Short summary: I can’t stay away from coding Blosxom plugins. Perl rules. PHP sucks. ;-)

• New version 0.04 of the tagging plugin, supporting Technorati style tag links to many resources.
• New add-on plugin pathbasedtagging to the plugin tagging, implementing Technorati style tag links in pure Blosxom without any help from Apache’s mod_rewrite.
• New plugin dept offering Slashdot like “dept.” lines for Blosxom postings.

Supporting Technorati style tag URLs After releasing the last version of my Blosxom plugin tagging, I noticed that Technorati only seems to like URLs ending in “/tagname” but not ending in “=tagname” (as they do if you use classic query strings instead of the path info), even if the a tag has a rel="tag" attribute. And not only I noticed this but also some other users of the plugin. (Although I do wonder how Furl made it to a Technorati partner with URLs like http://www.furl.net/furled.jsp?topic=tags…) So I somehow had to change the syntax style for my tags. This wasn’t very hard for the links, but I wanted them to still link to my blog and not to Technorati, Flickr, Wikipedia or any other external resource. Implementing Technorati style tag URLs The obviously easiest solution for someone who’s using and administrating Apache web servers for nearly ten years now was to use some mod_voodoo—eh—mod_rewrite:

RewriteEngine On
RewriteRule ^/cgi-bin/blosxom.cgi/tags/(.*)$ /cgi-bin/blosxom.cgi?-tags=$1 [PT]

That way I could use Technorati style tags and had a well performing solution. But somehow this solution wasn’t that satisfying since it wasn’t pure Blosxom and therefore had some dependency including access to some Apache config file. (Even if the config file was called .htaccess. ;-) A pure Blosxom solution A few days ago I somehow noticed that in general a special behaviour on some URLs could also be implemented using Blosxom’s API. Using the entries function to modify the Blosxom internal path itself before Blosxom or e.g. the entries_index runs but not returning any hashes, allows to have some path like URLs not being treated as a path by Blosxom. Unfortunately this couldn’t be incorporated into the tagging plugin itself, since plugins doing such path interpreting voodoo needs to be ran before any plugin supplying an entries function runs. But the tagging plugin must run after such a plugin. So I created the small add-on plugin pathbasedtagging which is solely thought for use together with the tagging plugin (but may have other, yet unknown purposes). And since I got asked if they could use the tagging plugin to link to external tag URLs instead of the own blog, I included a ready to use list of more or less popular external tag URLs including Technorati, Flickr, del.icio.us, de.lirio.us and Wikipedia. from the slashdot dept. Since I’ve always liked the often sarcastic or even evil comments inside Slashdot’s subtitle alike dept. lines and since I’m also used to use them at Symlink, I wanted them in my blog, too. Time for a new plugin. The basic work of parsing out the data from the text files the posts reside in was already written for the tagging plugin. So I just had to use that code, simplify it and add some little more code to get the dept plugin whose results you can see in my blog directly beneath the title of a posting since a few days now. Update 02:52h Hey, see my Technorati profile: It worked! Technorati recognised the tags! Yeah!

