The new roaming workstation profile in Debian Edu/Squeeze is fairly similar to the laptop setup am I working on using Ubuntu for the University of Oslo, and just for the heck of it, I tested today how hard it would be to integrate that profile into the university infrastructure. In this case, it is the university LDAP server, Active Directory Kerberos server and SMB mounting from the Netapp file servers. I was pleasantly surprised that the only three files needed to be changed (/etc/sssd/sssd.conf, /etc/ldap.conf and /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working. Most of the changes were to get the client to use the university LDAP for NSS and Kerberos server for PAM, but one was to change a hard coded DNS domain name in the mklocaluser hook from .intern to .uio.no. This testing was so encouraging, that I went ahead and adjusted the Debian Edu scripts and setup in subversion to centralise the roaming workstation setup a bit more and avoid the hardcoded DNS domain name, so that when I test this tomorrow, I expect to get away with modifying only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the university servers. My goal is to get the clients to have no hardcoded settings and fetch all their initial setup during installation and first boot, to allow them to be inserted also into environments where the default setup in Debian Edu has been changed or as with the university, where the environment is different but provides the protocols Debian Edu uses.

This evening I arrived at the LUV [1] meeting half an hour before it started. I was one of about a dozen people sitting in the room waiting, some of us had laptops and were reading email but others just sat quietly the venue is sometimes open as much as an hour before the event starts and in bad weather some people arrive early because it s more comfortable than anywhere else that they might hang out. So I went to the front and suggested that instead of just doing nothing we get some short talks about random Linux things to fill the time. This seems to be a good opportunity for people to practice their public speaking skills, share things that interest them with a small and friendly audience, and keep everyone else entertained. With some prompting a few members of the audience got up and spoke about Linux things that they were doing or had recently read about. They were all interesting and I learned a few things. I considered giving a talk myself (my plan B was to just speak for 15 minutes about random Linux stuff I m doing) but decided that it would be best if I just encouraged other people to give talks. I have suggested to the committee that we plan to do this in future and maybe have a mention of it on the web site to encourage people who are interested in such things (either speaking or listening) to attend early enough. I think that this concept has been demonstrated to work and should also work well in most other user group meetings of a suitable size. At LUV we typically have about 60 people attend the main meeting and maybe a dozen arrive really early so people who would be nervous about speaking to an audience of 60 may feel more comfortable. For a significantly larger group (where you have maybe 300 people attend the main meeting and 60 arrive early) the dynamic would be quite different, instead of having more nervous people give talks you might find that a membership of 300 gives a significant number of people who have enough confidence to give an impromptu short lecture to an audience of 60. As an aside the Connected Community Hackerspace [2] is having a meeting tonight to decide what to do about an office in a central Melbourne area. One of the many things that a Hackerspace can be used for is a meeting venue for lightning talks etc.

• [1] http://luv.asn.au/
• [2] http://groups.google.com/group/connected-community-hackerspace

Linux 2.6.35 has been a fairly interesting release from an ASoC point of view, with several notable framework enhancements:

• Support for keeping audio paths through the CODEC up during system suspend, primarily intended for use with devices where the Linux system is one of several independent systems running on the device and the other systems (like the cellular modem in a phone) can maintain useful audio paths even when the Linux system is inactive.
• Enhancements to the jack detection infrastructure, including the addition of notifiers on jack status changes (allowing better integration of physical jack detection with electronic methods) and snd_soc_dapm_force_enable_pin() (which allows DAPM managed supplies such as microphone biases to be forced on). For example, jack status change notifications can be used to enable microphone detection via bias current sense only when a microphone is physically present.
• Support for knot and continuous PCM rates in the core.
• SMDK6410 5.1 audio support, TI SDP4030 audio support, and basic support for playback on the 1133-EV1 PMIC module for Freescale i.MX31ADS systems (currently limited by the support for the SSI interface on the i.MX31).
• Support for DaVinci integrated voice CODECs, Philips UDA1345 CODEC, SuperH FSI2 interfaces, TI OMAP4, TWL6040 CODECs, WM9090 audio subsystem.

When I created my on-line photo album, we had the year 2001 and there was nothing wrong with publishing ones photos in the Internet. It has been almost ten years now, and things have changed. Privacy is an issue, especially when it also affects your friends and family. The problem
So I needed to find some protection. These were my requirements:

1. I only want to protect parts of the site, as there are some pictures that I intentionally share with the public. This selection should be possible down to the individual image.
2. The solution should work without any dynamic server component besides the web server itself. This rules out any self-written CGI scripts as well.
3. One password, given to all my friends etc., is not sufficient as it might leak to unintended audience.
4. I do not want my visitors to have to register and remember yet another username and password just for my site. I also do not want to manage this user database.
5. I do not want to have do large changes to the file structure of my photo album.

This rules out most common options, e.g. protection by a .htpasswd file. Requirements 3 and 4 point to a solution based on OpenID. With OpenID, my visitors can authenticate against a service they already use (Google, Yahoo, etc.), relieving me from the burden of maintaining a user database and them from having to remember a password. There is a mod_auth_openid module for the Apache webserver, and it is even distributed with Debian in the libapache2-mod-auth-openid package. So requirement 2 is fulfilled. The tricky part is: How do we achieve OpenID protection for some images, and not for others. The solution I first played around with selectively enabling or disabling mod_auth_openid based on <FileMatch> directives in the Apache configuration, but it was not elegant and would not scale well. I have more than 20.000 pictures to manage, and have already selected over 5000 pictures to be shown without protection. My solution is based on a partial copy of the whole directory tree that contains all public files. To save disk space, these are just symbolic links to the real file in the protected location. Some mod_rewrite magic then takes care of giving the user the impression that all files are in the same location. I set up a small example of my solution, which has this directory structure:

.:
drwxr-xr-x 2 root root 4096  2. Aug 12:03 images
lrwxrwxrwx 1 root root   18  1. Aug 12:05 index.html -> private/index.html
lrwxrwxrwx 1 root root   18  1. Aug 12:05 login.html -> private/login.html
drwxr-xr-x 3 root root 4096  2. Aug 12:03 private
./images:
lrwxrwxrwx 1 root root 33  2. Aug 12:00 pleaselogin.png -> ../private/images/pleaselogin.png
lrwxrwxrwx 1 root root 28  2. Aug 12:03 public.png -> ../private/images/public.png
./private:
drwxr-xr-x 2 root root 4096  2. Aug 12:00 images
-rw-r--r-- 1 root root  267  2. Aug 12:03 index.html
-rw-r--r-- 1 root root   94  2. Aug 12:01 loggedin.html
-rw-r--r-- 1 root root 2091  2. Aug 12:03 login.html
-rw-r--r-- 1 root root   10 18. Nov 2009  protected.html
./private/images:
-rw-r--r-- 1 root root 4074  2. Aug 11:58 pleaselogin.png
-rw-r--r-- 1 root root 2670  2. Aug 11:58 private.png
-rw-r--r-- 1 root root 2043  2. Aug 11:58 public.png

As you can see, real files only reside in private/, outside of that, only symbolic links exist. The apache configuration protects the private directory and blends it into the main directory:

   <directory /var/www/nomeata.de/openid-test>
        RewriteEngine On
        # Abuse the login page as an error image
        RewriteCond % QUERY_STRING  \.(png jpg)
        RewriteRule ^login.html$ /openid-test/images/pleaselogin.png
        # Ship private files, if they exist, unless public files exist
        RewriteCond  $1 !^private
        RewriteCond  /var/www/nomeata.de/openid-test/$1 !-f
        RewriteCond  /var/www/nomeata.de/openid-test/private/$1 -f
        RewriteRule  ^(.+)$ /openid-test/private/$1
   </directory>
   <directory /var/www/nomeata.de/openid-test/private>
        AuthOpenIDEnabled        On
        AuthOpenIDDBLocation     /var/lib/apache2/mod_auth_openid/mod_auth_openid.db
        AuthOpenIDLoginPage      /openid-test/login.html
        AuthOpenIDTrustRoot      http://nomeata.de
        AuthOpenIDCookiePath     /
        AuthOpenIDCookieLifespan 2592000
    </directory>

A special trick handles the login page for protected images: If the login page is requested and the referrer indicates that the user tried to access a .png or .jpg file, apache will instead ship an image containing an error message. For my photo album I have a small Perl script that, given a directory with a private/ directory therein and a list of rules in form of glob patterns, will symlink matching files and remove symlinks that are not allowed any more.
What s next? As you can see, this does not actually protect the content. It only requires the user to authenticate, then everything is visible. To select which OpenIDs are allowed to access which code, some bugs will have to be fixed in mod_auth_openid first. There was little activity there recently, I hope that the project is not dead.

