some dessert. So she and Oliver stayed in the waiting area while Jacob and I went asporing (exploring) to find something. We walked a block or two to the nearest Dunkin Donuts, then to a Starbucks, and then back. Jacob carried the sack of donuts, guarding them so carefully that I was afraid he might smash them. (They were cream-filled so that wouldn t have been good.) He had a lot of fun exploring Chicago Union Station, and also enjoyed walking in Chicago (though not quite as much; it was all a little too loud for him.) In the train station, he loved the escalators. Up and down we went, whenever we wouldn t get in people s way. I had to eventually drag him away from them as I was getting a little self-conscious at all the people standing around watching us repeatedly go up and down the escalators. Jacob has found a 3-year-old way to express his feelings: he ll pretend to be a kitty, and say the kitty is sad or something like it. All day he had been saying the kitty is hungry. He hadn t had a big breakfast, but he had plenty of opportunity to eat at lunch, and a snack. We were a bit confused, but I think we finally figured it out on the train back to Kansas. We didn t have time to eat breakfast in the diner on the train from South Bend to Chicago, so Jacob missed out on the dining car then, and I think he was disappointed or confused about that. Once we had dinner in the dining car, he was happier. Since we ve been back home, he s been talking about our next train trip. He says which suitcases we ll take, that we ll eat in the diner, that it will be a night train we take, and generally is still very excited about it. It was a fun trip.

Biella Coleman: Postdoc Hall of Shame (please spread the shame)

Postdoc Hall of Shame So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

Biella Coleman: Postdoc Hall of Shame (please spread the shame)

Postdoc Hall of Shame So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

Kartik Mistry: foss.in/2009: Report from lazy man


* Yes. I m kicking myself for being lazy and not doing stuffs that I supposed to do before, during and after foss.in/2009. I had expected too much that never happened but something too good happened that I wasn t able to imagine. foss.in/2007 was my last foss.in visit where we had lots of fun. Really. But, along with that certain elements (ie Real Life) made it hard to let me enjoy that. Same happened during 2008. Pity. I missed KDE Song and what not.. But, this year I determined and kicked myself several times. Real Life was kind of in happy mood. foss.in team helped me to figure out travel issues. So, I was all set. All days were filled with fun, much better involvement (& RTFM) with Debian and then my small talk at KDE PoTD was surprise to me (and also to that Projector that never worked with my Macbook). I ve made some cool friends Ramkumar, Siddhesh, Shreyank, Rahul Sundaram and many more from Pai hotel discussion group! For those who missed my stupid brown humor and PJs next time. C ya at foss.in/2010! And yes, I took only two pictures during entire conference. But, fossdotin flickr or picasa tag will say you what kind of fun we had.

Kumar Appaiah: Weird weather

Am I the only one who finds this sort of weather variation weird?(Source: NOAA)

9 December 2009

Asheesh Laroia: A big machine that nothing can stop

A couple of weeks ago, Lucas Nussbaum wrote about his experience at the Ubuntu Developer Summit. Two things stuck out at me: In the summer of 2004, my laptop (an iBook G4) ran Debian GNU/Linux on PowerPC. I tried out Ubuntu that autumn, and was very impressed. It's been five years since then. My desktop still runs Debian, and I'm proud to be a "two-distro" community member. At the same time, this juggernaut nature raises concern. When Ubuntu releases ship with significant flaws, I quietly sigh and wonder, Are we doing good service to the people coming to GNU/Linux for the first time and seeing Ubuntu? This bugginess has bit me a few times (even for upgrades between one release and the next), and it pushed a friend of mine to switch a lot of his computing to DragonflyBSD. Lucas points out that Ubuntu's done a fantastic job of becoming visible. A look at Google Trends shows that people search for "Ubuntu" about as much as they search for "Linux" at all. Richard Stallman complains when people refer to GNU/Linux as just "Linux." But today, the most popular name for an operating system based on GNU is probably "Ubuntu." For Stallman, having his hard work associated with someone else's "Linux" project must be frustrating. As a Debian contributor, it would be easy to succumb to the same feeling with regard to Ubuntu. Lucas is well aware of that. He asks, Debian does have users! I was feeling a bit disheartened about my maintenance work on alpine lately, when out of the blue I received an email from a fellow at MIT asking me if I would accept some help with maintenance from him. Just seeing the note was a relief; it's very nice to be reminded that I have users to take care of. Debian is not as popular as Ubuntu on the desktop (or laptop), it's true. But technically sharp people do frequently still choose it. For example, the FreeNAS project recently announced a switch from FreeBSD to Debian (and a new name as coreNAS). But we could end up a "package supermarket". To stave this off, we must do good releases and make sure people know about them. Doing all that work takes us all time. We must recruit new contributors, help them find things to work on, and make sure they feel welcome. And sometimes-sloppy maintainers like me ought to fix our packages, and get help from others where necessary. I promise to work toward that.

