Search Results: "ron"

17 March 2010

Steve Kemp: Are you sure you don't mind me going without you?

Recently I received a small flurry of patches to my blog compiler, from Chris Frey. These patches significantly speedup rebuilding a static blog when using Danga's memcached. The speedup is sufficiently fast that my prior SQLite based approach is no longer required - and (re)building my blog now takes on the order of 5 seconds. On the topic of other people's blogs I've been enjoying David Watson's recent photo challenge. I was almost tempted to join in, but I'm not sure I could manage one every day - Although I can pretend I recently carried out my my first real photoshoot. I'm still taking pictures of "things/places" but I'm starting to enjoy "people" more. With a bit of luck I'll get some more people to pose in the near future, even if I have to rely upon posting to gumtree for local bodies! ObFilm: Love Actually

16 March 2010

Ben Hutchings: KVM reliability

Russell Coker writes:
I had also hoped that it would be really reliable and work with the latest kernels (unlike Xen) but it is giving me problems with 2.6.32 on Opteron.
This is a regression caused by a recent security fix (CVE-2010-0298, "KVM: x86 emulator: fix memory access during x86 emulation"). It appears to affect only recent Linux kernels running as guests on AMD systems, and it will probably be fixed soon.

Russell Coker: Starting with KVM

I ve just bought a new Thinkpad that has hardware virtualisation support and I ve got KVM running. HugePages The Linux-KVM site has some information on using hugetlbfs to allow the use of 2MB pages for KVM [1]. I put vm.nr_hugepages = 1024 in /etc/sysctl.conf to reserve 2G of RAM for KVM use. The web page notes that it may be impossible to allocate enough pages if you set it some time after boot (the kernel can allocate memory that can t be paged and it s possible for RAM to become too fragmented to allow allocation). As a test I reduced my allocation to 296 pages and then increased it again to 1024, I was surprised to note that my system ran extremely slow while reserving the pages it seems that allocating such pages is efficient when done at boot time but not so efficient when done later. hugetlbfs /hugepages hugetlbfs mode=1770,gid=121 0 0 I put the above line in /etc/fstab to mount the hugetlbfs filesystem. The mode of 1770 allows anyone in the group to create files but not unlink or rename each other s files. The gid of 121 is for the kvm group. I m not sure how hugepages are used, they aren t used in the most obvious way. I expected that allocating 1024 huge pages would allow allocating 2G of RAM to the virtual machine, that s not the case as -m 2048 caused kvm to fail. I also expected that the number of HugePages free according to /proc/meminfo would reliably drop by an amount that approximately matches the size of the virtual machine which doesn t seem to be the case. I have no idea why KVM with Hugepages would be significantly slower for user and system CPU time but still slightly faster for the overall build time (see the performance section below). I ve been unable to find any documents explaining in which situations huge pages provide advantages and disadvantages or how they work with KVM virtualisation the virtual machine allocates memory in 4K pages so how does that work with 2M pages provided to it by the OS? But Hugepages does provide a slight benefit in performance and if you have plenty of RAM (I have 5G and can afford to buy more if I need it) you should just install it as soon as you start. I have filed Debian bug report #574073 about KVM displaying an error you normally can t see when it can t access the hugepages filesystem [6]. Permissions open /dev/kvm: Permission denied
Could not initialize KVM, will disable KVM support One thing that annoyed me about KVM is that the Debian/Lenny version will run QEMU instead if it can t run KVM. I discovered this when a routine rebuild of the SE Linux Policy packages in a Debian/Unstable virtual machine took an unreasonable amount of time. When I halted the virtual machine I noticed that it had displayed the above message on stderr before changing into curses mode (I m not sure the correct term for this) such that the message was obscured until the xterm was returned to the non-curses mode at program exit. I had to add the user in question to the kvm group. I ve filed Debian bug report #574063 about this [2]. Performance Below is a table showing the time taken for building the SE Linux reference policy on Debian/Unstable. It compares running QEMU emulation (using the kvm command but without permission to access /dev/kvm), KVM with and without hugepages, Xen, and a chroot. Xen is run on an Opteron 1212 Dell server system with 2*1TB SATA disks in a RAID-1 while the KVM/QEMU tests are on an Intel T7500 CPU in a Thinkpad T61 with a 100G SATA disk [4]. All virtual machines had 512M of RAM and 2 CPU cores. The Opteron 1212 system is running Debian/Lenny and the Thinkpad is running Debian/Lenny with a 2.6.32 kernel from Testing.
Elapsed User System
QEMU on Opteron 1212 with Xen installed 126m54 39m36 8m1
QEMU on T7500 95m42 42m57 8m29
KVM on Opteron 1212 7m54 4m47 2m26
Xen on Opteron 1212 6m54 3m5 1m5
KVM on T7500 6m3 2m3 1m9
KVM Hugepages on T7500 with NCurses console 5m58 3m32 2m16
KVM Hugepages on T7500 5m50 3m31 1m54
KVM Hugepages on T7500 with 1800M of RAM 5m39 3m30 1m48
KVM Hugepages on T7500 with 1800M and file output 5m7 3m28 1m38
Chroot on T7500 3m43 3m11 29
I was surprised to see how inefficient it is when compared with a chroot on the same hardware. It seems that the system time is the issue. Most of the tests were done with 512M of RAM for the virtual machine, I tried 1800M which improved performance slightly (less IO means less context switches to access the real block device) and redirecting the output of dpkg-buildpackage to /tmp/out and /tmp/err reduced the built time by 32 seconds it seems that the context switches for networking or console output really hurt performance. But for the default build it seems that it will take about 50% longer in a virtual machine than in a chroot, this is bearable for the things I do (of which building the SE Linux policy is the most time consuming), but if I was to start compiling KDE then I would be compelled to use a chroot. I was also surprised to see how slow it was when compared to Xen, for the tests on the Opteron 1212 system I used a later version of KVM (qemu-kvm 0.11.0+dfsg-1~bpo50+1 from Debian/Unstable) but could only use 2.6.26 as the virtualised kernel (the Debian 2.6.32 kernels gave a kernel Oops on boot). I doubt that the lower kernel version is responsible for any significant portion of the extra minute of build time. Storage One way of managing storage for a virtual machine is to use files on a large filesystem for it s block devices, this can work OK if you use a filesystem that is well designed for large files (such as XKS). I prefer to use LVM, one thing I have not yet discovered is how to make udev assign the KVM group to all devices that match /dev/V0/kvm-*. Startup KVM seems to be basically designed to run from a session, unlike Xen which can be started with xm create and then run in the background until you feel like running xm console to gain access to the console. One way of dealing with this is to use screen. The command screen -S kvm-foo -d -m kvm WHATEVER will start a screen session named kvm-foo that will be detached and will start by running kvm with WHATEVER as the command-line options. When screen is used for managing virtual machines you can use the command screen -ls to list the running sessions and then commands such as screen -r kvm-unstable to reattach to screen sessions. To detach from a running screen session you type ^A^D. The problem with this is that screen will exit when the process ends and that loses the shutdown messages from the virtual machine. To solve this you can put exec bash or sleep 200 at the end of the script that runs kvm. start-stop-daemon -S -c USERNAME --exec /usr/bin/screen -- -S kvm-unstable -d -m /usr/local/sbin/kvm-unstable On a Debian system the above command in a system boot script (maybe /etc/rc.local) could be used to start a KVM virtual machine on boot. In this example USERNAME would be replaced by the name of the account used to run kvm, and /usr/local/sbin/kvm-unstable is a shell script to run kvm with the correct parameters. Then as user USERNAME you can attach to the session later with the command screen -x kvm-unstable . Thanks to Jason White for the tip on using screen. I ve filed Debian bug report #574069 [3] requesting that kvm change it s argv[0] so that top(1) and similar programs can be used to distinguish different virtual machines. Currently when you have a few entries named kvm in top s output it is annoying to match the CPU hogging process to the virtual machine it s running. It is possible to use KVM with X or VNC for a graphical display by the virtual machine. I don t like these options, I believe that Xephyr provides better isolation, I ve previously documented how to use Xephyr [5]. kvm -kernel /boot/vmlinuz-2.6.32-2-amd64 -initrd /boot/initrd.img-2.6.32-2-amd64 -hda /dev/V0/unstable -hdb /dev/V0/unstable-swap -m 512 -mem-path /hugepages -append "selinux=1 audit=1 root=/dev/hda ro rootfstype=ext4" -smp 2 -curses -redir tcp:2022::22 The above is the current kvm command-line that I m using for my Debian/Unstable test environment. Networking I m using KVM options such as -redir tcp:2022::22 to redirect unprivileged ports (in this case 2022) to the ssh port. This works for a basic test virtual machine but is not suitable for production use. I want to run virtual machines with minimal access to the environment, this means not starting them as root. One thing I haven t yet investigated is the vde2 networking system which allows a private virtual network over multiple physical hosts and which should allow kvm to be run without root privs. It seems that all the other networking options for kvm which have appealing feature sets require that the kvm process be started with root privs. Is KVM worth using? It seems that KVM is significantly slower than a chroot, so for a basic build environment a secure chroot environment would probably be a better option. I had hoped that KVM would be more reliable than Xen which would offset the performance loss however as KVM and Debian kernel 2.6.32 don t work together on my Opteron system it seems that I will have some reliability issues with KVM that compare with the Xen issues. There are currently no Xen kernels in Debian/Testing so KVM is usable now with the latest bleeding edge stuff (on my Thinkpad at least) while Xen isn t. Qemu is really slow, so Xen is the only option for 32bit hardware. Therefore all my 32bit Xen servers need to keep running Xen. I don t plan to switch my 64bit production servers to KVM any time soon. When Debian/Squeeze is released I will consider whether to use KVM or Xen after upgrading my 64bit Debian server. I probably won t upgrade my 64bit RHEL-5 server any time soon maybe when RHEL-7 is released. My 64bit Debian test and development server will probably end up running KVM very soon, I need to upgrade the kernel for Ext4 support and that makes KVM more desirable. So it seems that for me KVM is only going to be seriously used on my laptop for a while. Generally I am disappointed with KVM. I had hoped that it would give almost the performance of Xen (admittedly it was only 14.5% slower). I had also hoped that it would be really reliable and work with the latest kernels (unlike Xen) but it is giving me problems with 2.6.32 on Opteron. Also it has some new issues such as deciding to quietly do something I don t want when it s unable to do what I want it to do.