Jacob and Oliver have enjoyed our recent train trip, and our stay, from Kansas to New York City for Debconf. All told, that s a 40-hour trip, including the layover in Chicago. When we got on the train, in the middle of the night as usual, Jacob couldn t stop chattering about how great , fun , and exciting it is. He told us about all the lots of great things on the train, the fact that we were on a night train , and generally couldn t stop chattering. For an hour. At 3:30AM. This was a typical sight from Jacob: It wasn t as relaxing as usual for Terah and me. Oliver is at the grabbing everything in sight stage. Which worked fine when Jacob was at the age, but with Jacob also along it was a bit more difficult to manage. I suspect that our next trip, when Oliver is a few months older, will go easier. A highlight for both boys, as usual, is the dining car. Oliver loves anything related to eating solid food it s still novel to him and Jacob loves anything relating to trains. What could go wrong? (Parents will probably identify the capability for two hyper-excited young boys to have plenty of things go wrong at a table in a restaurant here fortunately we didn t have anything go terribly wrong.) Oliver turned out to find the things outside the window to require intense concentration intense enough to stick out his tongue while he worked it all out. And Jacob, of course, wanted to get the wrapper off his straw by himself. Which he can do, but takes a minute. They also enjoyed the lounge car. We were in a sleeper room on both trains. That was nice, and when we needed to go explore , we could. Jacob s favorite part of the trip was when I folded down the upper bunk during the day for him to play. I pointed out that it was like a train treehouse. His face sure lit up. He loved that he had his own window up there to look out of. He climbed up the ladder, and after awhile of playing, said, Dad, would you like to play with me up here? Of course I would it always makes me happy when he asks if I want to play with him. As I was playing with him, I asked him if he was having fun in his train treehouse. He gave me a sweet smile, and said, Dad, this is the best place of ever! In Chicago, Jacob and I went outside and walked around. He enjoyed walking across the bridges over the canal by Union Station. I checked some work email when we got back, tried but failed to reach some local hams with my handheld, and then we got on the train for New York. The boys loved it too, and Jacob was very ready to be in New York when we got there. We got out at Penn Station which was, I think, pretty much what my mind had imagined of an underground station robbed of its former glory (especially having been in that part of Chicago Union Station). We found the connection to the 2 train uptown, bought some MetroCards for the subway, and got on. Jacob was very interested in the subway. He sat very, very still I thought he was scared but on asking him some questions, realized that he was just very interested and engrossed in it all. I had been trying out my HF antenna for my amateur radio setup a few days ago, and by some coincidence, kept making contact with people that grew up in New York. A guy from Fargo, ND a native of Brooklyn told me to make sure to get pretzels from a hot sauce vendor, Pastrami on rye or corned beef on rye from a Jewish deli (because they have the best meat), pizza from guys wearing red and white shirts, and don t be afraid of rats on the subway tracks, and that our boys will love to feed leftover bits of pretzels to pigeons and squirrels. He got so excited about NYC that he went on and on, saying, Man, you re making me hungry now. During times I m not at sessions at Debconf, we ve found some time to do some things as a family. We went to Grand Central Terminal, just to see it it is indeed still Grand. I knew there was a Jewish deli there, so I thought hey try out his advice. It was closed, and when I realized it was Saturday, I realized why. Oops. We hopped on another train to Brooklyn and checked out the New York Transit Museum, which is great and has a lot of exhibits about the history of the city s subway and bus systems. It s housed in a former subway station, and they have a lot of old subway cars down there dating back to 1905 most of which are open to go inside of. It s been nice to meet people at Debconf that I have only known via email or IRC. The organizers of this conference have done a fabulous job. I have every expectation that this will turn out to be the best conference I ve been to in at least 12 years this is my first Debconf. It doesn t skimp on the technical details, people are friendly, and there is a sense of common purpose. But just as important, while there is a set schedule, there is an easy way to add other ad-hoc sessions to the conference schedule. People can get together a group interested in a topic, and schedule an event about it for the next day very easily. I m quite impressed by that, and am looking forward to the virtualization discussion that grew out of a question to the mailing list. It was also neat to meet people that sort of knew our family from my blog posts. I had no idea that there were all that many people that actually read these things ;-) The Debconf kick-off was great. As I was walking across the campus of Columbia towards it, it was a nice temperature, with some light rain, and I heard bagpipes in the distance. Beautiful. And when I left after the evening sessions, I still heard bagpipes. So I went to check it out, and ran into Gabriella Coleman, one of the Debconf organizers and the person that gave the talk I just left on the way, with the same idea. The Columbia campus is beautiful and historic, and it is an excellent venue for the conference. New York is a great city and I m sure we ll be back. It is great to walk out of the hotel in the morning, buy a fresh peach or two from the street vendor 20 feet away, and then go buy a roll or two ($0.75 each) from the bakery down the street. I have been so missing rolls like that since we got back from Germany in March. These weren t quite like the German bakeries, but the closest I ve had to it. It is interesting to note how differently people from different places look at things. Terah has told several people how we live 6 miles from a town with 500 people in it, and people that stop to think about it realize how different it is from New York. It was a surprise to me to hear that some New Yorkers think of Columbia as country . It is beautifully landscaped, and feels different than the rest of the city. The numbers I ve seen suggest that a typical fall weekday has more people on the Columbia campus than in the entire county where we live. And that county is twice the size of New York City. That s not to say that there s anything wrong with New Yorkers thinking of it as country, any more than there is of me thinking of a town with 15,000 people as a pretty big town. It s a different perspective, and I enjoy different perspectives which is another thing I like about Debconf. There are so many people from all over the world there that different perspectives are inevitable.

This week, I am attending DebConf 10 at Columbia University in New York. The first day of DebConf is known as Debian Day. While most of DebConf is for the benefit of people involved in Debian itself, Debian Day is aimed at a wider audience, and invites the public to learn about, and interact with, the Debian project. These are the talks I attended. Debian Day Opening Plenary (Gabriella Coleman, Hans-Christoph Steiner) Hans-Christoph discussed Debian and free software from a big picture perspective: why software freedom matters, challenging the producer/consumer dichotomy, how the Debian ecosystem hangs together, and so on. Steps to adopting F/OSS in government (Andy Oram) Andy discussed FLOSS adoption in governments, drawing on examples from Peru, the city of Munich, the state of Massachusetts. He covered the reasons why this is valuable, the relationship between government transparency and software freedom, and practical advice for successful adoption and deployment. Pedagogical Freedom (panel, Jonah Bossewitch et al) The panelists discussed the use of technology in education, especially free software, some of the parallels between free software and education, and what these communities could learn from each other. This is a promising topic, though the perspectives seemed to be mostly from the education realm. There is much to be learned on both sides. Google Summer of Code 2010 at Debian (Obey Arthur Liu) This talk covered the student projects for this year s Summer of Code. Most of the students were in attendance, and presented their own work. They ranged from more specialized projects like the Hurd installer, to core infrastructure improvements like multi-arch in APT. Beyond Sharing: Open Source Design (Mushon Zer-Aviv) Mushon gave an excellent talk on open design. This is a subject I ve thought quite a bit about, and Asheesh validated many of my conclusions from a different angle. I ve added a new post to my todo list to go into more detail on this subject. Some points from his talk which resonated with me:

• When collaborating on code, everyone must reason with one collaborator: the computer. This forces a level playing field and a common encoding.
• Collaborating on other types of creative work is more difficult in part because of the differences encoding/decoding information between different individuals
• Making this easier for design work requires improving motivational factors and language as well as tools and processes
• Many design decisions are actually rational, and are compatible with a group consensus project. Too often, I hear that design can t be done collaboratively, citing too many cooks in the kitchen analogies, but I have never believed it.
• Mushon s own project, shiftspace.org, seems to be a browser-plugin-based system for collaboratively remixing web applications. I haven t looked at it yet.
• Leadership and openness are not mutually exclusive. This is another pet peeve of mine, and there are so many examples of open leadership in the free software community that I don t see how anyone can think otherwise.
• Mushon s presentation is available in revision control so that it can be freely used and improved

How Government can Foster Freedom in Technology (Hon. Gale Brewer) Councillor Brewer paid a visit to DebConf to tell us about the work she is doing on the city council to promote better government through technology. Brewer seems to be a strong advocate of open data, saying essentially that all government data should be public. She summarized a bill to mandate that New York City government data be public, shared in raw form using open standards, and kept up to date. It sounded like a very strong move which would encourage third party innovation around the data. She also discussed the need for greater access to computers and Internet connectivity, particularly in educational settings, and a desire to to have all public hearings and meetings shared online. Why is GNU/Linux Like a Player Piano? (Jon Anderson Hall, Esq.) Jon is a very engaging speaker. He drew parallels between the development of player pianos, reproducing pianos, reed organs, pipe organs and free software. He even tied in Hedi Lamarr s work which led to spread spectrum wireless technology. To be quite honest, I did not find that these analogies taught me much about either free software or player pianos, but nonetheless, I couldn t help but take an interest in what he was saying and how he presented it. DebConf Opening Plenary (Gabriella Coleman) Biella and company explained all the ins and outs of the event: where to go, what to do (and not do), and most importantly, whom to thank for all of it. Now in its 11th year, DebConf is an impressively well-run conference. I m looking forward to the rest of the week!

Hi! First, sorry not to have posted anything in the last two weeks! I was on vacation, and so, did less work on the project. But in no means it is dead, and development continues! First week of my vacation was (apart from resting, and vacation stuff) almost entirely dedicated to make my build environment work without internet access. Here, I was lucky to have made a complete debian/main mirror using reprepro before leaving! However, I had to fight a bit with debian-installer: first, for an unknown reason (if someone knows why, speak up!) it didn't search for the debian-installer section and I had to specify 'main/debian-installer' instead of 'main' in sources.list.udeb.local. Second, because I'm lazy, my reprepo repo isn't signed, and so, I had to pass some apt options to make when building d-i. After this first week, I've been able to work on uboot-installer, that you can find in pkg-fso/d-i.git. Originally written by my co-mentor Per, this package/script is meant to update the device's U-Boot env so it can boot Debian. It installs the uboot-envtools package, tries to read the U-Boot environment to make sure everything is ok, determines the new boot command, and shows/write it in the uboot env. When working on uboot env modification, I ran in a strange issue: I can read the env without problem using fwprintenv, modify it, and read it back, but U-Boot then fails, saying the environment is corrupted. In fact, this is because I've enabled CONFIGMTDNANDS3C2410_HWECC in config.s3c24xx, and it appears to cause invalid ECC values to be written on the flash. Switching it off solved the issue. Apart from that, I've made some minor modifications in the installation script, and I've (re)installed Debian countless times on my FR, and everything seems to work fine so far (although my kernel is non-installable at the moment because of version mismatch with what's in my repo). Building d-i for the FR So, you're welcome to test! Everything is available in the three (pkg-fso/d-i.git, pkg-fso/linux-2.6.git, and usbboot (hg)) repositories. You can rebuild the d-i image and packages the following way:

mkdir ~/incoming/
cd d-i.git/packages/
cd flash-kernel && debuild -uc -us && cd .. && mv *.*deb ~/incoming
cd base-installer && debuild -uc -us && cd .. && mv *.*deb ~/incoming
cd hw-detect && debuild -uc -us && cd .. && mv *.*deb ~/incoming
cd libdebian-installer && autoreconf -i -v && debuild -uc -us && cd .. && mv *.*deb ~/incoming
cd partman/partman-auto && debuild -uc -us && cd .. && mv *.*deb ~/incoming && cd ..
cd arch/armel/uboot-installer && debuild -uc -us && cd .. && mv *.*deb ~/incoming && cd ../..
# For some reason, I had to rebuild installation-locale too
cd installation-locale && debuild -uc -us && cd .. && mv *.*deb ~/incoming

Then, copy everything that is in ~/incoming to your repo. Alternatively, you can use localudebs and add the following lines to pkg-lists/netboot/network-console/armel/s3c24xx.cfg:

mmc-modules-$ kernel:Version 
mmc-core-modules-$ kernel:Version 
crc-modules-$ kernel:Version 
md-modules-$ kernel:Version 
ext2-modules-$ kernel:Version 
ext3-modules-$ kernel:Version 
flash-kernel-installer
base-installer
hw-detect
libdebian-installer4-udeb
partman-auto
uboot-installer
installation-locale
# For some reason, flash-kernel-installer brings live-installer in,
# disable it explicitly as we don't want it
live-installer -

Now that you have built every needed package, you can build the d-i image:

make clean_s3c24xx_network-console
# The SECOPTS thing is only needed if you are using an unsigned repository
make build_s3c24xx_network-console SECOPTS="--allow-unauthenticated"

Now, you can find the ready-to-use u-boot image in dest/s3c24xx/network-console/uImage-multi! There are a few differences between the pre-built image and the one you have generated. Those differences are: the kernel in use (2.6.32 for the pre-built image, 2.6.34 if you follow the steps above), the network config (192.168.42.202 for the pre-built image, 192.168.0.202 for your own), security (unauthenticated repositories are allowed in the pre-built image!), and uboot-installer (some changes are still staging on my local working copy). Testing d-i on your FR Beware, those images are only for testing (especially the pre-built one, which accepts unauthenticated repositories). It should not harm your device, but use with care anyway. Now that you have built your u-boot image multi (if you don't want to, you can use the pre-built one), you are welcome to follow the steps described in the How to Boot article. Now, follow the instructions that appears on the FR screen and you should be able to install Debian like you would on any machine. The equivalent of grub-installer is divided into two steps (the two are needed, but each provides bootable-system, yes, that's a bug): flash-kernel ("Make the system bootable") and uboot-installer ("Modify U-Boot environment on flash"). (Note: SSH password is "install") What's coming next/has to be done? I've just arrived at DebConf 10, and some intensive testing should be done here. Apart from that, there are quite a few things left to do (right now, or in a distant future):

• Merge uboot-installer into flash-kernel, or give it a life on its own
• Get changes merged into d-i
• Continue with upstreaming kernel changes (drivers and gta02 machine definition)
• Make a FSO task, investigate how to run nodm for a normal user
• Try to get a kernel working on HTC G1
• Resolve some bugs like #586427
• Work on MTD support for partman?
• g-i for the FR?

