Ninth day in Addis SSH To enable remote logins with ssh apt-get install openssh-server Then you can login with:

$ ssh efossnet@proxy.dream.edu.et

To verify the host key fingerprint of a machine:

$ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key.pub

Note: you need to verify it before logging in! More information at http://www.securityfocus.com/infocus/1806 Example ssh usages To log in:

    $ ssh efossnet@proxy

To run a command in the remote computer:

    $ ssh efossnet@proxy "cat /etc/hosts"

To copy a file to the remote computer:

    $ scp Desktop/july-18.tar.gz efossnet@proxy:

To copy a file from the remote computer:

    $ scp efossnet@proxy:july-18.tar.gz /tmp/

Beware of brute-force login attempts Warning about SSH: there are people who run automated scans for ssh servers and try to login using commonly used easy passwords. If you have an SSH server on the network, use strong passwords, or if you can it's even better to disable password authentication: in /etc/ssh/sshd_config, add:

    PasswordAuthentication no

To log in using public/private keys:

1. Create your key:

   ssh-keygen -t rsa
   

2. Copy your public key to the machine where you want to log in:

   ssh-copy-id -i .ssh/id_rsa.pub efossnet@proxy
   

3. Now you can ssh using your RSA key

If you use ssh often, read these:

• http://mah.everybody.org/docs/ssh
• http://www.securityfocus.com/infocus/1812
• http://www.sshkeychain.org/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys-HOWTO-6.html

proxy Problems we had today with the proxy: ssl does not work Reason: squid tries to directly connect to the ssl server, but the AAU network wants us to go through their proxy. Ideal solution: none. There is no way to tell squid to use a parent proxy for SSL connections. Solution: update the documentation for the Dream university users telling to setup a different proxy for SSL connections. Longer term solution: get the AAU network admins to enable outgoing SSL connections from the Dream university proxy. Other things that can be done:

• report a bug on squid reporting the need and requesting the feature
• download squid source code and implement the feature ourselves, then submit the patch to the squid people

Browsing normal pages returns an error of 'Connection refused'. In the logs, the line is:

1153294204.912    887 192.168.0.200 TCP_MISS/503 1441 GET http://www.google.com.et/search? - NONE/- text/html

That "/503" is one of the HTTP error codes. Explanation of the error codes:

• http://www.w3.org/Protocols/HTTP/HTRESP.html
• http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
• http://offline.web.cern.ch/offline/web/http_error_codes.html

Reason: the other proxy is refusing connections from our proxy. Solution: none so far. Will need to get in touch with the admins of the other proxy to try to find out why it refuses connection to our proxy, and how we can fix the problem. postfix on smtp.dream.edu.et Basic information is at http://www.postfix.org/basic.html. Difference between mail name and smarthost:

• The mail name is the name of the mail server you're setting up (TODO: need more details on what's it used for)
• The smarthost is the name of the mail server that will relay mail for you.

Quick way to send test mails:

apt-get install mailx
echo ciao   mail efossnet@localhost

To configure a workstation not to do any mail delivery locally and send all mail produced locally to smtp.dream.edu.et:

1. install postfix choosing "Satellite system"
2. put smtp.dream.edu.et as a smarthost.

To setup a webmail: apt-get install squirrelmail (on a working apache setup). To setup mailing lists: apt-get install mailman, then follow the instructions in /usr/share/doc. Mail server issues we encountered When a mail is sent to efossnet@localhost, the system tries to send it to efossnet@yoseph.org Investigation:

• "yoseph.org" does not appear anywhere in /etc or /var/spool/postfix
• postfix configuration has been reloaded
• postfix logs show that the mail has been 'forwarded'

Cause: the user efossnet had forgotten that he or she had setup a .forward file in the home directory. Solution:

 rm ~efossnet/.forward

Apache To add a new website:

1. cd /etc/apache2/sites-available
2. sudo cp default course
3. sudo vi course:
   1. Remove the first line
   2. Add a ServerName directive with the address of your server: ServerName course.dream.edu.et
   3. Customize the rest as needed: you at least want to remove the support for browsing /usr/share/doc and you want to use a different document root.
4. sudo a2ensite course
5. sudo /etc/init.d/apache2 reload