Stephan Peijnik: ujail: use cases, FAQs, part 1 & proof of concept, part 2

As I ran out of time whilst writing the "introducing ujail" post on monday I would like to further elaborate on the idea, giving you some examples of possible use cases and then having a look at FAQs regarding ujail. Additionally I have created a second proof of concept that should be a lot faster, see below for more details.

Use cases of ujail

Monday's post was rather technical, so let's have a look at possible use cases today.

The main reason for both having the idea of ujail and starting working on it is my web server. I am running quite a few (S)CGI scripts there and, even though running them as different users, on a per-vhost basis, I have the impression of the whole thing being a bit insecure.

Okay, PHP does provide its famous open_basedir feature, but I am also running some Python applications which I simply cannot restrict easily. My first ideas involved adding something similar to open_basedir to Python, followed by the idea of replacing some C library functions, like fopen and friends on startup time.

Whilst the adding open_basedir to Python would have involved changing a lot of Python's internals I soon discarded the library patching idea as those could be worked around by injected code directly invoking syscalls. It didn't take long for me to notice that I have to dig deeper. The idea of ujail was born and after coming up with the proof of concept this seems to be a viable solution.

Now ujail is not only about protecting a web server from its web applications, but could do a lot more, for example:

I am sure you can come up with even more use-cases. What should be noted is that emulating a system call does not mean that one necessarily needs to emulate the whole filesystem. What can be done, for example, is patching through access to common files (libraries, executables, etc.) whilst maintaining a virtual filesystem for data that will eventually be modified. A copy-on-write approach is possible too, for example. There are multiple methods with which the multiple filesystem could be implemented, the most common would probably be using a state directory.

FAQs

There have been some questions about ujail in comments to my first post which I would like to answer. Also, I have been thinking about things that are different about ujail compared to other virtualization techniques. Feel free to add additional questions either in a comment or drop me an email: debian at sp dot or dot at.

  1. Could you change the license of ujail to ... ?

    Not likely to happen. The proof of concept's license is GPLv3 and the actual code's license will be too. However, ujail is a userspace application that does not need any modifications to the kernel so there should be no problems with porting ujail from GNU/Linux to any other system.

  2. Does ujail work on operating systems other than GNU/Linux?

    Not yet. If it's technically possible to implement the technique on other operating systems I would be happy to accept patches.

  3. Do I need to patch my kernel for ujail to work?

    No, ujail is running in userspace. The only thing it needs is Linux with support for PTRACE_SYSEMU.

  4. How is this approach different from using LD_PRELOAD?

    With LD_PRELOAD one can replace library functions, but malicious code could still directly invoke syscalls, working around this protection completely. Also, statically linked binaries cannot be restricted with LD_PRELOAD.

  5. How is this approach different from user-mode-linux?

    User-mode-linux (UML) works by emulating a full kernel in userspace and allows you to virtualize a whole Linux instance (including a new init process, etc). ujail is about providing a way of restricting a single process (and its childs) inside a running system in terms of access to syscalls and the partial emulation of those.

  6. How is this approach different from linux-vserver?

    Linux-vserver is a kernel patch and runs in kernel space, as opposed to ujail, which works in userspace.
    Also, linux-vserver works similarly to user-mode-linux, providing a fully virtualized Linux instance.

  7. Does the account running ujail need any special privileges?

    No, the only restrictions that apply are those of ptrace.

  8. Where is the code?

    Right now ujail is in a planning phase, and only the proof of concept code has been written and published. The actual ujail code is yet to be written and the code will be hosted on launchpad.net.

Proof of concept, part 2

An anonymous person (who were you stranger?) added a comment to my first post, suggesting "Also, why patch the process rather than just modifying its state and trapping into the kernel?". I have had a look at this approach earlier, but it didn't work out. However, I decided to give it yet another try and created a second proof of concept. That code does not require patching any code, but only modifies the instruction pointer (eip) and the first register (eax). This should be a lot faster than patching the code.

Technically the new main loop works by calling PTRACE_SYSEMU and waiting for a notification. It then saves the instruction pointer and switches to PTRACE_SYSCALL. As before it waits for the emulated syscall to exit and at this point sets eax from orig_eax and decreases the value of the instruction pointer by the size of the "int $0x80" instruction. Another call to PTRACE_SYSCALL resumes the process. The next event is the process actually entering the real syscall and yet another one leaving the syscall again. These are resumed by PTRACE_SYSCALL and PTRACE_SYSEMU respectively. So, comparing this with the first approach we are only modifying two registers now, instead of writing to the TEXT area of the running process.

Thanks should go to the anonymous commenter for making me give this approach another try.

Questions? Criticism? More ideas? Want to contribute?

Coming to an end I would yet again like to let you know that I am open for questions, criticism, more ideas and contributions in general. So if you are interested in this topic come join the discussion by either dropping me an email, writing a comment to this post or replying to this post on your own blog.

Next.

Previous.