So for one day a few days ago, I wasn't Wouter Verhelst, Debian Developer, but rather the above. I'm not usually very much interested in doing touristy things, but then on the other hand I'm of the opinion that you can't really claim to have been somewhere if all you've seen is the inside of a certain specific university campus. So, well, touristy things. I took the subway to about 10 blocks away from the very south of Manhattan, and then walked. I passed by city hall and what used to be the world trade center, but there wasn't much to see there construction sites are the same everywhere in the world. I moved on to "the battery", the south tip of Manhattan, and had an... interesting look at the Statue of Liberty in the distance. I thought about going there, but the tickets were sold out, so scratch that. Instead, I walked on to the Brooklyn Bridge (passing by Wall Street on the way), spent some time looking for the pedestrian's entrance to that bridge (which was slightly harder than would've thought it to be), and walked partway up the bridge. I wasn't interested in crossing over to Brooklyn, but it's an interesting bridge to walk on, and I had an interesting time. When I left the bridge again, it started raining. I don't mind a few drips on a warm day like that day, but this was more than that, and it started to bother me. So, rather than walking to the Empire State building, as I'd been planning, I decided to take the subway there. This did mean I missed out on the SOHO area, which I would've liked to see, but well, you can't have it all. The Empire State building is something you grow up hearing about, and I'd seen pictures of it. It has a somewhat distinctive silhouette, shown on several comparative graphics of high-profile skyscrapers. But none of that is even close to the real thing. Not that it's higher than I expected; on the contrary. But it does look different; its color is much lighter than I thought, and the distinctive silhouette isn't as distinctive once you're standing right next to the building. But, well, going up the building clearly shows that it is the tallest building of New York. There are other skyscrapers, but most of those seem to be little dwarves in comparison. The view is nice, up there, and I took some interesting pictures. The tickets aren't very cheap ($20), but not insanely expensive either. I don't regret doing this. (in case you were wondering: yes, the above picture is in the point of view of the one above that, and vice versa) By that time it was around 4 pm already, and I thought about going back to the Columbia campus. As I checked out my map for the most efficient route, I found that it probably would've been easier to walk to Times Square and take the number 1 train there which stops right in front of Columbia (but below the surface, obviously). So since I was going to have to go there, I figured I could just visit Times Square while I was at it. I must say I'm not very impressed by it. For starters, Times Square isn't actually a square, at least not as I'm used to that word. Broadway and 7th avenue happen to cross at a, for Manhattan, uncharacteristically sharp angle, which results in more space between buildings than usual. But it's still fairly small as a "square". They've fenced off a part of that space and put a bunch of chairs and tables there. This would be a cosy and inviting, "gezellig" place, if not for the very audible noise of the traffic still going on all around it, and the fact that everywhere you see, there's three layers of brustling and visually noisy adverts. It could have been a relaxing oasis in the middle of the city, but instead it's just as busy as everywhere else in Manhattan. But then, I guess that's what New York City is all about. At any rate, after spending about half an hour or so there, I walked over to the subway to get back to the venue just in time for dinner. The end of a nice, touristy, day.

Over the last couple years, I have begun teaching. At first just a reading group or seminar with a handful of attendees. Last term I helped teach two large lecture classes. I know that, compared to some of my colleagues, I spend an enormous amount of time assessing and evaluating students' assignments. I try very hard to give detailed, substantive, feedback on each piece of student work. At the end of the day, however -- at my school at least -- there's always a grade. For someone who went well out of his way to go to a college with no grades, there's a tragic irony to the whole situation: I think grades mean little and are often worth much less. Today I am forced to to inflict them on people who, almost universally, do not.

After I finished an re-read my epic post describing my first day and a half at Debconf10 I suddenly realised that if I continue to describe the rest of 13 days here in such style and verbosity this would become a book, a boring one at that, so I decided to limit myself to 2 posts for Debcamp and then a post a day for the Debconf. But about the first half of the Debcamp week there are things that are as usual and there are things that are not. Let s start with the usual bits: more people arriving every day, evening parties are getting more and more fun and wild (or so people say) and the Internet and power at the hacklabs magically becomes more and more reliable day by day, the cabling mess grows organically trying to spread out evenly and not overload any individual socket, extension cords with non-local plugs appear and spread the load some more, people stress out, volunteer, crash out and repeat. All in all nothing can stop the freight train of few hundred Debian developers determined to have fun. With out own DFSG-free definition of fun. (But this year we appear to be running very close to the edge on volunteers if we run out of those, there will be a train-wreck, so please volunteer!) Now off to the unusual stuff. The City is well it is cool and very, very impressive. It is not terribly different to me at least I am used to such structure of the city: grid based layout of the downtown city (with some parks) and then branching out to separate, but different across-the-river districts and then sprawling out to slightly chaotic suburbs. Riga is very much like New York in the design. The difference is that New York is 10-20 times larger: the areas are 10 times larger, the buildings are 3-4 times higher on average, the streets are 2-3 times wider and yet have more traffic and there are far, far more shops, shows and restaurants. Also there is the subway. It is a great thing in that it hides the size of the city take a bus downtown once, to find out what I mean it takes ages to drive the distance that takes 20 minutes on the subway. I like this city, I am getting a feeling, that I could live here without much problem for me. So far I ve only had this feeling in Riga and Berlin. On the other hand this is USA. I ve so far only encountered one bad thing about it, but it is a pretty big one food. Basically all food that I ve tried so far in the USA has been crap. It was tasty salt, sugars and fat took care on my brain thinking it s food, but underneath that it was pretty crap: there was no texture, no content, no soul. The John Jay cafeteria where we are eating lunch and dinner is better than the most other options, because it is an all-you-can-eat buffet where you can choose your poison and it was also the place where I had the best piece of food in USA so far a slice of pepperoni pizza, that had a bit of taste behind the fat. Also, surprisingly, the fast food options (McDonalds, Burger King, ) are better than the equivalents in Europe, far better. In fact the fast food is cheap and in some cases tastes better than regular food, so there is no wonder why people might prefer it in some situations. So it is easy to see how people just accept shoving bland fast food or bland all-you-can-eat food into their mouths and not think much about it and thus become fat and put undue stress on their health. I expect the average weight of Debian developers to increase by 5 kg by the end of the conference. If you want to prove me wrong, running with bubulle would help you a lot with that. Events downtown. New York is a huge city with a lot of events going on every day, so everyone should be able to find something of interest for them. For me it was the free tickets for tapeings of The Daily Show and The Colbert Report. I got into both of those and for me The Colbert Report was by far the better experience. For one you can not get into Daily Show without a ticket (some tickets show up on the web site on the morning of the shoot around 11am), while 18 people from the stand-by list at Colbert Report got in. At The Daily Show you stand in a live line with ticket holders in one line and stand-by line separate. If you have tickets and arrive around 3pm you should be fine any later than that and you risk to be standing outside even with a ticket. You find that out around 4.30pm when they hand out physical tickets you have one, you get in. If not you might rush over to Colbert Report where a more humane system is used a staffer takes down your name and email on a numbered list and then you can walk around until 5.30pm then they let the ticket holders in and after that call the names of stand-by people that get in. The Colbert Report studio is brighter, more colourful and closer to the action, also it is very rare that cameras block the view from the audience (which is common on The Daily Show). It might have also been my luck when I got on the most boring The Daily Show episode I can remember, ever. The best joke was a woman asking John is she could get a ticket for her friend in August. The warm-up act and crowd control at The Colbert Report was also way better: Colbert staff was hyper, security was ever-present, warm-up was funnier and very engaging (he grilled me for several minutes and I replied making the audience laugh very hard explaining that Latvia was like India of Eastern Europe in regards to IT exports) and Colbert himself was very gracious talking to us out-of-character before the show for a good 10 minutes. Location, location, location. The talk rooms and event rooms and hacklabs are spread out across multiple buildings and there is a lot of other activities going on in those buildings besides Debconf, so moving between place might be confusing for the first day or two. Also the rooms are quite dark that might cause a noise problem for me and the video team as we ll have to up the sensitivity settings on our gear. The video team is working on fixing that by throwing a bit more light on to the speakers. Elevators are wicked fast, but can also be confusing, because the ground floor is on a different number for different buildings it can be G, 1 or even 4. Usually on campus there is a star next to the level with the exit. The dorms. I am in the Carman building and it looks like its interior has not been updated since it was built large ceramic bricks with very visible gaps (for the interior walls), raise-to-open windows, huge aircon fans that take up the whole bottom of the window, plumbing from the 60ies (at least). The security is weird on one hand you have to give your room card to the guard when entering the building, but on the other hand the room cleaning crew can simply forget to close your door after they are done. Like this Thursday I returned to the dorm just before lunch only to find the door of my room open. No one was around and nothing was missing, but it s still worrying. In any case I am steadily uploading photos from Debconf 10 to my Flickr page and new stuff should show up every day.