More VIM Undo: u (in command mode) Redo: ^R (in command mode) You can undo and redo multiple times. To recover a lost password for root or for the ubuntu admin user Boot with a live CD, mount the system on the hard disk (the live CD usually does it automatically), then edit the file /etc/shadow, removing the password:

enrico:$1$3AJfasjJFHa234dfh230:13343:0:99999:7:::

becomes:

enrico::13343:0:99999:7:::

You can edit the file because, in the live CD system, you can always become root. After you do this, reboot the system: you can log in without password, and set yourself a new password using the command passwd. Installing packages not on the CDs To get a package for installing when offline:

1. apt-get --print-uris install dnsmasq
2. Manually download the packages at the URLs that it gives you

Otherwise, apt-get --download-only install dnsmasq will download the package for you in /var/cache/apt/archives. You can install various previously downloaded debian packages with:

dpkg -i *.deb

Backups There are various ways:

• dump (for ext2/ext3 file systems) or xfsdump (for xfs file systems). Makes a low-level dump of the file system. It must be used for every different partition. It makes the most exact backup possible, including inode numbers. It can do full and incremental backups. To see the type of the filesystems, use 'mount' with no parameters. To restore: restore or xfsrestore.
• tar Filesystem independent. It can work accross partitions. It correctly backups permissions and hard links. It can do full and incremental backups. Example:

  tar lzcpf backup.tar.gz /home /var /etc /usr/local
  tar lzcpf root.tar.gz /
  

  To restore:

  tar zxpf backup.tar.gz
  

• faubackup Filesystem independent. Uses hard drive as backup storage. Always incremental. It cannot do compression. Unchanged files in new backups are just links to old backups, and do not occupy space. Any old backup can be deleted at any time without compromising the others. It can be used to provided a "yesterday's files" service to users (both locally and exported as a read-only samba share...). To restore, just copy the files from the backup area.
• amanda

  apt-get install amanda-client amanda-server
  

  It is a network backup system. It can do full and incremental backups. You can have a backup server which handles the storage and various backup clients that send the files to backup to the server. It takes some studying to set up. To restore: it has its own tool.

Some data requires exporting before backing it up:

• To save the list of installed packages and the answer to configuration questions:

  dpkg --get-selections > pkglist
  debconf-get-selections > pkgconfig
  

  To restore:

  dpkg --set-selections < list
  debconf-set-selections < pkgconfig
  apt-get dselect-upgrade
  

  If you do this, they you only need to backup /etc, /home, /usr/local, /var.
• To save the contents of a MySQL database:

  mysqldump name-of-database   gzip > name-of-database.dump.gz
  

  To restore:

  zcat name-of-database.dump.gz   mysql
  

You can schedule these dumps to be made one hour before the time you make backups. Scheduling tasks As a user:

crontab -e

As root: add a file in one of the /etc/cron.* directories. In cron. hourly,daily,weekly,monthly you put scripts. In the other directories you put crontab files (man 5 crontab). If the system is turned off during normal maintainance hours, you can do two things:

1. Change /etc/crontab to use different maintanance hours
2. Install anacron (it's installed by default in ubuntu)

For scheduling one-shot tasks, use at(1):

$ at 17:40
echo "Please tell Enrico that the lesson is finished"   mail efossnet@dream.edu.et
^D

When and how to automate

1. First, you manage to do it yourself
2. Then, you document it
3. Then, you automate it

Start at step 1 and go to 2 or 3 if/when you actually need it. (credits to sto@debian.org: he's the one from which I heard it for the first time, said so well). Interesting programs to schedule during maintanance

• rkhunter, chkrootkit
• checksecurity
• debsecan
• tiger

Important keys to know in a Unix terminal These are special keys that work on Unix terminals:

• ^C: interrupt (sends SIGTERM)
• ^\: interrupt (send SIGQUIT)
• ^D: end of input
• ^S: stop scrolling
• ^Q: resume scrolling

Therefore, if the terminal looks like it got stuck, try hitting ^Q. Problems we had today with postfix

• Problem: mail to efossnet@dream.edu.et is accepted only if sent locally. Reason:

  $ host -t mx dream.edu.et
  Host dream.edu.et not found: 3(NXDOMAIN)
  

  Solution: tell dnsmasq to handle a MX record also for dream.edu.et: mx-host=dream.edu.et,smtp.dream.edu.et,50
• The problem not solved with the previous solution. Reason: postfix was making complaints which mentioned localhost as a domain name. Solution: fixed by changing 'myhostname' in main.cf to something different than localhost. Note: solved by luck. Investigate why this happened.

