Marvell made a new version of U-Boot for the SheevaPlug available last month. This version, 3.4.19, integrates SD card support and improves support for FAT32 USB partitions (although USB support in general is still a bit flaky). This page describes how to install this new version of U-Boot on your SheevaPlug. First of all, download the SheevaPlug U-Boot 3.4.19. Unpack the zip file and copy the file u-boot-3.4.19/u-boot-rd88f6281Sheevaplug_400db_nand.bin to your TFTP server. I suggest you call the file u-boot.bin. Then start your SheevaPlug and type the following: The upgrade process will ask whether you want to change the environment: Make sure to answer "n" here. We also need to make a small change to the u-boot configuration because this version of u-boot no longer accepts the console parameter we have been using. Thanks to Tom Rinehart for pointing this out. Instead of console, we'll therefore add a new bootargs_console and update bootcmd to make use of it: You'll see that bootcmd contains $(console). You have to set a new bootcmd and change the console parameter to $(bootargs_console). In my case, I'd type: Make sure you don't forget the quotes! Finally, save the environment and restart your machine:

Just a quick update: XMPP4R-Observable is now on GemCutter. That s due to GitHub disabling gem building, and although everybody can get the source from GitHub as usual, those who want to quickly install it using Rubygems can do:

bash$ gem install xmpp4r-observable -s http://gemcutter.org

Happy Hacking.

On several occassions, R had suggested itself as a language for <it>systems scripting</it>. By this I mean random little adminstrative task such as (re-)moving or maybe renaming files or directories and the like. One of such cases just happened a few minutes ago. The aforementioned Garmin Forerunner 405 can cooperate quite nicely with Linux using the gant reader for the ant wireless communication protocol between the usb hardware dongle and the Garmin 405. (Sources for gant are both this file and this git archive.) I had meant to blog about this tool and the resulting files one of these days anyway, but today I just want to mention that the default filenames created by the program were somewhat horrid such as 20.09.2009 101112.TCX to denote the 20th of September of this year at 10:11h and 12 seconds. As we all know, filenames with spaces are bad for the environment as well as plain annoying. So I had made the simple change in the C sources to switch to a saner format such as 20090920-101112.TCX (and I see that the git archive now contains a similar fix). But that still left me with some 80+ files with the dreaded names. There are of course many ways to skin this cat and to rename the files in bulk. However, I found the following four lines to be fairly succinct

#!/usr/bin/r
files <- dir(".", pattern=".*\\.TCX$")
res <- lapply(files, function(f)  
    pt <- strptime(f, "%d.%m.%Y %H%M%S.TCX")  # parsed time
    ft <- strftime(pt, "%Y%m%d-%H%M%S.TCX")   # formatted time
    file.rename(f, ft)
 )

as they show, among other things,

• the access to one of the three (soon four) regexp engines, here as a simple patterns argument to dir()
• the functional programming nature of the beast: files is a vector of filenames, and lapply() unrolls the vector one-by-one calling the anonymous function and passing the current element off as f
• computing on times is particularly easy as we get strptime and strftime as any self- and POSIX-respecting language should
• similarly, we get access to file system-level operations natively avoiding all quoting issues that make files with spaces such fun in the first place.
• the littler scripting frontend providing /usr/bin/r rules.

So about five lines and two minutes later, some eighty-ish files were renamed and sanity was restored. Hm, and I took me five times as long to blog this. Lastly, I do not mean to imply that Python or Perl or Ruby or (insert favourite tool here) cannot do it equally well. I simply meant to say that programmatically creating new filenames is definitely easier in R than it would have been in shell. And as an added bonus, we even get fully parsed time objects that I could have tested for. But then tests and documentation never get written on a Saturday.