Don't get me wrong. We didn't freeze the development yet but we are freezing our developers! The air condition at the Columbia University in New York City is quite cold. Bring some warm clothes if you going to attend the DebConf that will start soon.

So an email went out to Debconf-announce with all this and MORE information but it is worth highlighting the talks/events as they are great. We look forward to having you in New York City! ********************************************************************************************************** exciting schedule highlights
- Have a look at the DebConf10 schedule,
there are a lot of really interesting things planned, both during Debian Day and DebConf
itself. We have a great line-up of speakers, and other events that are
sure to make this DebConf one to remember! A couple notable events that we wanted to highlight: Be sure to come to the DebConf Welcoming Plenary in the evening of Debian Day. This opening plenary will be the first thing that kicks
off DebConf and will be brief, important, and fun. General information
about DebConf, important logistical bits, and prizes(!) will be
had. Also, this gives you a chance to ask some questions before we get
started. Be there at 7:30pm in Davis Auditorium on August 1st! The much anticipated Cheese and Wine party will be happening in the
evening on the 2nd. This will be your chance to see what mixture of
fermented, cultured and alcoholic things your stomach can handle! Also exciting to mention is Eben Moglen who will be speaking on the
3rd during DebConf at 9:30am about Freedom and Privacy in the Cloud
and how we (yes us!) here at DebConf, can be the silver lining. If you
don t already know Eben Moglen
he is Professor of Law at Columbia Law School and founding Director of the Software Freedom Law
Center. Since 1993 he has served pro bono publico as General
Counsel of the Free Software Foundation. Moglen was part of Philip
Zimmermann s defense team when Zimmermann was being investigated over
the export of PGP. As counsel to the FSF, Moglen was charged with
enforcing the GNU General Public License (GPL) and later became
heavily involved with drafting version 3 of the GPL. Also in the evening of the 3rd at 7:30pm we will be treated to not
only a screening of the brilliant and beautiful and (award winning!)
film Sita Sings the Blues in
Pupin 301, but also a Q&A afterwards with the acclaimed animator Nina
Paley! She will describe how the process of making this film caused
her to question the wisdom of copyright monopolies in the arts. The
film is under a Creative Commons ShareAlike license, and her
distribution mechanism is unique as Paley consciously adopted the
methods of the free software movement to distribute the film. The
discussion with the artist after the screening will explain in depth
how and why, and discuss what Paley and QuestionCopyright.org are
doing next to encourage more artists to try the Free route. After the film, at 9:00PM the Columbia University Astronomy
Department will host a guided stargazing event, which includes use
of several different optical telescopes on their roof. There will be
astronomers on hand to answer any questions about the stars,
telescopes, or any other topics of scientific interest. There are many talks that are going to be exciting at Debian Day, even
for Debian Developers! One track will be showcasing general Free
Software themes and issues, and many of these talks will be really
interesting to Debian Developers, so be sure to check out the schedule and come On Debian Day we are excited to have the Honorable Gale Brewer speak at 4pm. She is part of the New York City Council and was the
former Chair of the Committee on Technology in Government, current
Chair on Committee on Governmental Operations and will discuss the
ways that government can foster freedom in technology. Its both
exciting and a privilege to have her speak at DebConf! day trip
This year, the day trip is going to be a blast, a crazy adventure at
the bizarre and fun Coney Island! Explore the historic RussianBrighton Beach! Ride the Cyclone rollercoaster, 82-years old this
year! Swim in the ocean! See the circus sideshow! Eat delicious food
or if unlucky, not so good food. Or do none of the above and just hang
out with your friends outside and have a good time. At the end of the day we are going to go to a unique cultural event:
the Brooklyn Cyclones baseball game where we will have the chance to
watch our beloved DPL humiliate himself as he throws out the first
pitch, in his Debian kilt! Don t like baseball, or sports? Don t worry, neither do we, but the point really isn t the baseball game,
the point is hanging out with all your closest Debian friends and
having a good laugh as Zack tries really hard not to trip, also a good
chance to experience some local culture and to relax after a hard day at the beach. free things in the city
There are an amazing number of free events happening in New York City during the summer! If you are looking for something to do, we ve
compiled a list of various events from a number of different locations
for you to easily view in one spot.

So an email went out to Debconf-announce with all this and MORE information but it is worth highlighting the talks/events as they are great. We look forward to having you in New York City! ********************************************************************************************************** exciting schedule highlights
- Have a look at the DebConf10 schedule,
there are a lot of really interesting things planned, both during Debian Day and DebConf
itself. We have a great line-up of speakers, and other events that are
sure to make this DebConf one to remember! A couple notable events that we wanted to highlight: Be sure to come to the DebConf Welcoming Plenary in the evening of Debian Day. This opening plenary will be the first thing that kicks
off DebConf and will be brief, important, and fun. General information
about DebConf, important logistical bits, and prizes(!) will be
had. Also, this gives you a chance to ask some questions before we get
started. Be there at 7:30pm in Davis Auditorium on August 1st! The much anticipated Cheese and Wine party will be happening in the
evening on the 2nd. This will be your chance to see what mixture of
fermented, cultured and alcoholic things your stomach can handle! Also exciting to mention is Eben Moglen who will be speaking on the
3rd during DebConf at 9:30am about Freedom and Privacy in the Cloud
and how we (yes us!) here at DebConf, can be the silver lining. If you
don t already know Eben Moglen
he is Professor of Law at Columbia Law School and founding Director of the Software Freedom Law
Center. Since 1993 he has served pro bono publico as General
Counsel of the Free Software Foundation. Moglen was part of Philip
Zimmermann s defense team when Zimmermann was being investigated over
the export of PGP. As counsel to the FSF, Moglen was charged with
enforcing the GNU General Public License (GPL) and later became
heavily involved with drafting version 3 of the GPL. Also in the evening of the 3rd at 7:30pm we will be treated to not
only a screening of the brilliant and beautiful and (award winning!)
film Sita Sings the Blues in
Pupin 301, but also a Q&A afterwards with the acclaimed animator Nina
Paley! She will describe how the process of making this film caused
her to question the wisdom of copyright monopolies in the arts. The
film is under a Creative Commons ShareAlike license, and her
distribution mechanism is unique as Paley consciously adopted the
methods of the free software movement to distribute the film. The
discussion with the artist after the screening will explain in depth
how and why, and discuss what Paley and QuestionCopyright.org are
doing next to encourage more artists to try the Free route. After the film, at 9:00PM the Columbia University Astronomy
Department will host a guided stargazing event, which includes use
of several different optical telescopes on their roof. There will be
astronomers on hand to answer any questions about the stars,
telescopes, or any other topics of scientific interest. There are many talks that are going to be exciting at Debian Day, even
for Debian Developers! One track will be showcasing general Free
Software themes and issues, and many of these talks will be really
interesting to Debian Developers, so be sure to check out the schedule and come On Debian Day we are excited to have the Honorable Gale Brewer speak at 4pm. She is part of the New York City Council and was the
former Chair of the Committee on Technology in Government, current
Chair on Committee on Governmental Operations and will discuss the
ways that government can foster freedom in technology. Its both
exciting and a privilege to have her speak at DebConf! day trip
This year, the day trip is going to be a blast, a crazy adventure at
the bizarre and fun Coney Island! Explore the historic RussianBrighton Beach! Ride the Cyclone rollercoaster, 82-years old this
year! Swim in the ocean! See the circus sideshow! Eat delicious food
or if unlucky, not so good food. Or do none of the above and just hang
out with your friends outside and have a good time. At the end of the day we are going to go to a unique cultural event:
the Brooklyn Cyclones baseball game where we will have the chance to
watch our beloved DPL humiliate himself as he throws out the first
pitch, in his Debian kilt! Don t like baseball, or sports? Don t worry, neither do we, but the point really isn t the baseball game,
the point is hanging out with all your closest Debian friends and
having a good laugh as Zack tries really hard not to trip, also a good
chance to experience some local culture and to relax after a hard day at the beach. free things in the city
There are an amazing number of free events happening in New York City during the summer! If you are looking for something to do, we ve
compiled a list of various events from a number of different locations
for you to easily view in one spot.