Problems found yesterday and today

• there is no way to tell squid to use another proxy for SSL connections: it only does them directly
• if you want to configure evolution to get mail from /var/mail/user, you need to explicitly enter the path. It would be trivially easier if evolution presented a good default, since it's easy to compute. It would also be useful if below the "Path" entry there were some text telling what path is being requested: the mail spool? the evolution mail storage?
• In Evolution: IMAP or IMAPv4r1? What is the difference? Why should I care?
• apt-get --print-uris doesn't print the URIs if the package is in the local cache, and there seems to be no way to have it do it.
• in /etc/apache2/sites-available/default, is the NameVirtualHost * directive appropriate there? It gets in the way when using 'default' as a template for new sites. Otherwise, one can add a new (disabled) site that can be used as a template for new sites instead of default.
• the default comments put by crontab -e are not that easy to read.

I recently blathered on about how much I love the A9 toolbar. So imagine my happy surprise when I found Alexadex.com, a fantasy stock market game in which the prices of domains are keyed to their Alexa "reach per million" numbers. For example, prodromou.name on Alexadex is priced at $4. I think this is pretty cool, but as I go twiddling around the site, I can't help wonder: don't we already have a fantasy stock market for domain names? (And, yes, that is a referral URL up there... I get $1000 pretend dollars for everyone who signs up for Alexadex with my referral number.) tags: alexa alexadex domain names fantasy stock market

Have you noticed, that most of the web 2.0 "sites" aren't really worth being called "web 2.0"? Take for example friendster. Many people say that friendster is a web 2.0 thing. Sure, it's using Ajax. But apart from that? Where's the open API? Where is remixing? What is it really different from, lets say, geocities with the addition of some easier linking and search functionality (read: "social networking") And seriously, the profile pages there suck just as bad as the homepages people made with geocities. Especially social networking pages tend to sit on their data and keep it closed. No FOAF files available. That's so web 1.0ish... the web 2.0 is a lot about APIs and open data access. Can you imagine a blogging service not offering syndication (e.g. RSS)? So why a social networking without FOAF? One of the few "true web 2.0 services" remains Google Maps. Even though it doesn't have tag clouds or social networking. ;-) But Mashups adding all that. We should rename the term to "Web 2.0 beta" anyway. It's not released yet. Or use the proper term for it: "DotCom 2.0" Or we should just stop using it, because it's all marketing buzz. Talk about open APIs, remixing, mashups, semantic web, syndication, tagging instead. [Update: web 2.0 is officially just "beta" - see for yourself. It ain't a true web2.0 logo if it doesn't contain "beta"... - also check out this huge list of web 2.0 logo mockups for known brands, including FedExr, McDndld's and of course S.NY beta...]

I am not happy with dh_pthon in the current state that it was (NMUed into) debhelper. It is preventing me from feeling good about or generally maintaining debhelper. This is a plan for fixing that.

1. Transform dh_python into a perl module or program by some other name and possibly different interface, and put this in some other package(s).
2. Modify dh_pysupport and dh_pycentral to call above so they take over dh_python's part of the work.
3. Reduce dh_python to a no-op warning script and put on deprecation track for removal.
4. Add a regression test to debhelper that fails if any debhelper script exceeds 150 lines, excluding POD docs. (Done in svn)
5. If at any point the python maintainers find an approach that does not invole multiple competing implementations and that is either simple or has the complexity encapsulated into some other program, I can add back a dh_python. Until then the current mess will be Not My Problem.
6. Be much, much, much more cautious accepting niche programs into debhelper in the future. :-(

Possible technical complications:

• dh_pthon supports params for passing additional module directories. dh_pysupport does too, but it seems that dh_pycentral does not. Need to check if this means that noone using dh_pycentral can use it with non-standard directories, so none of them pass directories to dh_python.
• dh_python has -V and -X flags that affect its behavior and the other two programs would not have access to this information.
  • I doubt that -X is used widely. Grep.
  • -V is a redundant interface, since it does something approximating what debian/pyversons does. So things should be able to switch to the other interface, except in edge cases (although IMHO it's not an appropriate interface for a debhelper program), and for the edge cases, -V could be added to the other two programs.
• It's possible that someone might set dh_python's -n flag but not also set it on their call to dh_pycentral or dh_pysupport. Can't imagine why though.
• Not all packages use the new python policy yet. For example, debconf doesn't. I'm not sure if that's a bug or not. One alternative would be reverting dh_python to the pre-NMU version (plus a small shim to make it a no-op if it detects the new policy), to avoid breaking such packages until they transition.