Wouter Verhelst: Stuff

I'm running again. No, not running in a bubulle style; I'm running for DPL. It started as a fairly last-minute decision because I would hate to see an election with only one candidate, but then two other people submitted their candidacy right after me. As I stated in my candidacy email, I had "a concert" this weekend. Actually, there were three two-hour performances; two on saturday, one on sunday. Early on, I also suggested videotaping the performance (using the excellent dvswitch, for which I added a patch to support crossfading transitions) to the organising group within the choir, and they liked that. Apart from dvswitch, we used the theatre's own audio mixing setup (so I wouldn't have to worry about that too much) and the theatre's intercom system. I'd made some tally lights, but in the end we were not entirely able to use them, because there were some issues to be dealt with that meant I couldn't quite get them working properly. So on saturday, I was in the theatre pretty early to get everything set up, did some explanations to the volunteers who would do the actual recording, drove my dad (who'd done the direction for the video parts) home, went home, and found my bed at around midnight. On sunday, I got up fairly early, booted my laptop to update the live images with some fixes for some issues we'd encountered on saturday, left for the theatre fairly early again, set up the extra camera position, found out that one of the laptops was actually running at 100Mbit rather than a gigabit and that therefore the extra camera wasn't going to work, learned that one of the volunteers for sunday had done some other camera work for another performance right before that, for which he'd rented some high-end DV-capable cameras. So we broke down the two low-end set-ups, set up the high-end cameras, connected them to the laptops, recalibrated the whitebalance and the diaphragm setting, and restarted the streams. Then one laptop started failing. Since we had had to remove one camera anyway, I just replaced it. By that time, I had about 15 minutes left before sunday's performance would start, so I went to prepare for that. After the performance had finished, I found out that something had gone wrong with the sound of sunday's performance; rather than music, we only heard crackling all the time. Luckily, the sound had also been separately recorded to a different medium, and that recording is fine, so we only need to resync the audio to the video, which should not be a problem. All in all, I had an extremely busy weekend. The alert reader will note that I didn't mention 'food' anywhere in the above paragraphs, mostly because I hardly ever found the time to eat. But it was also extremely satisfying. We still have some postprocessing to do, but I expect I'll put some videos online once we've done that. They're truly stunning, at times. And then yesterday I still had to spend some time writing my DPL platform, and doing some campaigning work. All in all, I didn't find my bed until approximately 4 AM... oh well. I look forward to the election time, and hope that I will do well. I don't need to win, but I'd hope my result will be at least as good as the last time... Update: we used the theatre's audio setup, not video setup -- oops :-)

Joachim Breitner: kexec saved my day

Yesterday evening, when returning from a two-day trip with no connectivity, I found my server to be broken. I still reacted on ping, but no service would respond. I tried to restart it using my hoster s web interface, but it would not come back up. I booted into the recovery system and checked the hard disk, but could not find any issues. File system checks went through without a hitch. But it would still not boot. Unfortunately, my hoster does not provide access to the system console, so I had no idea what was going wrong. I never did anything with kexec, (a relatively new feature of the Linux kernel to act as a bootloader to load another system) and I was very positively surprised to find that it works out-of-the-box and flawlessly: I was able to load my system s kernel and initrd from the recovery system and successfully booted it. I then ran lilo and rebooted right again, which now worked. I m not sure if running lilo fixed it, or the clean shut-down, nor do I know what caused the problem in the first place, but kexec saved my day here.

Stefano Zacchiroli: Elections!