This entry was originally posted in slightly different form to Server Fault There are two methods of using virtual hosting with HTTP: Name based and IP based. IP based is the simplest as each virtual host is served from a different IP address configured on the server, but this requires an IP address for every host, and we're meant to be running out. The better solution is to use the Host: header introduced in HTTP 1.1, which allows the server to serve the right host to the client from a single IP address. HTTPS throws a spanner in the works, as the server does not know which certificate to present to the client during the SSL connection set up, because the client can't send the Host: header until the connection is set up. As a result, if you want to host more than one HTTPS site, you need to use IP-based virtual hosting. However, you can run multiple SSL sites from a single IP address using a couple of methods, each with their own drawbacks. The first method is to have a SSL certificate that covers both sites. The idea here is to have a single SSL certificate that covers all the domains you want to host from a single IP address. You can either do this using a wildcard certificate that covers both domains or use Subject Alternative Name. Wildcard certificates would be something *.example.com, which would cover www.example.com, mail.example.com and support.example.com. There are a number of problems with wildcard certificates. Firstly, every hostname needs to have a common domain, e.g. with *.example.com you can have www.example.com, but not www.example.org. Secondly, you can't reliably have more than one subdomain, i.e. you can have www.example.com, but not www.eu.example.com. This might work in earlier versions of Firefox (<= 3.0), but it doesn't work in 3.5 or any version of Internet Explorer. Thirdly, wildcard certificates are significantly more expensive than normal certificates if you want it signed by a root CA. Subject Alternative Name is a method of using an extension to X509 certificates that lists alternative hostnames that are valid for that certificate. It involves adding a "subjectAltName" field to the certificate that lists each additional host you want covered by the certificate. This should work in most browsers; certainly every modern mainstream browser. The downside of this method is that you have to list every domain on the server that will use SSL. You may not want this information publicly available. You probably don't want unrelated domains to be listed on the same certificate. It may also be difficult to add additional domains at a later date to your certificate. The second approach is to use something called SNI (Server Name Indication) which is an extension in TLS that solves the chicken and egg problem of not knowing which certificate to send to the client because the client hasn't sent the Host: header yet. As part of the TLS negotiation, the client sends the required hostname as one of the options. The only downside to this is client and server support. The support in browsers tends to be better than in servers. Firefox has supported it since 2.0. Internet Explorer supports it from 7 onwards, but only on Vista or later. Chrome only supports it on Vista or later too. Opera 8 and Safari 8.2.1 have support. Other browsers may not support it. The biggest problem preventing adoption is the server support. Until very recently neither of the two main webservers supported it. Apache gained SNI support as of 2.2.12, which was released July 2009. As of writing, IIS does not support SNI in any version. nginx, lighttpd and Cherokee all support SNI. Going forward, SNI is the best method for solving the name-based virtual hosting of HTTPS, but support might be patchy for a year or two yet. If you must do HTTPS virtual hosting without problems in the near future, IP based virtual hosting is the only option.

I haven't written about politics since the election for several reasons. First and foremost, Obama won fair and square. While I might wish the other guy had won, I can't whine and pout or threaten to move to Canada like some people. The vox populi chose and that choice has to be respected. Secondly, one of the worst aspects of the current American political scene is the paranoid obsession with personalities in which the president is not just an implementor of policies good or bad, but personally responsible for the entire state of the cosmos. It started with Nixon, started getting alarming with Clinton and reached batshit levels of insanity with George W. Bush. But just because the left does it it, doesn't mean we have to follow suit. Although I figured Obamas policies would end up a trainwreck, I wanted to see what he actually did before calling him on it. The Nobel comittee isn't hoping and changing with me. In a decison that is bizarre even by the lax standards of a prize that long since jumped the shark, the President is to receive the Nobel Peace prize for...not being George Bush? It's difficult to see what substantive reasons they could have for their choice. But apparently one of these days he is going to make extraordinary efforts to strengthen international diplomacy and cooperation between peoples...democracy and human rights are to be strengthened. Well let's see now:

• There was the ridiculous episode with Russia and the reset button.
• From India to Israel to Poland and the Czech Republic Obama has antagonized allies and lowered the goodwill built up by Bush (ya rly).
• The Obama Administration did nothing to support Iranian protesters rising up against blatant election-stealing by their theocratic oppressors. Neither was there so much as a squeak when the protests were brutally put down. This by the way is the same Iran with which the administration continued sham negotiations even after they knew it was pursuing nuclear weapons. (Hey guys! Remember when nuclear non-proliferation was a goal of "multilateral diplomacy"?)
• Oh but wait, there is one errant country whose villany will not be allowed to go unchecked by US might: Honduras, where the countries constitutional court and parliament (or was it teh J00z?) acting to stop a Chavez style demagogue from stealing himself another term kicked him out. Instead of supporting this attempt at preserving the rule of law in a fragile corner of the world, the US inexplicably bought into the propoganda that it was a coup despite the Congressional Research Service saying that it wasn't. Luckily Honduras is treating Obama diplomacy as all other countries do and ignoring it.
• Obama is the first president since 1991 to refuse to meet with old and busted Peace Prize winner the Dalai Lama

Perhaps I am being a little unfair in not taking into consideration all the great things the president is going to do real soon now. It's just that I'm worried that this might be an attempt to sway him in the task of winning the war in Afghanistan (and more likely than not carrying it into Iran and Pakistan.) I take solace in the knowledge that heretofore Obama has shown a refreshing inclination to throw people under the bus when they are no longer convenient. If he can do that to the guy who says he wrote his book than some silly Norwegians won't be a problem.