Today was the first time I clicked on these buttons in Amazon that allow you to look at a few pages of a book. That is some Ajax application (which of course warned me first with some fancy schmancy Ajax popup, fading the window etc. that they only support Firefox, IE etc., ignoring the fact that Epiphanys rendering engine is, well, the same as Firefoxs'. I actually clicked the Ok button twice before it finally closed...) Anyway, what I want to share with you is a screenshot of some malfunction: So apparently they scanned the page word-by-word; often clipping the lower part (notice the missing parts of the p, g, y letters in most words). Some words have gone missing altogether (before "life"). However, the page appears to be a Jpeg image; you can see some compression artifacts around the words that are not my fault (you might need to zoom the image). So it seems like they disassemble the pages when scanning, then reassemble them to present them to the user. Sometimes messing up the background color, like in this example... interesting. Is there much data storage to be saved by merging word images and storing them only once? Are they reassembled on-demand?

When I was young, about 1992, I played through Wolfenstein 3D. It was great fun. When DOOM came out later, however, I found it to be boring. It was a better game than the Wolfenstein one, but not so much better that I wanted to spend time on it. I never even looked at Quake, or any of the numerous newer games released since. Partly this was because I had converted completely to Linux, and most of the games didn't work on it. Partly, however, I didn't really care, since my favorite games were C and Python. I have friends who play a lot, though. I even know a game design professional, Ville. Recently I asked him to to show me a good selection of games, primarily first person shooters. I saw, and played, Quake 2, Quake 4, Far cry, and Halo. They were all quite impressive, and pretty enjoyable, with Ville giving me advice all the time. Since Quake 2 works on Linux these days, I bought the CD-ROM and installed it. Unfortunately, it doesn't work on my laptop. It doesn't make any sounds at all, and sounds are fairly important for the game play. It does work on my desktop machine, so I've played it with that, despite the mouse trouble I have: my optical mouse seems to be incompatible with fast paced game playing, or possibly it is the surface of my coffee table. Either way, occasionally (and usually during a fight) the character starts looking straigh up at the ceiling and rotating along the vertical axis several times a second. It takes a couple of seconds to fix this. Not very good for survival. I'd fix it by trying a new mouse or getting a mouse pad, but I'm not sure I enjoy a first person shooter game enough to spend any effort on that. I've now played Quake 2 for a number of hours, and died a dozen times I think, without advancing very far. As long as I can spend time lazily shooting at alien monsters, I'm happy, but running around in mazes or figuring out which magic buttons to press in which order (after running through the maze to find them), has begun to bore me already. The fact that I find the quick pace of game play during close combat more frustrating than rewarding isn't helping. I will probably occasionally return to Quake 2, because the immersion in a glorious 3D world is so enticing, but I probably won't ever become enthusiastic. There's other kinds of games, of course. Foobillard, for example, gives much of the same kind of "wow, it's like the real world" experience to me than Quake 2, but I can take my time aiming before shooting. Also, of course, billiards balls don't shoot back. Unfortunately, I had to purge foobillard from my machine because it is too much fun, and I'd start a game (or a series of games) every time I had to wait for a compilation. One minute of fixing code and starting make, fifteen minutes of playing billiards, is not a good formula for productivity.

To hell with all this warm weather. Begin this week my thesis supervisor got back from the States, so I've been getting a much-needed kick under the backside. My thesis is improving with leaps and bounds, and although I've got a lot of work left I've also got a renewed sense of direction. I should find a few minutes somewhere to document, package and upload my python GA-toolkit code, it's becoming pretty neat and allows easy linking of GA's together. Optimizing algorithms sounds boring, and it is, but 'parameter calibration using meta-evolutionary algorithms' has a nice ring to it. In other news, Erich too has given me a much-needed kick regarding the Debtags AI SoC project. I've modified the old ai-tagger to also include the directories each debian package contains: The results are interesting to say the least. Take for example kde-i18n-zhtw in the tagdb changes webinterface. It clearly should get the culture::chinese tag, as it's the KDE Chinese i18n package for crying out loud. Yet, the old tagger gives it a mere 0.0003. Not good. The new tagger? 0.99004. Remarkable what a little bit of extra meta-data can do...