DPL elections strike back So ... here we go, it's DPL election time again, and I'm a candidate. After a few long days of suspense with me as the only candidate, we are now 4 candidates. I was not particularly happy of the scenario of being the only candidate: it would have given (both to the world and to DDs) an unjustified impression of disinterest towards the position, and would have also made quite pointless to discuss topics of Debian "politics" ( so, NOTA, what do you think of time-based freezes? ). With 4 candidates, campaigning is now much more useful, interesting, and challenging, as the archives of -vote already show. As last year, I've setup a page documenting my attempt, which includes an index of questions posed to the candidates on -vote. (To maintain the index, it helps quite a lot to maintain one-subject-per-question. Hint, hint.) Good luck to all candidates!
... and don't forget the DPL campaigning law! (with credits to Rhonda)

Ian Wienand: Handling hostnames, UDP and IPv6 in Python

So, you have some application where you want the user to specify a remote host/port, and you want to support IPv4 and IPv6. For literal addresses, things are fairly simple. IPv4 addresses are simple, and RFC2732 has things covered by putting the IPv6 address within square brackets. It gets more interesting as to what you should do with hostnames. The problem is that getaddrinfo can return you multiple addresses, but without extra disambiguation from the user it is very difficult to know which one to choose. RFC4472 discusses this, but there does not appear to be any good solution. Possibly you can do something like ping/ping6 and have a separate program name or configuration flag to choose IPv6. This comes at a cost of transparency. The glibc implementation of getaddrinfo() puts considerable effort into deciding if you have an IPv6 interface up and running before it will return an IPv6 address. It will even recognise link-local addresses and sort addresses more likely to work to the front of the returned list as described here. However, there is still a small possibility that the IPv6 interface doesn't actually work, and so the library will sort the IPv6 address as first in the returned list when maybe it shouldn't be. If you are using TCP, you can connect to each address in turn to find one that works. With UDP, however, the connect essentially does nothing. So I believe probably the best way to handle hostnames for UDP connections, at least on Linux/glibc, is to trust getaddrinfo to return the sanest values first, try a connect on the socket anyway just for extra security and then essentially hope it works. Below is some example code to do that (literal address splitter bit stolen from Python's httplib).
import socket
DEFAULT_PORT = 123
host = '[fe80::21c:a0ff:fb27:7196]:567'
# the port will be anything after the last :
p = host.rfind(":")
# ipv6 literals should have a closing brace
b = host.rfind("]")
# if the last : is outside the [addr] part (or if we don't have []'s
if (p > b):
    try:
        port = int(host[p+1:])
    except ValueError:
        print "Non-numeric port"
        raise
    host = host[:p]
else:
    port = DEFAULT_PORT
# now strip off ipv6 []'s if there are any
if host and host[0] == '[' and host[-1] == ']':
    host = host[1:-1]
print "host = <%s>, port = <%d>" % (host, port)
the_socket = None
res = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_DGRAM)
# go through all the returned values, and choose the ipv6 one if
# we see it.
for r in res:
    af,socktype,proto,cname,sa = r
    try:
        the_socket = socket.socket(af, socktype, proto)
        the_socket.connect(sa)
    except socket.error, e:
        # connect failed!  try the next one
        continue
    break
if the_socket == None:
    raise socket.error, "Could not get address!"
# ready to send!
the_socket.send("hi!")

15 March 2010

Adnan Hodzic: FoolControl, Gnome, Squeeze?

Other day I read Refreshing The Ubuntu Brand , upcoming visual style changes for Ubuntu 10.04 Lucid Lynx and my only comment to this whole story was Don t tell me you re moving window control elements to the left side of window in Lucid Side Frown
Either way if this is the revolutionary change for Ubuntu, then I have a visual style suggestion for Squeeze as well. Since Gnome is default desktop environment in Debian and as it looks like right now 2.30 will be what s going to be included into Squeeze; nothing much, or nothing really will visually change in Gnome by then. So how about this Lamp For some time now I ve been troubled by some things in Gnome, and what s bothering me the most is System menu. Why? Well because the list of utilities listed both under Administration and Preferences is so long that it s almost useless. So without losing your precious seconds of your life and losing fair amount of nerves well this is what s required to find what you were initially looking for. Interesting enough is the fact (please do stress) that Gnome consists of a fine thing called gnome-control-center which is not included in any of Gnome menus. IDK I really do enjoy Gnome vanilla flavor (overall am fan of vanilla flavored apps.) but what I ve been doing for quite time now is fixing this ridicule by having my own version of Systems menu, which consists of Add/Remove App. (synaptic) and Fool Control (gnome-control-center) Final result is that I get what I m looking for in couple of seconds without any lost nerves Victory Either way, after reading the redesigning Ubuntu article, this only encouraged me to go live with this suggestion. I know it s a minor change, but how about we have this implemented into Squeeze? Of course change my silly button labels; if not, what are my options? Make package that will do this for you? Rolls Eyes I m really interested to hear your input on this topic. Talking about redesigning stuff, is anyone up to do start doing this with Debian homepage? Yea? Count me in Wink