Since Joey Hess posted a short conversation we had on IRC today about the role of the DPL, I thought it's a good time to express some of my thoughts. Basically, I think that most people have a bad understanding of which tasks are really involved in being DPL (e.g. much more purely administrative crap that nobody else wants to do) and that they're quite naive about what the DPL can achieve, at least in the current climate. Let's just look at the current discussions on the -vote list. It's this time of the year when everyone pretends that its Christmas, expresses their feelings of what's wrong with Debian and where Santa Claus^W^Wthe candidates reassure them that everything will be fine. "Will you fix NM? Fix or replace ftp-master? etc." "Oh, sure I will, all of that (and more)." Honestly, would you elect someone if they told you they won't or can't? The strange thing is that the same questions get asked every year, and yet people don't get the hint and look for other solutions. I'm not overly happy with any of the candidates this year, and I was seriously considering running again, not next year but possibly later. However, this Christmas wankfest reminded me again why that may not be such a good idea after all. I remember how much time I spent answering questions on -vote myself, and while I'm all for transparency, many of the questions were just a waste of time. This year, the questions were relatively sane in the beginning but now it's just a waste of time most questions are posed in a way that it's clear what kind of answer people want to hear. I spent hours and hours answering questions, but at some point I thought "cannot we just stop talking for hours about what I'd do if elected and actually start doing all that stuff?". That would have been so much more productive. Instead of asking the DPL what they'll do to solve All The Problems In Debian, why don't you ask yourself what you can do to improve the situation? There's a bottleneck with the DAM, you say. Right, the chances that you'll be added as DAM are relatively small. But have you ever considered helping the DAM and to make their life easier? How about signing up as an Application Manager and producing such good reports that it'll be a piece of cake for the DAM to approve people based on your reports? Right, it won't fix the bottleneck, but it will make the situation so much better. Instead of bitching about the security team, why don't you prepare a package, write the text for the DSA and get everything ready in a way that a DSA member can simply take your work, recompile the package and issue the advisory? Now I'm sure some people will say that they've tried that and failed. Yes, not every upload for DSA will be accepted as it is, but how hard have you tried? And people always complain about the cabal and how hard it is to join teams. And while I agree that this is partly true, there are so many counter examples too. Look at me as an example. In 2.5 years, I became the most productive Application Manager, joined (and took over) the NM Front Desk, became a "senior" Quality Assurance member, and got elected as project leader. Am I special? No, in no way I just put in a lot of effort. Look at Jeroen van Wolffelaar, who joined at the end of 2004, and who is involved in QA (especially MIA) and lintian, is the co-author of the new packages.d.o code and an ftp assistant. Andi Barth (who got an account in January 2004) has done important QA work (bts2ldap), is a maintainer of the developers reference and a release manager. So it's not possible to join a team, you say? Maybe you're just not trying hard enough (and the right way!). (Hint: "make me a DAM/ftp-master/whatever" doesn't work as well as "how can I make your job easier?"). What I'm trying to say is that people should stop believing that the DPL will fix everything and that they should actually help out themselves. If we all work together and put effort into the areas that need work we might actually achieve something. People have been asking for a strong leader and this urge got stronger over the last few years. But, face it, we currently don't have a culture which accepts a strong leader. Joey Hess mentioned that he wants to see a DPL who pushes technical changes. I did that too, to some degree (mostly in private since that works much better than on a mailing list where a big flamewar is guaranteed). For example, I kindly asked Joey to lower the priority of the non-free question so it would not get asked in a default installation. And he did because Joey is a reasonable guy. (He also told me that me making this request made it easier for him to justify.) However, unfortunately, not everyone is like Joey. And what are you going to do if a maintainer refuses to listen, as many do? I mean, seriously, what can you do? Some are increasingly talking about the good old times of Bruce Perens who would tell people what to do and make decisions. The urge for a strong leader increased over the last years. I think that's partly a reason why Branden got elected last year people expected him to completely shake things up. I haven't talked to him and I wasn't part of the leadership team, so I don't really know what happened, but from what (little) I've heard, it seems that he tried, quickly realized just how rigid some of the structures are and gave up. You have to see things in a historical perspective (and I can only recommend that people who have access to the debian-private archives take the time to read through them). There's a reason we have had "weak" leaders since Bruce. While now a large number of people think that Bruce was the best thing since sliced bread, lots of people were really pissed off back then with him commanding people around. And what was the result? A constitution that would ensure that no leader would ever have such power again. And that's what we're currently stuck with. I think that one of the biggest problems Debian is currently facing is the inability to make decisions. There are so many endless, completely futile (and repetitive) discussions going on. We need someone who comes in, tells people to shut up and makes a decision on behalf of the project. A decision people will follow, even if they personally disagree with it. But seriously, do you think our culture would currently accept such a leader? I can tell you from experience that even people who have been asking for a "strong" leader won't actually follow a leader who tells them to take a certain course of action. We really need to fix this problem, and the problem is in our culture. And since our culture is defined by who we are, you should start with yourself first. Start by asking yourself a few questions. Do you think before posting something to our lists, and ask yourself twice whether it really adds value to the discussion? If there's an area that is problematic, will you try to help out? If asked to do something you're not particularly interested in but which is good for the project will you do it? And most importantly, will you contribute to make our culture something that is fun? The project leader is important, but don't wait for them to fix all of our problems. If there's a problem, try to figure out a way how you can solve it!