It appears that no matter what the system papersize is set to, and no matter what cups says is the default paper size, firefox, in its infinite wisdom locks it to being letter - this would probably be fine if I was in the US, but I'm not, and I want it to be A4... So, the stages to go through to get it to do the right thing appear to be:

• Goto about:config

• Filter on print_paper_size

• Change any bold (i.e. set) entries that are wrong to A4

This seems like something that should be much easier set, apparently using Page Setup only affects the current tab/window you are in and doesn't change the default, which is just odd.

I ve been considering for some time now to create a merge tool specifically suited for debian/changelog files. My goal was to let Git use it automatically thanks to gitattributes. I ve just gone ahead, so let me introduce you git-merge-dch. Grab it with git clone git://git.debian.org/~hertzog/git-merge-dch.git, you can build a package if you wish. Beware, you need to have a dpkg-dev 1.15.5 that is not yet published (so you need to build dpkg from its git repository, git clone git://git.debian.org/dpkg/dpkg.git) as I rely on features that I introduced recently you will also need the libalgorithm-merge-perl package. Using it in a git repository requires two changes:

• defining a new merge driver somewhere in the git configuration (in .git/config or ~/.gitconfig for example):

  [merge "git-merge-dch"]
          name = debian/changelog merge driver
          driver = git-merge-dch -m %O %A %B %A
  

• defining the merge attribute for debian/changelog files either in .gitattributes in the repository itself or in .git/info/attributes:

  debian/changelog merge=git-merge-dch
  

Now you can safely maintain two branches of a package with changelog files evolving separately and merge one into the other without creating undue conflicts. Suppose you created an experimental branch for version 2.28 (you use a version 2.28-1~exp1) when 2.26.2 was current stable in the master branch. In the mean time, 2.26.3 got out and was packaged in master. Next time you merge stable into experimental, the changelog entries for 2.28 and 2.26.3 won t collide despite being at the same place in the changelog file compared to the common ancestor. Let s continue with this example, 2.28 is out. Instead of adding a new changelog entry with New upstream release without further changes, you keep the current changelog entry and simply change the version into 2.28-1. While preparing this you discover a branch with fixes that was based on 2.28-1~exp1, if you merge it it will reintroduce a 2.28-1~exp1 entry that you don t want. Fortunately you can use the --merge-prereleases (-m) option of git-merge-dch so that it strip the prerelease part of the version string and considers 2.28-1~exp1 and 2.28-1 to be the same entry really. The only limitation is that this merge tool will remove any lines which are not parsed by Dpkg::Changelog (and which in theory are not supposed to be there). Feel free to test, share your comments, report bugs and send patches! Partagez cet article / Share This

So I finally got around to checking out the TED site; I ve quickly become a fan. One of the first talks I watched was Steven Levitt s child carseats talk. Both the talk and the feedback comments on the TED site reminded me of things I see in software development. Here s the video if you haven t seen it. Steven Levitt shows in his talk how 30 years of data on car crash fatalities imply that carseats do not outperform regular seatbelts for children ages 2 and up. Anyone who has a child or grandchildren will probably bristle at hearing that; as the father of a pre-schooler, it certainly gave me pause. We spent no small amount of time and decent chunk of money in selecting carseats for our child, thinking we had done our best to ensure our child s safety. For that matter, it would be illegal for us not to have done so. To see a decent-sized data sample suggesting my child would be better off in a seatbelt at her age is rather unsettling. By the end of the talk, I took away these observations:

• This great swath of an initiative was started by a very small yet vocal group of proponents whose assertions received little scrutiny.
• A solution tailored to the specific constraints of a portion of the audience has been put forth as the de facto solution for the entire audience.
• There is an ongoing assumption that the more complicated and costly solution must be superior to the simpler, existing solution.
• Cursory evaluation of a data set without rigorous attention to mitigating factors can lead to wildly inaccurate conclusions.
• The acceptability of a given solution is often tested against a narrow band of the overall criteria, and the solution is often optimized to pass that test.
• The likelihood that people will continue to choose the more expensive and complicated solution despite any data is high.