Russell Coker: Types of Security Tokens

The Security Token Wikipedia page doesn t seem to clearly describe the types of token. Categories of Security Token It seems to me that the following categories encompass all security tokens:
  1. Biometric tokens which seems rather pointless to me. Having a device I control verify my biometric data doesn t seem to provide a benefit. The only possible benefit seems to be if the biometric token verifies the identity of the person holding it before acting as one of the other types of token.
  2. Challenge-response devices. The server will send a challenge (usually a random number) and will expect a response (usually some sort of cryptographically secure hash of the number and a shared secret). A challenge-response device may take a password from the user and combine it with the challenge from the server and the shared secret when calculating the response.
  3. Time-based tokens (one-time passwords). They will provide a new pseudo-random number that changes periodically, often a 30 second time interval is used and the number is presumably a cryptographically secure hash of the time and a shared secret. This requires a battery in the token and the token will become useless when the battery runs out. It also requires that the server have an accurate clock.
  4. Use-based tokens. They will give a new pseudo-random number every time a button is pressed (or some other event happens to indicate that a number has been used). These do not work well if you have multiple independent servers and an untrusted network.
Here is my analysis of the theory of token use, note that I am not sure how the implementations of the various token systems deal with these issues.
  1. Biometric security seems like a bad idea for most non-government use. I have seen a retina scanner in use at a government office that made some sense as the people being scanned were in a secure area (they had passed some prior checks) and they were observed (to prevent coercion and the use of fake eyes). Biometric authentication for logging in over the net just seems like a bad idea as you will never know if you can trust the scanner.
  2. It seems to me that challenge-response devices are by far the most secure option. CR is resistant to replay attacks provided that it is not possible to have re-used challenges. If the calculation of the response includes a password (which is performed on some tokens that resemble pocket calculators) then a CR token will meet the something you have and something you know criteria.
    One potential problem with CR systems is that of not including the server or account ID in the calculation. So if I was to use a terminal in an insecure location to login to a server or account with data that is not particularly important then it would be possible for an attacker who had compromised the terminal to perform a Man In The Middle (MITM) attack against other servers. Of course you are supposed to use a different password for each account, if you do this then a CR token that includes a password will be resistant to this attack but I expect that people who use tokens are more likely to use one password for multiple accounts.
  3. Time-based tokens have a weakness in that an attacker who can immediately discover the number used for one connection could then immediately login to other servers. One example of a potential attack using this avenue would be to compromise a terminal in an Internet cafe, steal a hash used for logging in to server A and then immediately login to server B. This means that it may not be safe to use the same token for logging in to servers (or accounts) that have different sensitivity levels unless a strong password was used as well I expect that people who have hardware tokens tend to use weaker passwords.
    Also one factor that will make some MITM attacks a lot easier is the fact that the combination of the hash from the token and the password are valid for a period of time so an attacker could establish a second connection within the 30 second interval. It seems that only allowing one login with a particular time-coded password is the correct thing to do, but this may be impossible if multiple independent servers use the same token.
    Time based tokens expire when the battery runs out. The measures taken to make them tamper-proof may make it difficult or impossible to replace the battery so a new token must be purchased every few years.
  4. Use-based tokens are very similar to time-based tokens, it s just a different number that is used for generating the hash. The difference in the token is that a time-based token needs a battery so that it can track the time while a use-based token needs a small amount of flash memory to store the usage count. The difference at the server end is that for a use-based token the server needs a database of the use count of each token, which is usually not overly difficult for a single server.
    One problem is the case of a restore from backup of the server which maintains the use count database. The only secure way of managing this is to either inspect every token (to discover it s use count) or to issue a new password (for using password plus token authentication). Either option would be really painful if you have many users at remote sites. Also it would be required to get the database transaction committed to disk before an authentication attempt is acknowledged so that a server crash could not lose the count this should be obvious but many people get these things wrong.
    An additional complication for use-based tokens comes with the case of a token that is used for multiple servers. One server needs to maintain the database of the usage counts and the other servers need to query it by secure links. If a login attempt with use count 100 has been made to server A then server B must not accept a login with a hash that has a use count less than or equal to 100. This is firstly to cover the case where a MITM attack is used to login to server B with credentials that were previously used for server A. The second aim of this is to cover the case where a token that is temporarily unguarded is used to generate dozens of hashes while the hashes could be immediately used it is desirable to have them expire as soon as possible, and having the next login update the use count and invalidate such hashes is a good thing.
    The requirement that all servers know the current use count requires that they all trust a single server. In some situations this may not be possible, so it seems that this only works for servers within a single authentication domain or for access to less important data.
Methods of Accessing Tokens It seems that the following are the main ways of accessing tokens. To avoid driver issues and allow the use on random machines it seems that the USB keyboard and manual entry types of token are best. While for corporate Intranet use it seems that a SmartCard is best as it can be used for opening doors as well, you could use a USB keyboard token (such as a Yubikey) to open doors but it would be slower and there is no off the shelf hardware. For low cost and ease of implementation it seems that use-based tokens that connect via the USB keyboard interface are best. For best security it seems that a smart-card or USB interface to a device with a keypad for entering a password is ideal.

14 March 2010

DebConf team: DebConf10 call for contributions (Posted by DebConf10 Talks Team)

The Debconf team is excited to announce that we are now accepting proposals for contributions to this year s Debian conference! We invite you to submit proposals for how you would contribute until the deadline: May 1st, 2010, 23h59 UTC. There are many ways you can contribute, you could present a technical paper, host a panel discussion, put on a tutorial, do a performance, an art installation, a debate, host a meeting (BoFs, or Birds of a Feather Session), or other possibilities that you devise. This year we are also accepting proposals for tracks a thematic grouping around a particular subject, and people to coordinate those tracks. If you are looking for ideas of things that you could contribute, or have ideas for things that you would like to see happen at Debconf, have a look at the Contribution Brainstorm page. DebConf talks will be broadcast live on the Internet where possible, unless otherwise requested. Videos of the talks will be published on the web along with the presentation slides and papers. Step 1. Submit Proposal Proposals should provide an overview of your proposed contribution, similar to an abstract, and be no more than 600 words. Since contributions can cover a range of issues, please describe what your proposal covers, be it political (Free Software, law, advocacy, access, etc.), technical (d-i, OpenPGP, etc.), social (Debian structures and groups). It s okay to hit all three of these. Your proposal should also include some information on why you re qualified to present, or coordinate this topic. For example, you can include links to posts you have made to Debian mailing lists or other material that indicates your qualifications. Proposals and their abstracts will be accepted until May 1st, 2010, 23h59 UTC. To submit your proposal, go to http://debconf10.debconf.org/register.xhtml and register as an attendee. Once you are registered, there is a Submit a proposal link. You will see your proposal on the site. You can choose between different presentation types. If you are unsure what type you should use, please read our definitions first. If it s not there for some reason, or you have questions, please contact us immediately. Step 2. Committee Review The review committee for this year will make its decision by May 1st, 2010. All correspondence will be done by email. Step 3. Paper Submission Like last year, we are asking for papers to be submitted along with the presentations. A full paper is optional, however we strongly encourage you to submit one if possible as we intend to provide written information along with transcripts of the sessions for later viewing. Having written papers in advance will allow us to get translations done to help non-native-English speakers feel more comfortable with the topics presented. Papers are due by July 1st, 2010, and should cover the topic in reasonable depth (3 pages A4 text, plus pictures and diagrams). We will use LaTeX to typeset the proceedings. Please submit your paper formatted in LaTeX. Should you be unfamiliar with LaTeX earlier submission in plain text is also fine. Step 4. Live Presentation Longer presentations may have a break in the middle and should include workshop items that directly involve the participants. If using slides or any other presentation, please consider that your audience will consist of people who use free software, and your choice of application to prepare and display the slides should reflect this if at all possible. Fine Print Publication Rights Debconf requires non-exclusive publication rights to papers, presentations, and any additional handouts or audio/visual materials used in conjunction with the presentation. The authors have the freedom to pick a DFSG-free license for the papers themselves and retain all copyrights. The presentations will be recorded, and may be broadcast over the Internet. Any copies of the presentation will be made available under a license like the MIT/X11 license. Failure to Submit In the event that a deadline is missed we reserve the right to revoke any offer to present.