On #debian-games we were discussing today how opaque cdbs is for those who aren’t intimately acquainted with its inner workings. I want to be able to easily see, at least at the level of detail visible in a purely debhelper-based rules file, what’s going on inside just by running make itself, e.g.

debian/rules -p   grep -v ^#   grep -B1 dh_

Here’s a small excerpt of the output when run on ri-li:

binary-install/ri-li::
        dh_installdocs -p$(cdbs_curpkg) $(DEB_INSTALL_DOCS_ALL) $(DEB_INSTALL_DOCS_$(cdbs_curpkg)) 
        dh_installexamples -p$(cdbs_curpkg) $(DEB_INSTALL_EXAMPLES_$(cdbs_curpkg))
        dh_installman -p$(cdbs_curpkg) $(DEB_INSTALL_MANPAGES_$(cdbs_curpkg)) 
        dh_installinfo -p$(cdbs_curpkg) $(DEB_INSTALL_INFO_$(cdbs_curpkg)) 
        dh_installmenu -p$(cdbs_curpkg) $(DEB_DH_INSTALL_MENU_ARGS)
        dh_installcron -p$(cdbs_curpkg) $(DEB_DH_INSTALL_CRON_ARGS)
...

OK, it’s a bit crude and misses a lot of interesting details, but it is a starting point that can be tweaked to zero in on whatever parts interest you.

Hey, I'm sure you're wondering what DeFuBu is, aren't you? That's the Debian Funniest Bug contest! This is a new monthly contest which consists to choose the more fun bug. How to win? Simply drop me an email with the bug number. I will maintain a list of candidats. Then, a selected and feed jury will choose the best of them.
If the bug you reported win, you and the reporter will win something like your weight in Ubuntu CD or the right to write my new book, Debian for dummies. For example, I give you a bug reported by Florent Bayle, #355455, which the first candidate for July. PS: Please note that I do this for fun, not for raising personnal attacks ;-) PS2: This challenge has been renamed to DeFuBu to avoid some misunderstanding on its leitmotiv.

This afternoon I started looking at cfengine. In very little time, I've already set up rules that can bring a system from pretty much cdebootstrap state up to a minimal production system in our environment. I've still got a little ways to go, but it's already hacking on /etc/hosts, hosts.deny, sources.list, installing appropriate Debian packages for our systems, etc.

It's come a long way since I last looked at it six years ago.

One thing I can't figure out...

I have a /etc/bacula/bacula-fd.conf file that contains, among other things, this:

Director  

  Name = backup-dir

  Password = "foo"

 



Director  

  Name = backup-mon

  Password = "bar"

  Monitor = yes

 

I can't figure out how to make cfengine delete just that second section. I tried this:

       BeginGroupIfLineMatching "  name = .+-mon"

         IncrementPointer "-1"

         DeleteToLineMatching "\ "

         DeleteNLines "1"

       EndGroup

But it seems that the pointer is never actually being decremented, even when examined under verbose mode. That is, it leaves the leading "Director " line in the file.

I have an important decision to make about moreutils, my collection of new unix tools. The question is whether to stand firm behind the idea of only adding tools to moreutils that are truely unique and not available in similar form in other packages, or whether to collect good tools to fill in missing gaps in the standard unix toolset, even if they are similar to already existing, but possibly hard to find tools. So far I've had an easy time deciding to reject some tools like add, todist and tostats, which are somewhat special purpose and which turn out to already be mostly implemented in the numutils package. And I'm also fairly comfortable with Lars's and my decision to not include mime, which is similar to File::MimeInfo's mimetype program, if only because implementing that requires a lot of code or a long dependency chain. The decision is harder for things like shuffle/unsort, which both fill in the gap of a file randomisation tool. There already are packages in Debian (bogosort and randomise-lines) that provide this functionality. Another example is srename, which is similar to the rename program hidden in perl, which is insanely useful and rather underused. It's also tricky since I could well be missing existing tools that overlap with moreutils. For example I just learned of the renameutils package, which contains a qmv. That is close to the same thing as vidir, although limited to filename removals (no deletions), and rather more complex, with an interactive command line mode. I've decided that it's worth keeping vidir despite this, if only for the delation support and the possible broader scope later, but it does point to a more general issue. I've already concluded earlier that:

Maybe the problem isn't that no-one is writing them, or that the unix toolspace is covered except for specialised tools, but that the most basic tools fall through the cracks and are never noticed by people who could benefit from them.