FOSDEM is one of the events I really enjoy. Unfortunately, I couldn't attend last year because I was at a conference in China. However, this year I was back, and the event was bigger than ever. There's so much going on that it's really hard to keep up. There are a number of people I'd really like to have talked to more but there just wasn't time in those two days which were fully packed. It was nice to meet a number of people again, though, in particular the usual suspects, including Michi Banck (aka Hurd illusionist, "it supports two wireless cards now"), Guillem Jover (Spanish mafia boss living in exile), and Jordi Mallach ("World Domination for Catalan^WValencian"). I also hung around the Spanish free software research people with whom I'm going to spend a few months soon. Crazy Spaniards... I've no idea how I'm going to survive there. Oh, and Neal Walfield, who still stinks, and who thinks I have a British accent now (which he thinks is a bad thing while I took it as a compliment). Regarding new people, I had the great pleasure to meet and talk to Lennert Buytenhek. I talked to him on IRC a bit recently because he's involved in the big-endian ARM port and I've been hacking on the ARM based NSLU2 device. Lennert is quite frustrated because joining Debian is so hard. As it turns out, there's currently a six month wait to be assigned an Application Manager. I haven't really followed NM recently, but when I acted as Front Desk I tried to keep it less than approximately six weeks. Unfortunately, a great number of AMs resigned in the last few months and years, and it has been quite hard to find good new people as AMs. Lennert is the kind of person we really want to have in Debian since he's extremely kind, smart and productive. Given that the current situation seems really bad I decided to act as Application Manager again, but I only intend to do that temporarily. I'm sure I forgot lots of other things. But the summary is that it was a great weekend, with way too much stuff going on at the same time. And while I wish I could have devoted more time to my research, I gained some important insights and did one interview which was really informative.

Gianugo Rabellino, Matt Asay and others have been discussing "the meaning of open source". This touches on two things:

1. Free Software Business. How to make money with or from open source software. There was (still is, it's just not active) a mailing list, "Free Software Business" where this topic was rehashed several times in a number of interesting permutations, and all of the different business models were covered. The participants were all free software fans, with varying motivations that mostly centered around a free market view of the software world, and a desire to discuss ideas about how free software could be self-sustaining economically. Despite having some of the best minds in the business (people like Bob Young, Brian Behlendorf , Michael Tiemann, Russ Nelson [the list's host]) and a few economists, I don't think there was ever really a 'conclusion'. There are several models out there that work, but none of them is "perfect". They either involve holding something back (dual licensing, for instance), or don't really solve the problem of getting paid to produce software - service/support businesses are best when the consultants are working on paying gigs rather than creating software from scratch. It's more than obvious that there is a great deal of value in free software, and it's an extremely beneficial thing for companies that know how to take advantage of it. What's not so obvious is how to transfer enough of that value to the creators of the software to keep them going. The point being, "free software business" is not a solved problem, so expect to see various models, as people try things out. Some of them will have problems, and won't survive.
2. This leaves us with the crux of Gianugo's "rant", that some of these companies and groups are doing open source, but not in the true, open, community-oriented approach. I think he's right, but where I don't agree is with this:

   Also, I m not buying what Matt, Matthew and Ugo are saying about some sort of Darwinian selection being able to discriminate the good from the bad (assuming there is actually good and bad - I just tend to think we have different objectives): it s hard enough to move the CIO masses beyond the Open Source means Linux meme, go figure explaining why they should care to consider the difference between Open Source built within the virtuous cycle of community based development and Open Source as a pure distribution model of conceptually proprietary and closed to participation code.

   I see open source as being really strong right now, and do not deem it likely that that will change - it's survived Microsoft so far, survived the dot com bust, survived people trying to label it as a political movement, survived venture capital... Fundamentally, it just has too many things going for it. There's too much value, too much diversity, and ruddy health. So I think that where he sees people "not getting it", I see a competitive advantage for those who do. Things will sort themselves out with time.

As I already said, I wanted to do a little geek tour with Juerd, a fellow #perl6 guy. We did so and visited Fosdem, GPW and CLT. Some pictures of those events can be found here. Unfortunately I wasn't able to visit Amsterdam.PM for financial reasons. Nevertheless I had much fun on the tip! Therefor I'm already looking forward to go to the Easter Hegg, the German Linuxtag and some other events. See you there! PS: Did someone notice the fancy new CSS at http://perldition.org? :-)

As I already said, I wanted to do a little geek tour with Juerd, a fellow #perl6 guy. We did so and visited Fosdem, GPW and CLT. Some pictures of those events can be here. Unfortunately I wasn't able to visit Amsterdam.PM for financial reasons. Nevertheless I had much fun on the tip! Therefor I'm already looking forward to go to the Easter Hegg, the German Linuxtag and some other events. See you there! PS: Did any of you notice the fancy new CSS at http://perldition.org? :-)

Mickael Marchand noticed a problem with the mysql-dfsg backport on amd64. I don't own such hardware, but fortunately Christian Hammers was able to reproduce that problem, which seems not to be Debian related, so he filed a bugreport to the MySQL bug tracking system.