13 March 2010

Joerg Jaspert: Vacation fun

As some people know, I had a vacation in February. Only very few knew that I was heading down to Taiwan. I was leaving Germany at the 8th and back here on the 24th of February. Yes, that neatly fit this years Chinese New Years parties. Was at home for four days (and at work for one), after which I went off to this years Cebit. Until the day I arrived in Taiwan it looked like we do not have a booth there, but then everything changed while I was having a nice vacation. I really have to thank Alex here. Cebit was actually my task, but he jumped in and did all the preparatory work that was needed right in the time I started my vacation. Without that either my vacation would have been much different and less nice or we wouldn t have had a booth. I am back home since some days now, without any travel plans for the next few weeks/months to come. Though I wish I had a job (and private life) that would allow me to just go off again, ie. something I could do everywhere where there is net. Meh. Of course I did take some pictures (more than 2500) and also some notes during the trip. And having a blog that one or two people read, I think I should bore you all with it. But hey, you can skip it if you want. :) Yes, I should really take some time and work a bit on the pictures I took. Right now I only selected around seven hundred which I show off to people (and to link to from here), but they are basically just copies. While some are great in itself, many can need a bit of work here and there (cut out unimportant, blurry, colors, the usual stuff). And I also prepared multiple shots for HDR processing or to make a panorama view from, but thats something that takes time and has to wait. Just for the record, I think that this, this and this are very nice ones.
This is a public version of this text, so names and also various events and days have been cut out. Yes, people who know those in my pictures will know names, but thats no reason to feed the evil $searchengine caches more with hits for their names. Flight down, 8 Feb. Flight down from Frankfurt, using KLM so it went via Amsterdam and Bangkok (short Transit stop) to Taipei. The days before we had lots of snow and cold and all that stuff which tends to get flights cancelled, but I was lucky, none of that for me. The only slightly annoying thing was in Taipei, where KLM demonstrated how much a Business class Priority luggage sign is worth for them sometimes. We came in half an hour before schedule, but then had to wait an hour for our luggage (while all of economy luggage passed by). I think the business class Priority sign actually meant Priority to wait . The food on the flight from AMS to BGK was good, having a No Lactose Meal actually tasting well. Can t remember what it was, but better than the fish I got from BGK to TPE. Catering from Thai Airways, they do not know anything besides Fish when preparing No lactose meal and then they also manage to prepare it in the most boring way possible. Sad thing, but happened four times now, all the times I had catering prepared by them. Other than those points, no trouble at all. Immigration was done in about 20 seconds, customs didn t want to look at me, just the asians in front and behind me, all fine. Met my Travel Companion outside and off we got. First to the Taipei Main Station, where we got some food. Some rice (with a bit of meat) and red sauce, together with a soup. And a glass of tea, but that had an oily surface. Umm. Guess the cup wasn t all that clean, we both skipped that. Then I tried to get money from an ATM. First had to find one that actually wants my european credit card. And then, as usual when I travel offroad, I managed to forget my pin. Bah. Well, found an HSBC somewhere that actually takes my Maestro card, so at some point I got money (a pretty helpful thing, that is).
Wednesday, 10 Feb. First night in a new Timezone which is 7 hours before my normal one. Makes my body think I should not be allowed to sleep much. So it only allowed me some two hours before I woke up again. It didn t listen to any argument and didn t care that it was all dark and night, so I couldn t sleep more. Wellwell, got up at the same time as $TC then, we got some breakfast, egg/ham sandwich and tea. From there I set off and juggled my way through Taipei MRT over to YuanShan Station.
Confucius Temple
It is good for a visit of the Confucius Temple and also the Dalongdong Baoan Temple which is right beside it. Later on I got told there are much more impressive Confucius temples elsewhere, but it is still a good place to start off. And it just means I have one more reason for another visit. After those two temples I moved over to the Taipei Fine Arts Museum. Took about an hour to go through that museum, which again made it pretty clear to me: Some people just have too much time and money. I do not even get the setup in the entry hall, even though it looks nice, and let s not start about the rest they show there. Definitely not my thing, Fine Arts , nothing worth to waste money on, at least for me.
Having fun
So I left there after just about an hour and fought the MRT again. This time it spit me out at the Taipei Zoo station and I went through that. Appearently the nice sunny weather let some animals have fun, and that all in public. Tssk. Won t someone please think of the children?! :) Otherwise it is a pretty big area with lots of animals. Not all of them seem to be in areas that (I think) are big enough for them, though I m no expert in that. But it looked small for them. Also, while I thought it pretty well visited, many people there, I bet for Taiwanese standards the zoo was nearly empty. At least looking at their preparations for queues, like in front of the koala house, they are used to deal with like 20 times the amount of people. I count me lucky that there haven t been that many, else I would have needed to wait everywhere, which I hate. Queues are bad, mmmmmkay? As I already mentioned, the weather that day was pretty nice. Mostly sunny, only few clouds and some 25 til 29 degrees. No rain. Now that s a nice winter day.
HotPot
Dinner was scheduled for 1800h, a Hot Pot session. 5 people in total. Appears you order the meat for the hot pots from the waiter and let them bring it, but all the additional stuff you get yourself. They have a big selection of vegetables, seafood, bread/cake like stuff and whatnot you can take. I first also went there and got a small dish with stuff. But stopped right then and let the Taiwanese do the rest. Better that way, they know it. And hey, we had been 5 and they got stuff for like 35 people. :) It was a nice 2 hour session, in which we had lots of different kinds of additions to the hotpot (two pots actually, one spicy and one not spicy). I know of some meats, some vegetables, but then there also was said to be duck bladder and some other organs which they couldn t (or didn t want to? :) ) name in english. Now, db sounds worse than it is, it doesn t have a special taste and is mostly boring, I think. Of course, not liking seafood, I skipped on that, but about all the rest was nice. I like Hot Pot :) After this session the other 3 left for various reasons and $TC and me had a nice walk around/through the University, before going back to $TCs place.
Thursday, 11 Feb Had another short night as I only got to bed around 2AM, just to get up around 9AM. Additional fun that my body again insisted in being elsewhere, not accustomed to the timezone in Taiwan yet, waking me up a few times during the night.
Fishermans Wharf
Got an easypass for the MRT as that is a little better than buying a chip for every single trip and battled with MRT again, finally emerging at Danshui station. Sat a bit at the beach eating breakfast before finally starting a walk out to the Fisherman s Wharf . It is some 4 kilometers to it, made out as a bicycle path, but I just walked. Visited Fort San Domingo on the way and then went all the way up in that Wharf area, another kilometer. Got me a nice peppermint ice tea, though it was a funny process to it. The salesperson didn t speak english and my chinese is - well, limited is a too soft word to describe it. But it worked pretty well, with us pointing around on the menu and then the salesman showing me various additions, if I would want them. Like showing a milk bottle Want milk in tea? , showing sugar,
Spongebob
At the bridge in that Wharf I was approached by some Asian people, asking me to take a picture of them in front of the bridge. Fine, did it, did it again in another setting and then, when done, they asked me where I am from. When I said Germany they thanked me in German which surprised me a little. :) That is something funny anyways. Wherever I go, people look. They aren t much used to someone my size. Kids are usually more direct with pointing, grinning and sometimes crossing my way on purpose, just saying hi (some kind of test of courage, I bet). Every now and then I also get asked if they can take a picture with me. Right now there are like 20 pictures of me (that I know of) all over Taiwan that I didn t take, nor have. :) Now, who here loves Spongebob? This is the country for you! The picture only shows one small table, you can find much much more. Same goes for Hello Kitty and other such stuff.
Food!
Dinner this day was initially planned to be at some place called Maokong, but then plans changed, as $TC and others that we should meet there needed to pack for the next day. So $TC and me just went to the Shilin Night Market. Right beside it is a big food plaza. Like a thousand square meters (or probably a few more, what do I know, I haven t measured it, but it wasn t all too big) having some hundred or more little kitchens where you can get a very broad mix of things. We had cold noodles with some slightly spicy sauce and then some fresh guava juice. Tasty tasty. Though noodles with chopsticks was something new, but it worked out well enough. Later I had a noodle soup, that was something more tricky, but in the end you just need to find the right trick.
Little crowded
After food we went through the night market. Well. Parts of it. It s big. And its crowded. About the most crowded place I ve been to. Heck, half of Taiwan was in that street area. :) Didn t buy anything. The only stuff I thought interesting was a T-Shirt with a Taiwan map on it, but do try getting some in my size. Ha. Small asians. They say they have big sizes, but then its XL only (or a totally ugly color, brrr). We finished early here, as the packing for the trip starting Friday right in the middle of the night still needed to be done, and getting up at 6AM you do not want to stay up too late. But it was nice there anyways.