So, software professionals, does any of that sound familiar? It reminds me of numerous initiatives over the years that have led us inexorably to the software productivity morass we have slogged through for years now. I suppose the most heinous case study in my own experience would be J2EE and the insistence that it was the solution that any reasonable business application would choose for a platform. (Before you .Net folks jump on that one, DCOM and later the .Net enterprise stack was much the same.) And who hasn t read a benchmark or white paper with seemingly incontrovertible data depicted in highly-polished graphics insisting that Product Y is the one solution to address them all? I noticed that there were comments below the video on its page at the TED site, largely because the negative verbiage of the topmost comment jumped out at me. I took the time to read through them all (there were 36 at the time of this writing), and to my amusement, I saw parallels between them and how people react to questioning and examining our existing practices and means of developing software. See if any of these strike a chord:

• The idea that what we re doing might be wrong unsettles some people, and their response is often ferocious and irrational defense of the status quo.
• Those who have a financial stake in the current mode of operation are less likely to be open to scrutinizing it.
• There will be some people whose primary objection to the scrutiny is that they didn t think of doing it first; these people will sometimes attack the person questioning things on the grounds that it s all a selfish, attention-mongering endeavor.
• There are some people who will also be open to examining why and how we re doing things; whether they conclude the same thing or not, they are a welcome presence among the larger mass of those who ardently refuse to entertain the possibility of a need to change.

In recent years I ve been greatly encouraged by the willingness of companies to question whether or not the heavyweight frameworks and technology stacks are what they should be using. Helping companies slough off high-ceremony processes in favor of right-sized process that focuses on delivering the right software in a timely manner has been some of the more rewarding work I ve done the past several years. I think we have an encouraging number of people in the industry who are challenging the more expensive and complicated always equals better mantra. For the brave individuals willing to put these questions to the community at large, I hope you find some comfort in knowing that the resistance and rejection you will encounter is a thing to be expected; you are not alone in that respect. Here s hoping we continue to be open to self-examination, no matter what emotional responses it might provoke or what fear of the future it may stir up within us.

I've been suffering a really annoying bug in VIM recently: when repeating an action that introduced space characters to the buffer (that is, single-byte 0x20 ASCII-compatible space characters), the action would insert Unicode non-breaking space characters instead (0xc2ac). I've finally tracked this down to an old vimspell plugin. Version 1.100 / released 14-Sep-2005 causes this in conjunction with the Debian vim-gnome package, version 2:7.2.245-2 (and perhaps others). The solution for me is to just remove the vimspell plugin: the upstream author recommends that users of VIM versions 7 and upwards use the built-in spell checker instead anyway.

I'm going to this year's Debian developers meeting, the DebConf9. Unfortunately the conference overlaps with even more important events, so I will only be there half the time from 27^th of July, but I will stay to the end. Being a first time visitor of DebConf I'm curious about what's going to happen there and about getting in touch with all the other geeks... *grin* See you there!

---

debmirror 2.3 should be hitting the mirrors about now. Main change is that it will now use the available diffs to update Contents files, which should give a nice bandwidth reduction for users who mirror those. With that the option --pdiff (for "package diff") no longer really covered its function, so I decided to change it to --diff. There's also a fix for mirroring archives that don't have a Release file. Question for users The option --add-dir has been marked as deprecated (for quite some time now I suspect). I'm considering to remove it in the next release as I cannot see any use cases for it, but it's quite possible I'm missing something and there are still people using it. If you would like that option preserved, then please mail me at debmirror@packages.d.o with an explanation of why and how you use it. Managing the size of a local mirror The archive has grown a lot over the past Debian releases and keeping even a partial local mirror can require quite some disk space. Luckily debmirror offers quite a few options to tune what is mirrored. My own mirror covers testing and unstable 'main' for 6 architectures (i386, amd64, armel, hppa, sparc and s390), no source, no D-I images. It uses only 61G. I say "only" as that's about 33GB less than it could have been without tuning. In other words, I'm saving a bit more than one third! Here are the options I added to achieve this:

--exclude-deb-section='^debug$'
--exclude='/(xen-)?linux-[a-z]+-2\.6[.0-9]*-[-[:alnum:]]*(openvz vserver xen)[-[:alnum:]]*_'
--exclude='(k/kde g/gnome o/openoffice\.org).*/.*_(armel hppa s390)\.deb'
--exclude='(a/axiom/ d/debian-edu-doc/ e/ember( -media)/ e/eclipse(/ -))'
--exclude='(e/erlang g/(gcl(cvs)? ghc6)/ l/llvm(/ -) p/paraview/ o/openturns/)'
--exclude='(s/scalapack(-doc)?/ f/festvox- g/gcc-snapshot/)'
--exclude='(/acl2-books_ /digikam-doc_ /fluid-soundfont-gm_ /deal.ii-doc_)'
--exclude='(/libxmpp4r-ruby-doc_ /lilypond-doc_ /qt4-doc_ /vtk-doc_)'
--exclude='/i18n/Translation-.*\.bz2' --include='/i18n/Translation-(nl de)\.bz2'

And the explanation is:

• I rarely use debug packages and they are relatively big; if I do need one I'll download it manually from a remote mirror.
• I don't run vserver or xen kernels (and if I did I'd probably compile custom kernels anyway). I do want "regular" kernels because of D-I work.
• I doubt I'll ever want to install KDE, GNOME or OpenOffice on my armel, hppa or s390 boxes, but I do want them for the other three arches.
• Selected individual (mostly scientific) source packages that I doubt I'll ever use but use up significant disk space (and bandwidth when updated). These were found by a simple:

  du -s pool/main/*/*   sort -rn   head -n 50
  

• Selected individual huge binary packages (mostly documentation), found using:

  du -s pool/main/*/*/*.deb   sort -rn   head -n 50
  

• I'm only interested in Dutch and German translations of package descriptions. Well, actually I'm not even interested in those, but it's useful to have them for testing debmirror.

Obviously I have nothing against any of the packages that I exclude. It's just that I don't need them.

Then they stopped, and Thorin muttered something about supper, and where shall we get a dry patch to sleep on? Not until then did they notice Gandalf was missing. So far he had come all the way with them, never saying if he was in the adventure or merely keeping them company for a while. He had eaten most, talked most, and laughed most. But now he simply was not there at all! Just when a wizard would have been most useful, too, groaned Dori and Nori (who shared the hobbit s views about regular meals, plenty and often).

- J.R.R. Tokien, The Hobbit

I am very fond of the works of J.R.R. Tolkien; it would not surprise me to find that many of you recognize these words from the second chapter of The Hobbit titled Roast Mutton . It occurred to me recently that there are parallels between Gandalf s role in The Hobbit and that of an Agile coach. Now, before my fellow Tolkien enthusiasts leap on their keyboards, bear with me on this. Know that I am not saying an Agile coach is on par with a wizard (OK, with one of the Istari sent by the Valar, but let s table that so as not to scare off the normal folk, alright?); that should be enough to calm you down. In the excerpt from The Hobbit at the top of the page, Bilbo and the dwarves have run into their first predicament. Note that it s not a particularly difficult situation; they just need to find shelter and partake of some food. Fire would be nice, too, if it could be managed. (Mind you, it s the first day of their journey; they set off mere hours ago fully provisioned and riding on ponies.) It isn t very long before the fledgling group finds itself not only without shelter and food, but in the hands of three rather nasty trolls who are deciding how best to eat the entire group. Gandalf returns once things have gotten out of control, and with some subtle adjustments to the situation, the crisis is averted. Could Gandalf have come back sooner and spared them this entire experience? Perhaps, but in their struggle a few key things happened. First, the group had to work out how to assess tasks at hand and appropriately delegate. To their credit, that effort was partially successful. The most skilled firestarters were assigned to that task, one of the keen-eyed dwarves was assigned to be the lookout. Second, they gathered some field experience that led to the establishment of improved practices, i.e. don t leave the ponies laden with packs when you make camp, particularly if it s all your food. (They lost most of their food that night when the pony carrying it bolted and ran straight into a nearby river later that night.) Third, Bilbo Baggins was called upon to perform his first task as burglar, albeit a fool s errand that landed them in the troll predicament. While Bilbo was wildly under-equipped for his job, he managed to work through it. That experience began a developmental journey that would prepare him for the great things that would be expected of him later on. This was not Gandalf s first adventure, nor was it the first group of people he needed to equip and challenge in order to develop them to a point that they could accomplish their goal. At this point, he s been in Middle-Earth just shy of 2,000 years. He would have been more than capable of walking them through their entire journey, but to what end? Agile coaching is a discipline that aims to help teams develop their own use of methodologies like Scrum and cross-methodology practices like testing, user stories, etc. This means equipping teams with just enough information to strike out on their own for a bit, then letting them run with it rather than dazzle them with one s own mastery so as to appear like the indispensable demigod. Until people struggle with the terse maxims of Agile Software Development, they cannot internalize them. And when the wizard is always around, why bother struggling? One of my greatest frustrations as an Agile coach is how few companies are willing to take a coaching approach with their Agile adoption. They want you to come in and be the demigod as a full-time contractor. Sure, there are fiscal, political, and seemingly practical reasons that they will cite; I chalk most of them up to being excuses for a lack of willingness to embrace what it would take to face the hard task of nurturing what you have. It s seemingly easier to just throw more money at more bodies and hope that somehow things will all work out, and surely if you can stumble upon some superstar to wrangle the mess, you ll eventually be able to browbeat them into becoming a full-time employee. Don t get me wrong; in some ways, I benefit from this dysfunction. From a selfish business standpoint, having a single full-time client is certainly easier than juggling multiple concurrent clients and their schedules. As far as actually accomplishing the aim of my business, however, I think it hinders the mission. One of my aims in working with companies is to be a coach despite being brought in as a contractor. It s certainly possible, though it is more challenging. There s not that natural separation of the coach from the team that forces them to take up the mantle on their own. Few things in my work are more rewarding than having a developer come to me and say, I wasn t really sure this Agile stuff could work, but now, after going through all this, I wouldn t want to go back to the old way of doing things. Much later in the journey of the hobbit and his dwarf companions, Bilbo is again called upon for a challenging task. His response makes me think Gandalf s approach has worked:

Perhaps I have begun to trust my luck more than I used to in the old days he meant last spring before he left his own house, but it seemed centuries ago but anyway I think I will go and have a peep at once and get it over. Now who is coming with me?

- J.R.R. Tokien, The Hobbit

Here s hoping more people will be willing to embrace the challenging, messy, and altogether beneficial task of equipping teams and allowing them to struggle when necessary, even if it means the occasional scuffle with trolls.

At this point in my career, I can t really see myself organizing much of anything as it is time I don t seem to have. But after I saw Memefactory, I decided that it was well worth my time to get these guys and their computers to NYU. With help from a string of organizations at NYU, Memefactory will be performing a souped up, updated version of their masterful performance tour of Internet memes on October 9th. It is SO worth checking out. (ps, we remixed this poster though we did not get much of the bling)

******************

If one were to assume there might be any kind of end to the meaningless drivel on the web, one would be wrong. For this very reason, we present MemeFactory NYU. We re lucky enough to have been invited by NYU to present our second, full-length MemeFactory during which we wax philosorapsophical about the state of popular (and some unpopular and some berpopular) internet media. That means about one and one half of one hours of 3 projectors, 3 gentlemen, more pictures of cats, videos of fails and power ratings over 9000 than any previous MemeFactory. We d call it bang-for-your-buck, but damn this shindig is $Free! So don your pancake hat - or your furry suit, we wont judge - and get ready to Get Down, get WeeGee d and of course Crank That. http://wwksf.com/nyu To recap: WHEN: October 9 7:30-9:00. WHERE: Warren Weaver Hall RM 109, http://cs.nyu.edu/web/Location/directions.html (Free and Open to the Public) WHO: What We Know So Far http://www.whatweknowsofar.com/NYU WHY: Because it is not another academic lecture but lively performance filled with nothing but insight and humor for die-hard Internet memeologists and newbies alike. Take the plunge with the memefactory! SPONSORED: NYU @ Free Culture, Council on Culture and Media, Center for Religion and Media, NYU ACM s Chapter

At this point in my career, I can t really see myself organizing much of anything as it is time I don t seem to have. But after I saw Memefactory, I decided that it was well worth my time to get these guys and their computers to NYU. With help from a string of organizations at NYU, Memefactory will be performing a souped up, updated version of their masterful performance tour of Internet memes on October 9th. It is SO worth checking out. (ps, we remixed this poster though we did not get much of the bling)