One way that tools fall between the cracks, after all, is by being spread amoung lots of little obscure packages like File::MimeInfo, bogosort, randomise-lines, odd corners of perl, mmv, renameutils, etc. You might know about some of these packages, but you probably didn't know about all of them -- I know I didn't. I suspect that the authors of some of them didn't know about others and duplicated work. A single package that collected good generic, consistent, and simple implementations of tools, even if some of them were not unique to it, could benefit from getting more attention than lots of small packages like those, and both help users find out about these tools as well as focus development energy on them to make them better. So which is more important, focusing on collecting and writing unique tools or promoting slightly less unique tools?

After some iteration, I now have a full build of GNU Radio from CVS running on Debian with 2.6.8.1 kernel on my HP tc1100 tablet, including the SSRP firmware, utilities, and examples. And it all seems to work! Here's a window dump of my first FFT with a signal generator feeding an unmodulated 1 Mhz carrier into the board. And here's a picture of the test setup after I dialed the generator up to 2 Mhz.

In a recent work-related conversation, Matthew Wilcox pointed out that EFI partitions are mountable on Linux and many distributions keep ia64 system partitions mounted at /boot/efi by default, but Debian does not. Since that behavior is mostly my fault, I recounted the history by way of explaining why it worked that way... and on suggestion from Martin Pool am repeating it here to document all this for posterity. When we were making ia64 bootstrap decisions, the default bootloader on i386 was lilo, and the closest example to what we needed for ia64 in Debian was powerpc. This is because systems using EFI only understand FAT partitions by default, and thus need a FAT partition somewhere that the firmware can read from... often the first partition on the first disk. The Debian model for handling such things at the time seemed to be to craft a command to hook from kernel package postinst scripts that did the heavy lifting in association with a config file. What went on behind the curtain wasn't something to bother the user with on an average day if you could avoid it cleanly. Some bootloaders know how to read a config file from /boot directly, and we started out thinking we'd use elilo that way, but it was hard to match up paths/naming in EFI to what they would look like under Linux. It was also clear to me that most ia64 systems were going to have large system partitions so there'd be plenty of space. So we punted and copy the elilo executable, config file, and any kernels or initrd files referenced in the config to the system partition. I also thought the default location other distributions had chosen for mounting the EFI partition once the kernel was up, /boot/efi, was pretty ugly, but I couldn't think of anything better. The problem is that the standard says you need an \efi\"whatever" directory as the root of your content in the system partition, so mounting the partition at /boot/efi yields paths like /boot/efi/efi/debian. Some distributions didn't adhere to the standard at first, and so didn't see the ugliness until they started to comply... but I was on a team at HP making disk partitioning and content decisions that caused me to be very aware of these details. Putting that all together, I decided there wasn't any point in having the EFI partition mounted by default... anyone who cared and wanted it mounted could just add a line to /etc/fstab to put it wherever they wanted. If I were doing it again today, I'd have an entry in /fstab marked noauto delivered during system installation. I haven't cared enough to tackle that change, though. Sadly, there's one detail of the current implementation that can get in the way of complete happiness. The Debian-specific 'elilo' script that runs in user space to manage the EFI boot partition contents based on the content of /etc/elilo.conf expects to have to mount the EFI partition, and exits with a complaint if the partition is already mounted. For typical users, this script only gets called during installation and from kernel package postinsts, and the actual elilo bootloader remains oblivious to all this. If other distros have picked up the Debian script, I'm not aware of it. So, you're no worse off mounting the EFI partition in Debian than with some other distro, you just get treated poorly if you try to use our elilo script while the partition is mounted. Clearly, we could handle this better. If someone wants to offer up a patch to the elilo script that asks the user if it's OK to scribble in the already-mounted partition instead of doing a mount / scribble / unmount cycle in the presence of an existing mount, I'll be happy to include it in the Debian elilo package. Meanwhile, a lot of us have switched from lilo to grub on our i386 systems, and I'd love for my ia64 systems to work more like my grub-equipped systems. But making a substantive change like teaching elilo to know where /boot is so that it can read a config file from there and do things more like grub, without symlinks, etc, has several issues. We'd need to get the right set of file systems supported from EFI/elilo, we'd need to address the naming issues, and we would require either user intervention on upgrade, or some clever automatic parsing and rewriting of the relevant config files. I can think of other things that would be more rewarding to work on, so don't anyone hold their breath...