Friday, 12 Feb Got up early. I mean, early. 6 AM. ARGS. Not really my favorite thing to do, but as our plan said we have to get the HighSpeedRail to Kaohsiung at 7:42AM there wasn t much else to do. Pretty nice train, lots of room to sit, even in second class. Don t know business, but probably even more. And it looks fast, if I can trust the display it had we where going near 300km/h. After arrival in Kaohsiung we went out to $TC s place to get our luggage away, as it is annoying to move around with all the stuff. I got another easypass here, this time a lent one from $TC s Mother. It s fun, there are two MRT systems in Taiwan using the same technics, basically the one in Kaohsiung is built like the one in Taipei, using the same style of RFID cards (and chips for single trips). But they made them incompatible. One can not use a pass from Taipei in Kaohsiung and vice versa, for whatever reason. It s not like the two cities are very far away from each other, it would actually make sense to be compatible, but that is probably what stops them doing it. We took this Friday and also the Saturday to get around Kaohsiung, visiting several places. As the MRT in Kaohsiung has a different station design at every of its stations we did look at some of those too. Especially Formosa Boulevard , a station that has two points describing it best:
one part of the dome of light
Right outside one of the exits is a funny little cosmetic surgery. I only remember it thanks to the english name of the Doc, but somehow I don t think it was chosen wisely: Dr. Luck . . Aiik, you need be lucky to get out there looking better? Dr. Unlucky might not be good for you taking a wrong cut? :) (Yes, I know, I m crazy, don t tell me. Ok, if you really want, queue up, you aren t the first.) At one point we went out to Sizihwan, where we walked to a ferry. Actually we tried renting bikes, but this little bike shop wasn t prepared for a small german like me, not having bikes my size. (And no safe way to get the saddle of the smaller ones into a height I could start using the bike). So walk it was, not nice bike trip. Still ok, got to the ferry, got over to the other side and had a nice walk there to the/along the coast.
one more temple
We bypassed multiple temples there, at one of which a great cite came up: Temples in Taiwan are something like 7-eleven. They are everywhere. I love it. And somehow it s true, you can find one around each other corner, a little like those churches in Puebla, Mexico. In the evening we had been out for a night market. The first one was pretty boring. While having been announced in the MRT station near it to be a night market for New Years things, we found it to be about empty and very boring, so we went over to another one nearby. Wasn t as crowded as the Shilin one, and not as large, but nice. At the end of it had been a small game stand, where one could shoot balloons to get some price. I ended up getting the biggest available, as this isn t really a challenge. How anyone can miss hitting a balloon there I don t know. They are only like 3m away, not moving, you have clear view, and if you really need it even get a laser pointer on your gun. Anyways, was fun enough, I repeated shooting enough times to get the biggest available Patrick doll they had (a meter). Hrhr. Who likes Spongebob, eh? Speak up! :) I got a few nice shots of the night skyline of Kaohsiung late one of those evenings, where we went to the Dream Mall and up into the big wheel . Also had some game spots there, but turns out I m not as good throwing things at a target than I am shooting at them. We also went out to a historical sugar refinery, looking around. Of course, this being Chinese New Years eve, there haven t been that much people moving around, it was pretty empty. And the people working there all just waiting for their shift to end. But still got some pretty nice pictures from and around it. Also tasted a new kind of icecream (new for me that is), which actually has a kind of sand like feel. I like it. Like I actually liked most of the food, pretty much all the time. Of course everyone has things one does not like, but in general the food is great. Especially the largely different style compared to the european way of cooking. I ate lots of things I won t ever touch here in Germany.
Sunday, 14 Feb; Monday 15 Feb A nice two days some way out of Kaohsiung. Found out I am pretty good at losing various things: I got a bag full of (Li n w ; Syzygium samarangense; wax apple, love apple, java apple, bellfruit, see the wikipedia page for more on it) and about an hour later I totally had lost track where it ended up. The same happened with a big bag of tissues I had bought. Somehow both of the bags got feet and ended up elsewhere without telling me.
ocean place
That one evening we went out for Dinner, a big party of people. Was a place right beside the ocean, so yes, seafood. Oh yay, I don t like that too much. Happy enough there must have been a conversation going on like Hey people, this silly german doesn t like seafood much, lets get one other option too . So we had a plate with some cold chicken on. But I tried various of the seafood dishes too and liked some of them. Actually some I had tried in Germany at some point where I learned to hate them and now I liked them as I got them in Taiwan. People also seemed to think I am good at using chopsticks, though I think I am just fiddling around and be lucky when I get my stuff. But maybe it just means Hey, it looks funny what you are doing. Keep going, we like to laugh. :) ). We actually had been around this place a little earlier that day, taking a walk around it, drinking some tea, that type of thing. And got a set of nice bottles of fresh coconut juice. My first time i got it fresh, I think. But I also managed to lose track of it. I bet somewhere there is a party consisting of tissues, (Li n w ) and a bottle of coconut juice, singing classic songs like Strike, we escaped the german Lunch the other day happened to be a big family meetup. Lots of people, lots of chatting, lots of fun (I think :) ). When we arrived it started out by about all of them trying to get me to sit down somewhere. And me bad impolite german not wanting to. But there was no way to escape, so finally they won and I sat, with a number of people around me, trying to chat with me. Which is actually hard work for both sides, but every now and then gets a good laugh. But my chinese is far far away from being useful for even a small meaningful sentence, so they had to activate their english knowledge, especially for the times $TC had been elsewhere and couldn t help out translating. Somehow the job got done, they asked their questions and I hope they mostly understood my replies. Bad me, speaking too fast english sometimes. We had a nice lunch there, with the most notable part being the way I got called to it. It s interesting how much you can say by just using body language and pointing. (Oh, of course food was very good too, but that fact is one you can take as a given, even if I don t mention it again). Later on a dice game started, and after a short explanation of the rules I joined in. Took only a little, but then I got the rules, its easy. I didn t get any of the chatting that happened during the whole game, but it was very much fun and really insane (so would also fit DebConf very well) and nearly no times you do need words to understand what is going on. I like this game and they gave me a set of dices, so I can train it and come back to play again. Ha. A bit after that dice game people unpacked some of the sweets I brought from Germany. One of them being spicy. Really nicely spicy, at least for the average Taiwanese. If you happen to have been at DebConf9 and also had the luck to be one of those I offered some chocolate or wine gum to, you know what I write about. The stuff here was slightly less spicy, but still more than enough to leave a nice impression. They had lots of - well - fun trying them out, gave a good set of laughter. And ordered more for next time. Uhoh, I already know which I will take with me, but then there have to be special preparations before testing. :) I ve also got invited to come back next year. Might be I haven t made the worst impression. Well, lets see if I can take this up and if they still want me in a years time. At least my chinese should be much better by then, given another year of training. (Even if I find it actually hard to learn. For some reason its not easy for me to memorize language things, at least not chinese. Oh my, one year, I should have some 3 words more, I hope :) ). In the evening, back in Kaohsiung, $TC also told me rules of a second dice game that I had seen some people playing. Also seems like fun if played with enough people.
Tuesday, 16th Feb
35mins delay
We started the trip by taking the train from Kaohsiung to Taitung. We had been a little late for it, had to run from the MRT to the train station. Silly me took that as an opportunity to fall down a set of stairs. Only to discover, when getting to the platform, that the Taiwan Railway wanted to give me a feeling of home, delaying the train. First by 31 minutes, later it got up to 43 minutes. Somehow felt like Deutsche Bahn, being late is also their best quality. When the train finally got in we saw that we had been lucky to have seats reserved, this train was full, lots of people moving around within Taiwan that day. We got to Taitung all fine and had the Hotel send someone to pick us up at the train station, as it is a long way from the train station over to the Hotel. Got our room and left it pretty soon again to look around.
Hello Kitty
Spotted a funny little Hello Kitty car and got some food for lunch followed by a walk along the beach. Found some sculptures made of wood, where one of it seems to have some bad stomach problems
Wooden figure with stomach problems
Later on we had a nice and long walk through Taitung Forest Park. Took some time, got some nice pictures. It was getting dark when we got back into town, time for Dinner already. Yay, food. Next day a train trip to Hualien was set, but only for the afternoon, so we had time to look around. We first went through the Peinan Cultural Park, but unfortunately