Warning: Very long post ahead. You have been warned! What? Tor is a Free Software project (revised BSD license), developed by Roger Dingledine and Nick Mathewson, which creates an infrastructure for anonymous TCP communication. From the project website:

Tor is a toolset for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, IRC, SSH, and other applications that use the TCP protocol. Tor also provides a platform on which software developers can build new applications with built-in anonymity, safety, and privacy features. Tor aims to defend against traffic analysis, a form of network surveillance that threatens personal anonymity and privacy, confidential business activities and relationships, and state security. Communications are bounced around a distributed network of servers called onion routers, protecting you from websites that build profiles of your interests, local eavesdroppers that read your data or learn what sites you visit, and even the onion routers themselves.

Tor also allows you to set up and/or use a so-called Tor hidden service, i.e., a server which offers some service (a website, ssh access, or similar) without revealing its IP to its users. Why? Why would you want to use Tor? Well, because you probably don't want anybody (neither state agencies, nor companies, nor "hackers", nor any other individuals or groups) to be able to record, analyze, and (ab)use information about your web browsing habits, or any other communication habits. For instance, you don't want Google to have a complete search-profile of you, which — even worse — might some day get in the hands of other parties. In the days of massive data retention you don't want all your electronic traces to be recorded, stored for ages, analyzed, and data-mined for dubious reasons and with even more dubious results and false conclusions drawn which might negatively affect you. If you're a human rights activist in China, you want anonymous communication. If you're a whistleblower, you want anonymous communication. The list is endless. For securing your communications, so that nobody is able to sniff your emails, your chat messages, your passwords, your private documents and conversations, you use encryption. For communicating anonymously you can use Tor. Combine both, and you have secure and anonymous communication. In case you're wondering whether criminals might abuse Tor, read the Tor Abuse FAQ. Short answer: yes, but if you're willing to break the law, you already have anonymity (open access points, stolen/prepaid mobile phones, etc.). You don't need Tor to do bad things if you're a criminal. If you're one of those horrible "oh, but I don't have anything to hide" guys, consider this: Say you have a drug/alcohol problem and want to visit an anti-drugs/anti-alcohol website or forum for help. Would you want the whole world, your neighbors, your co-workers, your boss, to know that, or would you rather want to keep that a secret? Say you have AIDS and want to get information on the web? Or, to make the example even more dramatic: Would you want some random guys to be able to watch you while you fuck your wife? No? So you have something to hide after all, right? My point is: Everyone has something to hide, even more, it is a basic human right to have the ability to hide something. It's called privacy. How? Tor implements a form of onion routing to, basically, push encrypted data through multiple Tor nodes (servers), before it reaches the final destination (e.g. a website). The result is that neither the website owner, nor a local eavesdropper, nor any single Tor server knows who requested that specific website, hence you are communicating anonymously. For more technical details, read the Tor overview and the Tor documentation pages. In order to use Tor, you have to install and run a local Tor client/daemon (this is not necessarily a Tor server!). On Debian, type apt-get install tor, on other systems you can get the respective binary packages or download the sources and compile Tor yourself. Usually Tor is used together with Privoxy, a configurable HTTP proxy which sanitizes your web-browsing experience by removing nasty banner ads, pop-ups, JavaScript, webbugs, cookies etc. etc. So: apt-get install privoxy. After installing and starting Tor and Privoxy, you can now configure your webbrowser to use Privoxy as an HTTP proxy (see below), and Privoxy will in turn use Tor to anonymize your communication if you add "forward-socks4a / localhost:9050 ." to your /etc/privoxy/config. Anonymizing various applications Most (but not all) of the following information is also covered in the very useful Torify HOWTO in the Tor wiki (I will add the missing information there, ASAP). As I'm pretty paranoid, I have checked every single of these configurations with Ethereal to ensure that the traffic is really anonymized. However, if you are paranoid, you shouldn't trust me, but rather test this stuff for yourself! Warning: DNS Leaks:
The biggest problem with many applications is that they leak DNS requests. That is, although they use Tor to anonymize the traffic, they first send a DNS request untorified in order to get the IP address of the target system. Then they communicate "anonymously" with that target. The problem: any eavesdropper with more than three brain cells can conclude what website you visited, if they see that you send a DNS request for rsf.org, followed by some "anonymous" Tor traffic. The solution: use Tor together with Privoxy, that prevents DNS leaks. Many non-HTTP-based applications are usually torified using a small tool called torify (e.g. by typing torify fetchmail), but often this approach has DNS leaking problems, see below.