About a month ago or so, I joined in a discussion on the debian-boot and pkg-exim4-devel mailinglists about the current Exim (v4) configuration schemes. To keep you from having to google for that discussion, I'll quickly summarize my opinion on the subject of the exim4 configuration scheme in Debian: I think it sucks. I've been a rather fanatic (ish) exim user since about two months after I became a Debian Developer. Initially, I removed it to replace it with sendmail. But that was a bad idea, and I quickly found out why. However, I never liked the exim 3 configuration script, since I never could get it to do what I wanted; and, according to the exim 4 maintainer (and to anyone who compares both schemes), the current exim 4 configuration system is just a rehash of the exim 3 configuration system; not much more. But it's so backwards. The initial question which exim4-config asks you may have been relevant in the time the initial exim 3 config script was written, but it is so totally outdated in a modern Internet. As a result, my current modus operandi when I install a new box is to get out of the exim4 config system as soon as I can, to gunzip /usr/share/doc/exim4-config/examples/example.conf.gz to /etc/exim4/exim4.conf, and to open the file in a text editor. At least I know that works, the way I want it. No hard feelings, Marc (but you knew that already). Personally, I had different ideas about what an efficient question would be, and I posted those to the mailinglist (you will have to google for those if you want them, though :-). I also promised to come up with some code to implement my ideas. This has proven to be... interesting. Currently, I have a config script that does a few questions and then switches to "Not Yet Implemented" mode. As in: it displays a debconf template of "Type: error" that basically says "This part still has to be implemented". For the postinst script, I wanted to base myself on the existing postinst script. That does not seem to be a very good idea, however; the existing postinst script contains a lot of upgrade cruft. And then I still have to write my update-exim4.conf. Looks like I took on a job which turns out to be larger than expected... Oh well, I guess I'll cope. It'll just take a bit longer than I wanted it to.

ScatterChat is a new cross-platform IM client announced by the Cult of the Dead Cow / Hacktivismo (during the HOPE conference, it seems). From the website:

ScatterChat is a HACKTIVIST WEAPON designed to allow non-technical human rights activists and political dissidents to communicate securely and anonymously while operating in hostile territory. It is also useful in corporate settings, or in other situations where privacy is desired. It is a secure instant messaging client (based upon the Gaim software) that provides end-to-end encryption, integrated onion-routing with Tor, secure file transfers, and easy-to-read documentation. Its security features include resiliency against partial compromise through perfect forward secrecy, immunity from replay attacks, and limited resistance to traffic analysis... all reinforced through a pro-actively secure design.

So the client is a "friendly-fork" of Gaim, it uses Tor to achieve anonymity, and for the crypto parts (secure messaging, secure file transfer) ScatterChat uses libgcrypt. It's a cross-platform application available for Linux, Windows; support for other OSes is planned (Mac OS X, others). You can always download the source code, of course, as it's free software. Actually, not quite. While ScatterChat itself is based on the GPL'd Gaim, it has to be GPL'd, too. However, the scatterchat-module package, which seems to contain the crypto-parts, is licensed under a custom "Hacktivismo Enhanced-Source Software License Agreement" (HESSLA) right now, which is so horribly long I didn't even bother reading it. However, the README says:

I am open to the possibility of re-licensing parts of this library to GPL, BSD, public domain, or some other license. I cannot make any promises, but I will try to accomodate reasonable requests.