Park your dog
we had no dog to park there. After that we rented a scooter to get a little farther away from the train station. After getting some fuel for it we headed to National Museum of Prehistory (which was much more interesting than the Fine Arts one earlier) and later on just drove around some time. Just looking around, without a clear direction, simply for the look around. Was fun, but too short actually. But we had to head back at some point to catch our train over to Hualien. In Hualien we again got a Taxi to the Hotel. We left that soon after arriving, Hotel rooms are boring, and it was food time again anyways. Only a little annoying, one of the few days we had rain and I can imagine something nicer than rain when I am outside. But somehow this damn weather doesn t bother to stop raining when I go out.
Thursday, 18th Feb A full day stay in Hualien, no Hotel change. Just a trip over to the Taroko Gorge.
Taroko Gorge
Which is a very nice and impressive place to visit, sure too much for a single day, I definitely have to come back here. (Well, I have to come back for multiple other reasons, but this sure is one). We took the bus to the first stop in that park, somewhere around the Leader Village Taroko. Probably a nice place for a night or ten.
Nice place?
There was a short trail we followed, getting some more pictures and impressions, but it didn t take us long until we where back in a queue for a bus, this one going all the way up to the furthest away spot a bus goes to. There we had some lunch before we wanted to start walking around. Unfortunately (for my nose) we then passed by a place selling Stinking Tofu . Other customers there said that this is not the best available, but I got a taste of it. Don t really need that version more often, even though its not as bad as it smells or the name suggests. We walked a little there and I got some more pictures before we set off to climb the stairs to the Hsiang-Te Temple of Taroko .
Hsiang-Te Temple of Taroko
Looking down from there we saw a lot of buses which was our sign to get back to the bus station, as the last bus was scheduled to get off somewhere at 3 in the afternoon. And as we didn t have a Hotel place here it is pretty helpful to catch the bus. So we queued up once more and had a bus ride back to the train station. Next time there should definitely be a night or more in some Hotel somewhere there. On the way back we took a slight detour, having another time at the beach, not enjoying the weather which insisted on a little rain and lots of wind.
Friday, 19th Feb This day saw us moving to Luodong, another place with a day of rain. Still, my gps log tells me we where moving around a lot, even though I do not have a single picture from the whole day. And as pictures are the main source of my memory ups. Well, I remember the rain, of course. I also remember that I got a steak at some place and that we bought various kinds of food (and tea and juice! :) ) on one of those markets, eating it in our Hotel room. (Rain is bad, mmmmmmmkay?!). And there was some kind of park too, in which I got a funny little game. Oh well.
Saturday, 20th Feb
Way to go
There is nothing nicer than starting a day with a fun bus trip in the morning. Going high up into the mountains. On a day where the clouds reach down to some level underground, more or less. Using very narrow streets and the usual mountain like narrow curves. While not being able to see far. We got up to Taipingshan all fine but once there we had to wait for our room to be ready. So we took a walk around. Actually not a walk. More a climb. Being a mountain place, and those mountains never having heard of those nice invention called elevator or that other named escalator, people setup stairs. Millions of them.
atmosphere
Besides the stairs it is a very nice place to walk around. We took various of the trails through the area and besides me sometimes nearly falling down (damn slippery grounds) it was great. At some point in the afternoon we got our room and also ate some instant noodles before taking another trail, one that took us some 2 hours. You should really take a look at all the pictures I took, as the few I link directly sure do not present this area right. Taipingshan starts at Picture 434 and continues up to Picture 634, but a good number of them is from the second day too.
Sunday, 21st Feb Contrary to the day before there wasn t a single cloud to spot. Ok, ok, there have been some, pictures proof it, but it was a nice sunny day. Nice start of the end of the trip through Taiwan (still one and a half day in Taipei to follow, but the trip around country is over). Of course that meant taking a lot of pictures again,
a sunny morning
and soon after breakfast we took the BongBong Train over over to the Maosing station. There are again a few prepared trails, most of which we took. We only skipped on the one going to the waterfalls, as it wouldn t have fit into our schedule. Got compensated with a pretty adventurous track with lots of nice sights following the old train tracks. Thanks to a number of landslides there is no train going anymore and thus it is a nice way to walk.
rails
It is a 1500m long walk and sometimes you really have to be careful, but it provides many great views and is a really nice trail. Got a few hundred pictures, yay. Including a proof I ve really been there. I hate pictures with me, really, they are just shit by default (maybe I shouldn t be in them?), but in total I got 11 pictures that proof I was really there and not only sent a camera (four of those are included in that gallery I always link to). We got back to the main place around noon and after Lunch we took the Bus back down to Ylan. The bus was scheduled to go at 15:30h, so we went to it fifteen minutes earlier. While we had a sunny day, clouds had started coming in at 15:00h, and at the time the bus started it was all white and there wasn t much too see for the driver again.
me was there
But it turned out that this makes no difference. The driver must have a very prominent wish to die while taking his passengers with him. Or he is insane. Or has a very important appointment somewhere else. Whatever it is, he drove down, on narrow streets, very tight curves, not too much sight and all that with a speed thats incredible. Several times a part of our bus was out over the abyss. I found it pretty fun and all that, especially as it made for a set of very nice views all over the area, and appearently another passenger thought similar, but $TC did have quite the opposite of thoughts and did not feel all that great. We arrived in Ylan one hour before schedule, which, on a 70km trip through mountain area should give a hint how it was. Took a minute off to regenerate and then we wanted to look around a bit. Having our luggage with us that is annoying so we tried to leave that at the train stations baggage service counter. Turns out the personell there is a bunch of crackmonkeys not following their own advertised opening times. Probably wanted to go home early, those lazy dolts. Fortunately the people at the ticket counter were better and exchanged our tickets and we took the Train back to Taipei a little earlier than initially planned.
Monday, 22nd Feb Bad day for all those people who had a nice vacation during Chinese New Year, they had to get back to work. I didn t have that problem and so went around Taipei a bit. Initially I had plans of going to some tourist spots, like the National Palace Museum or others, but then just skipped them all and just took a walk through various spots of Taipei. Basically just Get out of MRT station XY, walk around . The GPS track later told me that I actually covered about 15 km that way, and my feet agreed to that. At some point I did bypass a German Cuisine restaurant, called Zum Fass . Don t ask me how the food is there, I wasn t in, but still had to grin a little when reading the menu. In the evening we went out to get me some Tea to bring back to Germany. Well, some is some kind of understatement, it was lots, as much as I could pack. But good stuff, some of it is steaming right now right besides the keyboard here. Yummy.
Tuesday, 23rd Feb
lantern
As always, the worst day of any vacation. The day you have to leave and go back home. My flight was scheduled for 20:00h, so I took another half a day just looking around Taipei. Which made me even more jealous of those not having to get away, as I happened to pass by some preparations for the Lantern festival. Which happened only a few days after I got away. Next year I have to plan better and stay longer, what I saw on preparations, and that only at the Sun Yat-sen Memorial Hall definitely makes it worth it. Timing in the afternoon was very tight, I actually got the last bus that was in time for my flight. Just one later would have created some trouble, my total time on the airport was something around 30 minutes before boarding started. Just enough to get the minimum needed amount of postcards written and off to boarding. The flight back was boring. Food from TPE to BGK was a pretty good variation on No lactose , some noodles with stuff. Of course from BGK over to AMS it was fish again, same boring Thai Catering as usual. I was unable to sleep well on the flight. Somehow I woke up very often despite earplugs and eye mask. With all that I turned out to be half asleep when we arrived in Amsterdam and so I accidently took an opened half litre bottle of water with me through security. Funny, they didn t spot it. Instead they decided to make a big fuss about my camera bag, asking me in detail what I have in there, supposedly trying to check if I know what I carry. And made an even bigger show of scanning it again. And that bad liquid that those idiotic stupid laws written by brainless monkeys from our governments forbid got no notice at all. Imagine what I could have done to air safety with it! Oh my. Back in Germany my luggage got out first, so no waiting at all. I passed by work to leave some weight there (Hello boss, want some tea?) and went back home. This was also my first trip where I had a noticable jetlag after coming back. For nearly a week my damn body insisted on being in Taiwans timezone, waking me up at times I should sleep, feeling tired when I should be awake. Tssk. Conclusion of this trip: I will be back in Taiwan for sure. I don t care if you take this as a promise or threat, but I will be back! :)