Here at DebConf10 the schedule is starting to get really packed of events, which is great! About a half of those events are BoFs (in the IETF sense), i.e. discussion sessions among people interested in specific topics. (Other conferences use "BoF" to refer to impromptu, non-scheduled, and spontaneous events, while at DebConf we have traditionally submitted, reviewed, and scheduled BoFs in advance.) As most DebConf regulars, I've attended quite some BoFs in the past and I share with others the impression that the quality and usefulness for the project of BoFs varies substantially from BoF to BoF. That's why I'd like to share a BoF recipe, which comes from possibly the best organized BoF I've ever attended. As it happens with all good recipes (and with free software), I've took the liberty of customizing it a bit.

---

DebConf BoF HOWTO have a coordinator A good BoF should have a coordinator, which is usually (but not necessarily) the person who proposed the BoF in the first place. The role of the coordinator encompasses at least 2 tasks: preparing the BoF in advance (read below) and moderating the discussion to ensure everybody get a chance to participate. prepare in advance A good BoF is more than just getting together, vaguely knowing the BoF topic, and ... discuss. Mind you, it might work very well that way too, but the chances of having a successful BoF are much higher if attendees arrive prepared. That is quite simple to achieve. It just takes the BoF coordinator to prepare some working questions and/or detailed discussion topics, and advertise them as such. That way potential participants can make up their minds, recall experiences that they want to share, note down comments they want to bring into the discussion, etc. In my experience, the BoF time will then be used in a much more productive, exciting, and ultimately fun way. Most BoFs can also benefit from a few introductory slides on the BoF topic, to ensure all participants start from a common ground. The last slide could contain a brief recap of the working questions, so that the audience have them handy. don't be exclusive Debian is not a company and Debian contributors are not employees, therefore we cannot expect all relevant people to attend a specific BoF, just if they had to. As usual, the risk of cutting off community members who cannot attend should be mitigated as much as possible. To that end, minutes are just great; after the BoF, minutes should be posted where appropriate, and possibly uploaded to Penta as event attachments. ... but taking minutes is just boring and not everyone is good at that (for instance, yours truly used to suck at taking minutes, even if I'm trying to get better ...). If you have a trusted participant which is good at taking minutes, great, go for it! If you don't, use collaboration. During past DebConfs as well as at UDS this year, I've been shown a nice way of doing that. It takes a dedicated projector in the BoF room showing some real-time, collaborative editing facility (e.g. gobby). With such a setup, people usually just start taking minutes collaboratively, although explicitly inviting the audience to do that is a very good idea. Ideally, the room should have two projectors, one for supporting slides, another for collaborative minutes taking. In case there is only one, as it is usually the case for DebConf, it's probably better to use it for minutes and switch to them as soon as supporting slides are over.

---

gobby.debian.net for BoF minutes at DebConf10 For DebConf10, the DebConf team has setup a gobby (infinote) server at gobby.debian.net. Just do the following in order to be ready for collaborative minutes taking:

    # apt-get install gobby-0.5
    $ gobby-0.5 -c gobby.debian.net

(Note: you shouldn't use the non versioned gobby package as it uses a different protocol and doesn't support undo, which is quite risky; see Debian bug #590753 for more background.) As the naming convention for DebConf10 minutes, using document names that start with dc10- sounds sensible.

---

comments welcome! So, what do you think of the above suggestions? Do you have further best practices to share on BoF organization at DebConf? Leave a comment or mail me. In the end it would be nice to author a proper "DebConf BoF HOWTO" document for further reference. Thanks to Gregor for his feedback on early versions of this post.

Processor       : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 799.53
Features        : swp half thumb fastmult vfp edsp thumbee neon vfpv3 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc08
CPU revision    : 5
Hardware        : Genesi Efika MX
Revision        : 51030
Serial          : 0000000000000000 
             total       used       free     shared    buffers     cached
Mem:        482740      44836     437904          0       4672      21104
-/+ buffers/cache:      19060     463680
Swap:            0          0          0
Bus 002 Device 002: ID 0b95:772a ASIX Electronics Corp. 
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 13d3:3273 IMC Networks 802.11 n/g/b Wireless LAN USB Mini-Card
Bus 001 Device 002: ID 1a40:0101 TERMINUS TECHNOLOGY INC. USB-2.0 4-Port HUB
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

This evening I was mulling over a recurring desire for a simple, scalable, and robust replication filesystem. These days there are several out there, including Gluster. For the past year I've personally been using chironfs for my replication needs - I have /shared mounted upon a number of machines and a write to it on any will be almost immediately reflected in the others. This evening, when mulling over a performance problem with Gluster I was suddenly struck by the idea "Hey, Redis is fast. Right? How hard could it be?". Although Redis is another one of those new-fangled key/value stores it has several other useful primitives, such as "SETS" and "LISTS". Imagine a filesystem which looks like this:

 /
 /srv
 /tmp
 /var/spool/tmp/

Couldn't we store those entries as members of a set? So we'd have:

  SET ENTRIES:/              -> srv, tmp, var
  SET ENTRIES:/var/spool     -> tmp
  SET ENTRIES:/var/spool/tmp -> (nil)

If you do that "readdir(path):" becomes merely "SMEMBERS entries:$path" ("SMEMBERS foo" being "members of the set named foo"). At this point you can add and remove directories with ease. The next step, given an entry in a directory "/tmp", called "bob", is working out the most important things:

• Is /tmp/bob a directory?
  • Read the key DIRECTORIES:/tmp/bob - if that contains a value it is.
• What is the owner of /tmp/bob?
  • Read the key FILES:/tmp/bob:UID.
• If this is a file what is the size? What are the contents?
  • Read the key FILES:/tmp/bob:size for the size.
  • Read the key FILES:/tmp/bob:data for the contents.

So with a little creative thought you end up with a filesystem which is entirely stored in Redis. At this point you're thinking "Oooh shiny. Fast and shiny". But then you think "Redis has built in replication support..." Not bad. My code is a little rough and ready, using libfus2 & the hiredis C API for Redis. If there's interest I'll share it somewhere. It should be noted that currently there are two limitations with Redis:

• All data must fit inside RAM.
• Master<->Slave replication is trivial, and is the only kind of replication you get.

In real terms the second limitation is the killer. You could connect to the Redis server on HostA from many locations - so you get a true replicated server. Given that the binary protocol is simple this might actually be practical in the real-world. My testing so far seems "fine", but I'll need to stress it some more to be sure. Alternatively you could bind the filesystem to the redis server running upon localhost on multiple machines - one redis server would be the master, and the rest would be slaves. That gives you a filesystem which is read-only on all but one host, but if that master host is updated the slaves see it "immediately". (Does that setup even have a name? I'm thinking of master-write, slave-read, and that gets cumbersome.) ObQuote: Please, please, please drive faster! -- Wanted