• Webbrowser: Firefox, Mozilla, Galeon, Konqueror, ...:
  Most browsers can be torified by using Privoxy as an HTTP(S) proxy, i.e. using 127.0.0.1 as proxy host and 8118 as proxy port.
  For example, to torify Firefox go to Edit -> Preferences -> General -> Connection Settings -> Manual proxy configuration and configure:
  HTTP Proxy: 127.0.0.1 port 8118
SSL Proxy: 127.0.0.1 port 8118
FTP Proxy: 127.0.0.1 port 8118
SOCKS v5

  For Konqueror, go to Settings -> Configure Konqueror -> Proxy -> Manually Specify the proxy settings -> Setup and configure:
  HTTP Proxy: 127.0.0.1 port 8118
HTTPS Proxy: 127.0.0.1 port 8118
FTP Proxy: 127.0.0.1 port 8118

  Warning: Although Privoxy doesn't support FTP, you should configure the browser to use Tor + Privoxy for FTP. By doing that, you get an error message when you try to access ftp:// URLs, but at least you don't send untorified traffic without noticing.
  Warning: Firefox's "Live Bookmarks" (RSS feeds) are a problem if you switch from a torified to an untorified state sometimes (by switching or enabling/disabling the proxy). Firefox periodically requests all the feeds you're subscribed to. If you turn off Tor + Privoxy usage, they will be requested non-anonymously, and you won't even notice it! Solution: remove all "Live Bookmarks", or never switch to untorified browsing.
• HTTP-based tools: lynx, links, w3m, wget, curl, ...:
  Most other HTTP tools, such as wget, can be torified by setting the respective values for the http_proxy and HTTP_PROXY environment variables. Applications which don't honor http_proxy probably have a configuration option to set the HTTP proxy.
  Add this to your ~/.bashrc or similar config-file:
  http_proxy=http://127.0.0.1:8118/
HTTP_PROXY=$http_proxy
export http_proxy HTTP_PROXY

  Warning: links is a notable exception here. It does not honor the http_proxy environment variable! However, you can add http_proxy 127.0.0.1:8118 to your /etc/links.cfg and/or to your ~/.links/links.cfg. Or go to Setup -> Network Options and do the same there. Or use the -http-proxy 127.0.0.1:8118 command line option.
• Instant Messaging: Gaim:
  Go to Preferences -> Network -> Proxy and configure this:
  Proxy type: Socks 5
Host: 127.0.0.1
Port: 9050

  Gaim doesn't seem to leak DNS requests.
• Debian: Apt:
  Setting http_proxy is enough, as apt-get honors the http_proxy environment variable. But you can also add this line to your /etc/apt/apt-conf:
  Acquire::http::Proxy "http://127.0.0.1:8118/";

  apt-get doesn't seem to leak DNS requests.
  Warning: This will only work for deb/deb-src lines in /etc/apt/sources.list which use HTTP, because Privoxy does not support FTP.
• RSS-Reader: Akregator:
  Which RSS feeds you are reading tells quite a lot about you, and it's probably an information some people or organizations would be very interested in, I imagine. So anonymizing your feed-reader is quite important, IMHO. Akregator (a KDE RSS-reader application) uses Konqueror internally, so if you have set Konqueror to use Tor + Privoxy as HTTP-proxy, Akregator is safe, too.
  Akregator doesn't seem to leak DNS requests.
• Podcast Client: iPodder/Juice:
  Got to File -> Preferences -> Network settings and configure this:
  Use a proxy server: enable
Address: http://127.0.0.1
Port: 8118

  iPodder/Juice doesn't seem to leak DNS requests.
• Secure login: ssh:
  In order to torify all your ssh communications (ssh, slogin, sftp, etc.), edit your /etc/ssh/ssh_config and/or ~/.ssh/config and add:
  Host *
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050

  This requires socat, so: apt-get install socat.
  ssh doesn't seem to leak DNS requests.
  Warning: Simply using torify ssh does not suffice, it leaks DNS requests!
• Email: fetchmail:
  Properly torifying fetchmail is pretty ugly. Basically, torify fetchmail should be enough (one would think), but that leaks DNS requests! All tips offered in the Torify HOWTO suffer from this problem. The ideal solution would be to use tor-resolve (a small utility which resolves DNS requests via the Tor network, and hence anonymously) before fetching the emails, but I haven't found a good and simple solution for that. What I do right now is to hardcode IP addresses in my ~/.fetchmailrc config-file and then use torify fetchmail, which doesn't leak DNS requests. However, it leads to some ugly "fetchmail: Server CommonName mismatch: foo.bar.com != xxx.xxx.xxx.xxx" warnings.
  I always start fetchmail manually, often by clicking an icon in my IceWM toolbar. So I use the following line in my ~/.icewm/toolbar config-file:
  prog Fetchmail fetchmail xterm -e torify fetchmail