I'm going to do just that, email the author and ask him nicely to change the license to some sane, well-known free software license. If you feel similar, please let the author know (hint, hint). Depending on what the HESSLA really says, it might prevent ScatterChat from entering Debian, for example. I haven't yet tried to use the application, but it sure looks like it has a lot of potential. It also seems do most security-related things right:

• it doesn't try to reinvent/reimplement its own crypto primitives (which would be doomed to fail), but rather uses libgcrypt
• it has a documented crypto protocol
• it's free software, which is a major requirement (see Kerckhoffs' principle)
• it doesn't reinvent the wheel, but rather uses Tor for anonymity (for example)
• etc. etc.

Of course that's no guarantee that it's secure; I hope some crypto-gurus look over it soon. But at least they didn't make obvious stupid mistakes we've all seen in many other pieces of software. Anyways, I feel this is a real important project which will help lots of people (activists, political dissidents, normal people like me and you who value their privacy). Go check it out! (via Boing Boing)

Ah, the classic DBus performance issue has reared it's head on Planet Gnome again. I'll chip in my thoughts on this, as I've done a fair bit of profiling on a large user of DBus. When I first ported of EDS to DBus, it didn't perform as fast as the original ORBit implementation. However when I dug out OProfile I discovered that the main bottle necks were deep in EDS itself, and DBus although in the profiles, wasn't anywhere near the top. We spent a few months optimising EDS-DBus (there was some serious low-hanging fruit) and by the time we'd done the obvious optimisations, EDS-DBus was faster than upstream EDS for the typical usage (running a book view, which happens every time you search in Evolution). For some methods EDS-DBus was still slower than EDS, and getContacts() is a perfect example. This method takes a query, builds the set of contacts that match, and sends it back to the client in a single list (compared to book views that do the same thing incrementally, and provide future updates). When profiled you discover that libdbus and libc are the top offenders, taking almost 70% of the runtime. The benchmark was asking for all contacts, so EDS-DBus was sending a 150 contacts as vCards over the bus in a single list, which amounts to about 100Kb of data. Now, this gets copied when it enters the library, copied again as it enters the sockets to the bus, which then sends it into another socket to the client, which then makes a copy. These copies really hurt, and are one of the things that ORBit does better than DBus: it copies less frequently and has generally had more optimisation time. There are several ways of making it better.

• Those nice people at Collobara have batshit insane cunning plans for a SHM-based transport, instead of sockets. This would reduce the number of copies, but does introduce some, well, interesting locking fun.
• Almost half of the copies could be removed by creating a private connection between the client and the server, missing out the bus entirely. I plan on doing this for the book views as they are heavily used and the bottleneck is, again, the copies.
• Obviously, heavily profiling and optimising libdbus to remove any redundant copies would help. There may be cunning ways to avoid some of the copies for certain situations, and allowing those to happen in the GLib bindings would be useful.

In conclusion, the DBus vs ORBit performance issue isn't a real one generally. It's a rare case where the cost of the transport is the bottleneck (generally only in fake benchmarks), and when the transport is the bottleneck, there are generally other ways of optimising the code: as Havoc says DBus makes doing true asynchronous method calls trivial, and if you are sending huge amounts of data down the bus a private connection should be used (which will also make you a nicer citizen on the bus, as sending huge messages will clog up the tubes). NP: Kind Of Blue, Miles Davis

Summary: Think, Bike, Dance. Best grade in final exam for my previous six years of life. Biked 20 km in 50 minutes in city after-work traffic. Partied 9:30 hours, dancing most of that. Biked 20 km back, in 55 minutes.

• 7:00 wake up, having slept too little after having IRCed for too long
• 7:30 enjoy reading the morning newspaper
• 10:30 final oral exam for my studies. Programming paradigms, object oriented software development, UML, OCL, XML, CSS, XSLT, XQuery, techniques of logic programming, Prolog. Grade: 1.0 (best possible grade)
• 12:00 lunch with collegues
• 13:00 rest up. buy some hard to find lindy hop dancing CDs
• 15:00 return home by train
• 18:15 leave for an invitation-only-all-inclusive party. by bicycle.
• 19:05 arrival at the club, 20 km in 50 minutes having crossed most of munich. New personal record for this route.
• ... food, cocktails, dancing, more cocktails, more dancing ...
• 04:30 notice that you're the "last man standing" (i.e. dancing) and decide to leave, too.
• Bike back in 55 minutes, new personal record for this direction, too.
• Enjoy the sunrise for another sunny hot day, take a shower, go to bed.