******************

If one were to assume there might be any kind of end to the meaningless drivel on the web, one would be wrong. For this very reason, we present MemeFactory NYU. We re lucky enough to have been invited by NYU to present our second, full-length MemeFactory during which we wax philosorapsophical about the state of popular (and some unpopular and some berpopular) internet media. That means about one and one half of one hours of 3 projectors, 3 gentlemen, more pictures of cats, videos of fails and power ratings over 9000 than any previous MemeFactory. We d call it bang-for-your-buck, but damn this shindig is $Free! So don your pancake hat - or your furry suit, we wont judge - and get ready to Get Down, get WeeGee d and of course Crank That. http://wwksf.com/nyu To recap: WHEN: October 9 7:30-9:00. WHERE: Warren Weaver Hall RM 109, http://cs.nyu.edu/web/Location/directions.html (Free and Open to the Public) WHO: What We Know So Far http://www.whatweknowsofar.com/NYU WHY: Because it is not another academic lecture but lively performance filled with nothing but insight and humor for die-hard Internet memeologists and newbies alike. Take the plunge with the memefactory! SPONSORED: NYU @ Free Culture, Council on Culture and Media, Center for Religion and Media, NYU ACM s Chapter

Humm... Has anybody else seen a pattern like this? I am getting a flurry of root login attempts at my main server at the University since yesterday 7:30AM (GMT-5). Now, from the machines I run in the 132.248.0.0/16 network (UNAM), only two listen to the world with ssh at port 22 And yes, it is a very large network, but I am only getting this pattern on one of them (they are on different subnets, quite far apart). They are all attempting to log in as root, with a frequency that varies wildly, but is consistently over three times a minute right now. This is a sample of what I get in my logs: [update] Logs omitted from blog post, as it is too wide and breaks displays for most users. You can download the log file instead. Anyway This comes from all over the world, and all the attempts are made as root (no attempts from unprivileged users). Of course, I have PermitRootLogin to no in /etc/ssh/sshd_config, but I want to understand this as much as possible. Initially it struck me that most of the attempts appeared to come from Europe (quite atypical for the usual botnet distribution), so I passed my logs through: The top countries (where the number of attempts 5) are: I am attaching to this post the relevant log (filtering out all the information I could regarding legitimate users) as well as the full output. In case somebody has seen this kind of wormish botnetish behaviour lately please comment. [Update] I have tried getting some data regarding the attacking machines, running a simple nmap -O -vv against a random sample (five machines, I hope I am not being too agressive in anybody's eyes). They all seem to be running some flavor of Linux (according to the OS fingerprinting), but the list of open ports varies wildly I have seen the following: Of course, it strikes me that several among said machines seem to be Linuxes, but (appear to) run Microsoft services. Oh, and they also have P2P clients.

Attachment	Size
Results of parsing the logs	21.58 KB
Relevant portion of the logs	1.05 MB

I was gonna write this as a comment to Daniel Kahn Gillmor s post on sexism in the FOSS community, but it got a bit too big and I noticed I couldn t log in with OpenID to comment, so here it goes. Do you think that the significant under-representation of women is a problem? I don t think it s a problem in itself, but it is a symptom which can point to a series of problems, with different levels of importance, depending largely on the cultural background involved. That is to say: the reason for this gender disparity may have significantly different roots depending on the place, some of which need to be addressed in completely different ways, if at all. Off the top of my head I d name a few:

1. Cultural favoring of men as intellectually superior in any given field, filtering women out of participation in said field.
2. Cultural/religious taboo of women as professionals in general.
3. Cultural/religious taboo of learning for women.
4. Cultural favoring of women as superior in some fields, draining other fields of prospective women professionals.
5. Cultural characterization of certain fields as non-feminine, scaring women away on other grounds than technical capacity.
6. Cultural expectations regarding pregnancy and marriage, coupled with age expectations for entry level jobs, barring entry to certain fields.

And since I m speaking theoretically, we could also imagine a maternalist culture in which women aren t attracted to IT because it s beneath their level , preferring instead careers in politics or whatever is seen as a superior career in this imaginary culture.
This is obviously bogus, but I feel the need to make at least one Devil s Advocate argument pointing out that women don t necessarily need help achieving equality everywhere. With this in mind, I d say we can start addressing the problems where they exist and for what they are. Seems like a clearer starting point, IMHO. Disclaimer: I m not really active in this endeavor, partly because I ve never believed in any particular large-scale plan to change the scenario. I m more of a small-scale guy: changing the world one person at a time (which is ironically contradicted by the sheer existence of this post, but anyway ).