  Sometimes I invoke fetchmail from the command-line, too, so I have this alias in my ~/.bashrc:
  alias fetchmail='torify fetchmail'
Warning: Just for the record: torify fetchmail alone (i.e. used with hostnames in ~/.fetchmailrc) does not suffice, it leaks DNS requests!
• IRC: XChat:
  Go to Settings-> Preferences -> Network -> Network setup -> Proxy server and configure:
  Hostname: 127.0.0.1
Port: 9050
Type: Socks5

  Then make sure you check the "Use a proxy server" checkbox in the preferences dialog of the IRC server you want to use.
  XChat doesn't leak DNS requests.

You might also want to check out toraliases, a small shell script you can source from your ~/.bashrc file. It defines some functions and aliases which transparently direct the traffic of some (but not all!) programs through Tor. Applications which cannot easily be torified Anything not using TCP usually cannot be torified, as Tor only works for TCP.

• Non-TCP traffic from tools like ping, host, dig, nslookup, nmap, traceroute and lots more: as Tor only supports TCP, you're out of luck. However, you can safely use web-frontends such as dnsstuff.com over Tor + Privoxy (if they don't block Tor users, that is).
• whois: Although torify whois google.com leaks the DNS request for the whois-server (in this case whois.crsnic.net), it doesn't seem to leak the host you wanted to lookup. Can somebody confirm this? The safer method is to use a web-frontend, though.
• FTP: Although torify ncftp works, it leaks DNS requests! I haven't yet found a way to fix this (help is appreciated!). I also tried a few other FTP clients, without luck.
• GnuPG: Using gpg anonymously should work by using a proper http_proxy environment variable and by using a hidden Tor server as keyserver.
  Add this to your ~/.gnupg/gpg.conf:
  keyserver x-hkp://yod73zr3y6wnm2sw.onion
keyserver-options honor-http-proxy broken-http-proxy

  This works in theory. However, I noticed a problem: while gpg --recv-keys seems to work fine, gpg --refresh-keys leaks DNS requests! It seems GnuPG hard-codes the keyserver to keyserver.pgp.com in that case and leaks the DNS request for this domain name.
• Sending email (SMTP): Not sure how to do this with Tor. Many Tor nodes block SMTP per default. A better solution is probably Mixmaster/Mixminion.
• CVS, svn, Bittorrent/Azureus (untested HOWTO), usenet clients (pan, slrn), xmms: TODO. Haven't checked, yet.

Pitfalls to be aware of

• Rule #1: Don't spoil your anonymity by being stupid!
• IRC: Don't use nicks which hint at you, such as your real name, real-life nickname, acronyms which are known to "belong" to you or identify you. Don't use things like DCC which might reveal your real IP or real information about you. Disable all possibly "leaky" features/commands such as CTCP, VERSION requests, automatically accepting files from other IRC users, etc. etc.
• Don't accidentally access Tor hidden server URLs in an untorified browser. For example, if you would try to access the fictitious hidden server abc1234.onion, this request would travel over the net unencrypted and untorified. An eavesdropper could sniff that, enable Tor on his computer, go to abc1234.onion, and would know what you wanted to look at.
• Double-check that all applications you use don't leak DNS requests.
• Do not only configure your ~/.foobarrc config-files but also the config-files in /etc. Otherwise you might eventually use wget, ssh, lynx or other tools as root (instead of your normal, non-privileged user account) resulting in untorified traffic!
• Disable all "check for updates automatically", "notify upon new release" and similar "phoning home" features in all your applications. Most such features are probably not Tor-safe, i.e. will send/receive untorified traffic. Some candidates are Firefox, Adobe Acrobat reader, Gaim, and others.
• Never, never, think that Tor encrypts your traffic! It does not! The person who runs a Tor exit node can easily sniff all plain-text traffic! Tor only anonymizes your traffic, but it can still be sniffed plain-text at the beginning and at the end of the onion route! So don't do any HTTP-auth, or plain-text password sending for e.g. POP3, telnet, and so on. Always use encryption in addition to Tor!
• In general, spread only a minimum of information. Disable referrer sending (e.g. using Privoxy), disable cookies, kill webbugs (Privoxy), and so on.
• Watch your language, especially in public forums or IRC. A linguist can probably easily figure out which country/region you're from if you speak/write broken English or use certain idioms or false friends. This might or might not be a problem for you, but it's something you should bear in mind.
• If you're extra paranoid, you could set up your firewall to block all outgoing DNS traffic and force all applications to use Tor to resolve names. You could probably also block all outgoing non-Tor traffic...
• Another good idea is probably carrying an Anonym.OS LiveCD with you, so you can have a (more) anonymous communication wherever you go.