I had planned long for this Debconf and with the experience from the previous times I did all I could to reach one goal minimise stress. I think I got it right this time. First of all I got my company (Accenture) pay for the whole thing, so I did not have to worry about sponsorship queue (but instead I must gather and deliver them back some knowledge gained from the conference should be easy). I also managed to get a direct flight there is a weekly flight Tashkent-Riga-New York on Sundays and I got a ticket for that both ways. This took many hours off the travel time and reduced the stress a ton. Then I also did all the prudent travelling things: mostly reading the New York page on Wikitravel. This told me (among other things) what metro line to take to get the best view of the city. And for luggage I took a backpack (for the laptop and walking around) and a roller (for the clothes). I learned a lot from the Up in the air movie, it really teaches one how to take stress out of travel. This went very well in the beginning I took a bus to the airport early, checked in, breezed trough security and then waited and waited. The boarding only started half an hour after we were scheduled to depart. But I can not complain, because the flight attendant called my name (among a few others) just before boarding and changed my ticket I was bumped up to business class . It has been many years since I ve flown a regular (non-budget) airline and now first time ever in the business class! We got regular class meals, but at least we got to sit in the big chairs with lots of leg room. It was great! I bought a paper book (from Charles Stross) to read during the flight, because that is the only thing you can do during take-off and landing and I had some stuff to listen to in my iPhone. I tried sleeping and I think I managed to kill a couple hours that way too. It sure helped combat jet lag later on. When I arrived, I had my immigration and customs forms filled out. Latvia is on the USA Visa Waiver program, so I just had to fill out a form online prior to the trip to get a permission to enter USA. I only had one printout of the Waiver confirmation page and my airline took that before giving me a boarding pass, so I had no paper copy to give to the guy at the USA border, but he did not even ask for it he only took the two forms I filled out, scanned my passport, took my fingerprints (all fingers) and a photo. Then he gave me back the customs for (stamped) and I could go get my luggage. After that it was just a matter of walking trough customs and giving the customs official the pre-filled and stamped customs form. I was not stopped further. The AirTrain was a bit confusing you just get on the AirTrain and go where you need to go, you actually pay at the place where AirTrain connects to metro, so when you are coming from the airport you are actually paying ($5) when you are exiting the AirTrain system. There are plenty of AirTrain people that will give you an AirTrain ticked for $5 cash right there or you can use a machine to get it (where you can also pay with a card). The machines also take AmEx, but you must know the PIN code, if your don t know the PIN of you AmEx card (like I don t know the PIN of my corporate AmEx) you can only buy MetroCards at news stands, but there you will not find the unlimited ride tickets only 5 or 10 ride tickets are available. Next I screwed up a bit and thus got a bit lost in the New York metro system. The Wikitravel recommends to take the AirTrain to Jamaica station and from there take J or Z line into the city for the best views. I went to Jamaica and got into the first metro train that came on to the platform. Unfortunately, that was the E line train and it does not cross with J or Z lines after that, so I was stuck. To complicate the situation E line is under repair, so after a few stops the trains diverted to the F line and I had to scramble to figure out where to get out to get to the 1 line where Columbia University is. I ended up spending more than an hour in the metro, but I got there in the end. So I emerge from the 116th street metro station directly in front of the campus entrance gate and it starts raining. A thunderstorm swept across New York as soon as I stepped outside the metro station, so I took shelter a the side of the building. It kept raining. After a few minutes decided that I don t want to wait any more, so I put all my electronics into my backpack and went towards the dorm where my room was. The rain was warm, people around me were playing and running around in the wet grass, it was fun. The guard showed me where to go to check in. It was really simple sign here, here is you magnetic stripe key, have fun. And the room was just as spartan bed, desk, chair, closet, bathroom and a large fan under the window. The first night I did not know that I could actually turn that fan down, so I slept to the sound of full fan blasting, much like on the airplane. The dorm looks ancient it looks like it was build in the 60s and never changed since then. I mean, I ve lived in worse places, but people would at least change wall sockets or faucets or ceiling paint every other decade or so. The newest things here were the magnetic locks on the doors and a TV and a mini fridge in the hallway. After dropping my things I went off to the Mudd building across the campus to check in with people in the hacklab. It was just starting to take shape, but many great and familiar people were already there. It was like walking into a family home same warm welcome smiles and that great feel of belonging to the group. After I quick chat I went off downtown. The plan was that I left my old Canon 400D camera back at home and that I would buy a new Canon 550D here in New York on arrival. Unfortunately I underestimated the travel time on subway and by the time I got back downtown most shops where already closed. I got to checking out a Best Buy and was told there that they don t have 550D in stock. Next morning I went for a full scale search B&H Photo Video store, J&R Express, another BestBuy none of them had the Canon 550D (aka T2i) in stock in a body-only configuration. BestBuy had a few sets with the kit lens, but I did not want paying 100$ extra for something I already have. The last option was Adorama and I got lucky I nabbed the last 550D they had and it was body-only. Now I was back, with a camera in my hands and the Debconf10 could really begin!

I just posted this announcement culminating several months of work with the next Debian Edu release. Not nearly done, but one major step completed.

This is the first test release based on Squeeze. The focus of this release is to test the user application selection. To have a look, install the standalone profile and let the developers know if the set of installed packages i.e. applications should be modified. If some user application is missing, or if there are some applications that no longer make sense to be included in Debian Edu, please let us know. Also, if a useful application is missing the translation for your language of choice, please let us know too. In addition, feedback and help to polish the desktop (menus, artwork, starters, etc.) is appreciated. We would like to ship a nice and handy KDE4 desktop targeted for schools out of the box. The other profiles should be installable, but there is a lot more work left to be done before they are ready, so do not expect to much. Changes compared to the lenny based version

• Everything from Debian Squeeze
  • Desktop environment KDE 4.4 => the new KDE desktop in combination with some new artwork
  • Web browser Iceweasel 3.5
  • OpenOffice.org 3.2
  • Educational toolbox GCompris 9.3
  • Music creator Rosegarden 10.04.2
  • Image editor Gimp 2.6.10
  • Virtual universe Celestia 1.6.0
  • Virtual stargazer Stellarium 0.10.4
  • 3D modeler Blender 2.49.2 (new application)
  • Video editor Kdenlive 0.7.7 (new application)
• Now using Kerberos for password checking (migration not finished). Enabled for:
  • PAM
  • LDAP
  • IMAP
  • SMTP (sender verification)
• New experimental roaming workstation profile for laptops.
• Show welcome page to users when they first log in. The URL is fetched from LDAP.
• New LXDE desktop option, in addition to KDE (default) and Gnome.
• General cleanup (not finished)

The following features are not working as they should

• No web based administration tool for creating users and groups. The scripts ldap-createuser-krb and ldap-add-user-to-group can be used for testing.
• DVD installs are missing debian-installer images for the PXE boot, and do not set up the PXE menu on eth0 because of this. LTSP clients should still boot from eth1 on thin client servers.
• The restructured KDE menu is not implemented.
• The LDAP server setup need to be reviewed for security.
• The LDAP directory structure need to be reworked.
• Different sets of packages are installed when using the DVD and the netinst CD. More packages are installed using the netinst CD.
• The jackd package fail to install. This is believed to be caused by some ongoing transition, and hopefully should be solved soon. The jackd1 package can be installed manually for those that need it.
• Some packages lack translations. See http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status, and help out with translations.

To download this multiarch netinstall release you can use

• ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso
• http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso
• rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso

To download this multiarch dvd release you can use

• ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso
• http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso
• rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso

There is no source DVD available yet. It will be prepared when we get closer to the final release. The MD5SUM of these images are

• 3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso
• 22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso

The SHA1SUM of these images are

• c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso
• 2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso

How to report bugs: http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla Please direct replies to debian-edu@lists.debian.org

The web offers a compelling platform for developing modern applications. How can free software benefit more from web technology, and at the same time promote more software freedom on the web? What would the world be like if FLOSS web applications were as plentiful and successful as traditional FLOSS applications are today? Web architecture The web, as a collection of interlinked hypertext documents available on the Internet, has been well established for over a decade. However, the web as an application architecture is only just hitting its stride. With modern tools and frameworks, it s relatively straightforward to build rich applications with browser-oriented frontends and HTTP-accessible backends. This architecture has its limitations, of course: browser compatibility nightmares, limited offline capabilities, network latency, performance challenges, server-side scalability, complicated multimedia story, and so on. Most of these are slowly but surely being addressed or ameliorated as web technology improves. However, for a large class of applications, these limitations are easily outweighed by the advantages: cross-platform support, instantaneous upgrades, global availability, etc. The web enables developers to reach the largest audience of users with the most compelling functionality, and simplifies users lives by giving them immediate access to their digital lives from anywhere. Some web advocates would go so far as to say that if an application can be built for the web, it should be built for the web because it will be more successful. It s no surprise that new web applications are being developed at a staggering rate, and I expect this trend to continue. So what? This trend represents a significant threat, and a corresponding opportunity, to free software. Relatively few web applications are free software, and relatively few free software applications are built for the web. Therefore, the momentum which is leading developers and users to the web is also leading them (further) away from free software. Traditionally, pragmatists have adopted free software applications because they offered immediate gratification: it s much faster and easier to install a free software application than to buy a proprietary one. The SaaS model of web applications offers the same (and better) immediacy, so free software has lost some of its appeal among pragmatists, who instead turn to proprietary web applications. Why install and run a heavyweight client application when you can just click a link? Many web applications perhaps even a majority are built using free software, but are not themselves free. A new generation of developers share an appreciation for free software tools and frameworks, but see little value in sharing their own software. To these developers, free software is something you use, not something you make. Free software cannot afford to ignore the web. Instead, we should embrace the web more completely, more powerfully, and more effectively than proprietary systems do. What would that look like? In my view, a FLOSS client platform which fully embraced the web would:

• treat web applications as first-class citizens. The web would not be just another application, represented by a browser, but more like a native application runtime. Web applications could feel much more native while still preserving the advantages of a web-style user experience. There would be no web browser: that s a tool for legacy systems to run web applications within a compatibility environment.
• provide a seamless experience for developers to build web applications. It would be as fast and easy to develop a trivial client/server web application as it is to write Hello, world! in PyGTK using Quickly. For bonus points, it would be easy to develop and run web applications locally, and then deploy directly to a PaaS or IaaS cloud.
• empower the user to manage their applications and data regardless of where they are hosted. Traditional operating systems act as a connecting fabric for local applications, providing a shared namespace, file store and IPC mechanisms, but web applications are lacking this. The web s security model requires that applications are thoroughly sandboxed from each other, but a mediating operating system could connect them in meaningful ways, just as web browsers store cookies and passwords for various websites while protecting them from each other.

Imagine a world where free web applications are as plentiful and malleable as free native applications are today. Developers would be able to branch, test and submit patches to them. What about Chrome OS? Chrome OS is a step in the right direction, but doesn t yet realize this vision. It s a traditional operating system which is stripped down and focused on running one application (a web browser) very, very well. In some ways, it elevates web applications to first-class status, though its paradigm is still fundamentally that of a web browser. It is not designed for development, but for consuming the web. Developers who want to create and deploy web applications must use a more traditional operating system to do so. It does not put the end user in control. On the contrary, the user is almost entirely dependent on SaaS applications for all of their needs. Although it is constructed using free software, it does not seem to deliver the principles or benefits of software freedom to the web itself. How? Just as free software was bootstrapped on proprietary UNIX, the present-day web is fertile ground for the development of free web applications. The web is based on open standards. There are already excellent web development tools, web application frameworks and server software which are FLOSS. Leading-edge web browsers like Firefox and Chrome/Chromium, where much web innovation is happening today, are already open source. This is a huge head start toward a free web. I think what s missing is a client platform which catalyzes the development and use of FLOSS web applications.

Why use a Chroot environment? A large part of the use of chroot environments is for the purpose of security, it used to be the only way of isolating a user from a section of the files on a server. In many of the cases where a chroot used to be used for security it is now common practice to use a virtual server. Also another thing to note is that SE Linux provides greater access restrictions to most daemons than a chroot environment would so in many case using SE Linux with a sensible policy is a better option than using a chroot environment to restrict a daemon. So it seems to me that the security benefits that can be obtained by using a chroot environment have been dramatically decreased over the last 5+ years. One significant benefit of a chroot environment is that of running multiple different versions of software on one system. If for example you have several daemons that won t run correctly on the same distribution and if you don t want to have separate virtual machines (either because you don t run a virtualisation technology or because the resources/expense of having multiple virtual servers is unacceptable) then running multiple chroot environments is a reasonable option. The Simplest Solution The simplest case is when all the chroot environments are equally trusted, that means among many other things that they all have the latest security patches applied. Then you can run them all with the same labels, so every file in the chroot environment will have the same label as it s counterpart in the real root this will mean that for example a user from the real root could run /chroot/bin/passwd and possibly get results you don t desire. But it s generally regarded that the correct thing to do is to have a chroot environment on a filesystem that s mounted nosuid which will deal with most instances of such problems. One thing to note however is that the nosuid mount option also prevents SE Linux domain transitions, so it s not such a good option when you use SE Linux as domain transitions are often used to reduce the privileges assigned to the process. There are two programs for labeling files in SE Linux, restorecon is the most commonly used one but there is also setfiles which although being the same executable (restorecon is a symlink to setfiles) has some different command-line options. The following command on a default configuration of a Debian/Lenny system will label a chroot environment under /chroot with the same labels as the main environment: setfiles -r /chroot /etc/selinux/default/contexts/files/file_contexts /chroot I am considering adding an option to support chroot environments to restorecon, if I do that then I will probably back-port it to Lenny, but that won t happen for a while. For a simple chroot once the filesystem is labelled it s ready to go, then you can start daemons in the chroot environment in the usual way. Less trusted Chroot environments A reasonably common case is where the chroot environment is not as trusted. One example is when you run an image of an old server in a chroot environment. A good way of dealing with this is to selectively label parts of the filesystem as required. The following shell code instructs semanage to add file contexts entries for a chroot environment that is used for the purpose of running Apache. Note that I have given specific labels to device nodes null and urandom and the socket file log in the /dev directory of the chroot environment (these are the only things that are really required under /dev), and I have also put in a rule to specify that no other files or devices under /dev should be labelled. If /dev is bind mounted to /chroot/dev then it s important to not relabel all the devices to avoid messing up the real root environment and it s impractical to put in a specific rule for every possible device node. Note that the following is for a RHEL4 chroot environment, other distributions will vary a little some of the file names. semanage -i << END
fcontext -a -t root_t -f -d /chroot
fcontext -a -t bin_t /chroot/bin.*
fcontext -a -t usr_t /chroot/usr.*
fcontext -a -t usr_t /chroot/opt.*
fcontext -a -f -d /chroot/dev
fcontext -a -f -s -t devlog_t /chroot/dev/log
fcontext -a -f -c -t null_device_t /chroot/dev/null
fcontext -a -f -c -t urandom_device_t /chroot/dev/urandom
fcontext -a -t "<<none>>" "/chroot/dev/.*"
fcontext -a -t "<<none>>" "/chroot/proc.*"
fcontext -a -t lib_t /chroot/lib.*
fcontext -a -t lib_t /chroot/usr/lib.*
fcontext -a -t bin_t /chroot/usr/bin.*
fcontext -a -t httpd_exec_t -d /chroot/usr/bin/httpd
fcontext -a -t var_t /chroot/var.*
fcontext -a -t var_lib_t /chroot/var/lib.*
fcontext -a -t httpd_var_lib_t /chroot/var/lib/php.*
fcontext -a -t var_log_t /chroot/var/log.*
fcontext -a -t var_log_t -f /chroot/var/log/horde.log.*
fcontext -a -t httpd_log_t /chroot/var/log/httpd.*
fcontext -a -t var_run_t /chroot/var/run.*
fcontext -a -t httpd_var_run_t -f /chroot/var/run/httpd.pid
fcontext -a -t httpd_sys_content_t /chroot/var/www.*
END
You could create a shell script to run the above commands multiple times for multiple separate Apache chroot environments. If there is a need to isolate the various Apache instances from each other (as opposed to just protecting the rest of the system from a rogue Apache process) then you could start each copy of Apache with a different MCS sensitivity label which will provide adequate isolation for most purposes as long as no sensitivity label dominates the low level of any of the others. If you do that then the semanage commands require the -r option to specify the range. You could have one chroot environment under /chroot-0 with the sensitivity label of s0:c0 for it s files and another under /chroot-1 with the sensitivity label of s0:c1 for it s files. To start one environment you would use a command such as the following: runcon -l s0:c0 setsid chroot /chroot-0 /usr/sbin/httpd