More information More information is available in the Tor documentation, the Tor wiki, and especially in the Tor FAQ. In addition, there's an IRC channel on Freenode (#tor), some slides and a video (torrent) about Tor you might find interesting. If you would like to help, you can run a Tor server, donate some money, or volunteer to do other things (code, debug, document, translate, and more). That's it for now. I'm very grateful for comments and suggestions, especially for hints on how to anonymize more applications. Also, if you notice any dumb mistakes I made, please leave a comment. Update 2006-03-07: Fixed typos, added link to the toraliases project (thanks Benjamin Schieder).

I've had the same mouse for probably 5 years, and I'm very happy with the result. Unfortunately, the batteries don't make good contact with the pins anymore and sometimes it takes ten minutes of delicate work to get it going again. So today, I went to buy a mouse, and surprise, surprise, I had forgotten how much it sucks to be a left-handed when purchasing certain objects. At the computer store, there were about 25 different mouse models, most of them featuring extra buttons, ergononic shape and other cool stuff. I was ready to buy something for even more than 20 if it was worth it, but due to the non-simmetrical shape of most of them, again I could only go for the cheapest models. I took a Creative optical mouse, and downgraded from a cordless mouse with 5 buttons + a wheel to a plain simple 3-button + wheel. At least it's USB... all the low end mice are still PS2. When I was looking for a laptop, one of the requirements was that the touchpad wasn't slightly displaced to the left. So right-handed-ish... I know there are shops with stuff for left-handed. Once, my mother bought me a pair of nail scissors designed for left-handed people. All that kind of stuff is generally very expensive and anecdotic, though. I wonder if we'll ever see laws that will force manufacturers to provide inverted items on demand. I want one of those cool mice.

Ivan never has enough, and has gone ways further on his Escriu b quest. Following up on my previous post on the X.Org Catalan changes, he has posted a list of characters that he still misses in our layout, in order to type really correct, orthotypograpically-wise, Catalan. Ivan, the king of nitpickers. :) Toni also posted a mini-HOWTO on how to get your geminated l's look a lucinants .

Via Luis, I really like this article. Debian has become way too corporate in a lot of ways it seems, and many of us are forgetting what it's like to try and do something daring. It's one of the reasons I find aj's DPL platform compelling, even though he hasn't said how he's actually going to encourage a faster tempo. People got really excited when I simply updated Debian's X packages to the latest upstream version. Granted, this is cool, but it's far from the exciting stuff I'm looking to do once we're finally caught up with upstream for real (almost there!) It doesn't have to be revolutionary or anything, but I want the XSF to be a center for exciting things to happen. Unfortunately, the most exciting X stuff is happening everywhere but Debian right now, despite my best efforts to open it up further.

And while I share helix's hate for the term "stop energy", the vast and deep flamefests that periodically consume the project really do seem to slow down our development noticeably when I just look at daily changelogs in sid. Julien may call me a teletubby for this (a metaphor I loathe for its utter stupidity) but debian-x has been almost 100% free of flamewars for the past year or so since I came on, and we've gotten a remarkable amount done. Contrast that with the previous era in which the fighting seemed to sap the will of the most productive and capable members of the team, all of whom seemed to focus much of their energy elsewhere as a result. While I think a mailing list code of conduct will be an important step in achieving this effect project-wide, I think a more fundamental solution is for individuals to attempt to build momentum themselves. Momentum like what I've tried to build with X seems to stop these energy-sucking flamewars dead in their tracks, and makes the project seem like a lot more fun place to be. I know that with all the flames going on with ndiswrapper and such I've been able to retreat in to XSF-land and find my happy place and be productive.

I dropped my cell phone a few months ago, and it ended up with a large crack across the LCD, which to me became the perfect excuse to finally get that Blackberry I’ve always wanted. However, given the uncertainty about the outcome of NTP v. RIM, I decided to hold off on my purchase till after the hearing last week, which was widely expected to provide some closure one way or the other as to whether RIM would be allowed to continue its service in the U.S. Unfortunately, there was no such closure to be found. So, I have a quick question to those more in the know than I: When the media talks of a “Blackberry shutdown”, I assume they’re just talking about a shutdown of the push email service, not a shutdown of all access to the Blackberry network? In other words, if Blackberry is shutdown, I presume I’d still be able to access the web etc.? Or would my brand new Blackberry become little more than an expensive paperweight?

One thing I'm wondering about is why bittorrent sites have an RSS feed with all torrents ever added to the site. Even for fairly small places like legaltorrents.com, there is no way I could imagine anyone being interested in indiscriminately downloading anything that has been added. I can see a point for subcategory feeds, but a catch-all? "We don't know what it's good for, but it's so Web 2.0!", probably.

English (Queen's English) is the only real language.

After this required short announcement by our main sponsor, Daniel Stone, lets go ahead and explain something of interest to the many Catalan X.Org users out there. Ivan and I have been looking at the issues that block a GNU/Linux user from using the compound geminate L, , instead of the more usual L L spelling. The and characters are unfortunately not included in ISO-8859-1, so fonts were the first big problem we faced. When modern X desktops started using True Type fonts by default, the de-facto free font in most distributions became Bitstream Vera as soon as they were licensed under a Free Software license back in 2003. Bitstream did not include the Unicode glyphs U+013F and U+0140, but some time after, chatting with daf, I learned he was working on Olwen, a Vera extension which would add proper Welsh coverage. He promptly added the Catalan glyphs, but Olwen never got widely exposed in distributions. Luckily, things are changing lately. Due to the lack of bugfixes or new releases of Vera, the list of Vera derivatives like Olwen started growing. The DejaVu project is building a font family, based on Vera, which merged many of these smaller purpose Vera derivatives, including Olwen. DejaVu, is, as far as I know, slowly replacing Bitstream Vera as the standard free, high quality true type font in free desktops. With the font blocker easily solvable now, the next problem was making the input easy. Some terminals, such as GNOME's or rxvt, allow you to insert Unicode typing a Unicode code point. The Spanish layouts don't provide a shortcut for it though, and if you try to do Level3-Shift+l, you'll get a Polish character, , that is of no use in neither Catalan, Spanish, Galician, Basque or other languages in the Spanish state. We wanted to replace that with , but when we had a look at it last Saturday night during our stay in Bruxelles, we couldn't find what the name for Unicode's U+0140/U+013F was in XKB-speak. So, as I said, on Sunday I went looking for Daniel and Keith to see if we would be clued up. The solution is easy: there is no name mapping, but you can use Unicode in 0x100XXXX notation directly in your X config file to make it work. He tried in his laptop, and why not, generated a patch for X.Org 7.0's xkeyboard-config. Daniel can't be that good, so he forced me to spread lies about the English language in this blog entry if we wanted the patch committed. :) Support for X.Org 6.8 and 6.9 isn't planned, unless you bribe your X maintainer to add a tiny patch. This has been implemented as an "es" keyboard extension (named cat ) because other systems don't have that feature in the Spanish layout, and X.Org wants to remain compatible with the rest. We'll have to add a

        Option          "XkbVariant"     "cat"

option to our keyboard section in xorg.conf. If you're not using X.Org 7.0, you might want to try:

xmodmap -e "keycode 46 = l L U140 U13f U140 U13f"

but I don't know if that'll work in all systems. To test in your keyboard, that'll probably be AltGr+l or AltGR+L . What we need to do now is to add support for the character in more fonts, alternative spellings for words using the ela geminada (ie, col labora and co labora ) in dictionaries, wordlists..., and of course, teach users about the avalability of this, and promote its usage.

As I mentioned on debian-project recently, Broadcom has been very supportive of our MIPS port. They donated several fast MIPS development boards (dual-core 800 MHz) to a number of Debian developers as well as machines for our mips and mipsel buildd network. Without those boards, we'd have a hell of a time keeping up and certainly wouldn't meet the Vancouver requirements. Broadcom recently released a new chip, the 1480, which is a quad-core CPU, and I managed to get hold of a development board based on this chip. I had some trouble with FedEx because they weren't sure how to handle a shipment worth several grant to an individual who is a volunteer working on a project which legally doesn't exist in the UK. However, the FedEx lady was really nice and said she'd sort it out... and the next day the board turned up. Unfortunately, SMP support in the MIPS kernel was broken so I was only able to run the board in non-SMP mode: it really sucks having a quad-core CPU and then you can only use one core! There were also DMA errors when using an IDE PCI card. Fortunately, the SMP problems got solved in the meantime, and using the generic IDE driver works. Now that I have the board running, I compiled GCC 4.1 and my next step will be to build the Debian archive to see how well GCC 4.1 work on MIPS.