Biella Coleman: Stuff I have been enjoying (a freaken lot)

So in the last week I have read some stuff, seen some presentations, and visited some sites that I have really loved, so here they are to share: Trollcats (this will take my power point slides to a whole NEW level) and here is one for all the free software geeks, in particular. I finally read Manuela Carneiro da Cunha fantastic Prickly Paradigm press book Culture and Culture: Traditional Knowledge and Intellectual Rights. If you don t know jack about the thorny issues around indigenous knowledge an IPR, the first 2/3 provides a pretty darn good introduction rooted not only in an explanation of trade treaties, the limited repertoire available for indigenous groups to politically respond, but a great story about a specific frog that secretes a sticky film that basically F s you up (if you let it seep in your open wounds). It is entertaining. The last 1/3 takes a far more theoretical turn and will be harder to understand for novices (it helps if you have like at least a BA, possibly MA in anthro, best if you have a PhD from her academic home, U of Chicago). It is there where she discusses the relationship between culture as reflexive (hey, peoples of the world, we have x, y, c culture) as lived unreflexively (the unconscious plane of norms that helps guide perception and action). I loved her theoretical somersaults whereby she explained how contradictions between the two are experienced as anything but a contradiction. Ok so today I went to this conference Radars and Fences III (where I presented my anon/scientology talk for the first time 3 years ago!). I was not able to stay the whole day but I saw Ricardo Dominguez & Amy Sara Carroll from the Electronic Disturbance Theater present on the Transborder Immigrant Tool, which I knew about but did not know how infused it was in poetry, poetry that is, in fact, an integral part of its arsenal. Their presentation was fantastic and it reminds me the great political work being done at the interface of art and technology (and believe me, these 2 are rabble rousers. UCSD, who helped fund the project, are not all that happy they did and they also get not hate mail they get but the HATE mail). Then I saw Laila El Haddad & Mushon Zer-Aviv present on an amazing project You are Not Here which is a bit hard to explain briefly but I will try (and their site introduces it as an urban tourism mash-up. It takes place in the streets of one city and invites participants to become meta-tourists of another city. So basically there are two interlinked sites (NYC and Baghdad and Tel Aviv and Gaza) where you can be a tourist (though the physical place to follow the symbols are only in NYC and Tel Aviv). You need a map. You get a map. The map, once put up to the light shows two cities/places with symbols that indicate a special spot on the map. You find the physical spot, there is sticker or other sign with a phone number, you call, and you hear a story not about NYC or Tel Aviv (where you would physically go) but about Baghdad or Gaza and a story that pertains to the area of the map that overlaps where you are in NYC or Tel Aviv. We saw a bunch of examples and they were riveting and powerful.

Biella Coleman: Stuff I have been enjoying (a freaken lot)

So in the last week I have read some stuff, seen some presentations, and visited some sites that I have really loved, so here they are to share: Trollcats (this will take my power point slides to a whole NEW level) and here is one for all the free software geeks, in particular. I finally read Manuela Carneiro da Cunha fantastic Prickly Paradigm press book Culture and Culture: Traditional Knowledge and Intellectual Rights. If you don t know jack about the thorny issues around indigenous knowledge an IPR, the first 2/3 provides a pretty darn good introduction rooted not only in an explanation of trade treaties, the limited repertoire available for indigenous groups to politically respond, but a great story about a specific frog that secretes a sticky film that basically F s you up (if you let it seep in your open wounds). It is entertaining. The last 1/3 takes a far more theoretical turn and will be harder to understand for novices (it helps if you have like at least a BA, possibly MA in anthro, best if you have a PhD from her academic home, U of Chicago). It is there where she discusses the relationship between culture as reflexive (hey, peoples of the world, we have x, y, c culture) as lived unreflexively (the unconscious plane of norms that helps guide perception and action). I loved her theoretical somersaults whereby she explained how contradictions between the two are experienced as anything but a contradiction. Ok so today I went to this conference Radars and Fences III (where I presented my anon/scientology talk for the first time 3 years ago!). I was not able to stay the whole day but I saw Ricardo Dominguez & Amy Sara Carroll from the Electronic Disturbance Theater present on the Transborder Immigrant Tool, which I knew about but did not know how infused it was in poetry, poetry that is, in fact, an integral part of its arsenal. Their presentation was fantastic and it reminds me the great political work being done at the interface of art and technology (and believe me, these 2 are rabble rousers. UCSD, who helped fund the project, are not all that happy they did and they also get not hate mail they get but the HATE mail). Then I saw Laila El Haddad & Mushon Zer-Aviv present on an amazing project You are Not Here which is a bit hard to explain briefly but I will try (and their site introduces it as an urban tourism mash-up. It takes place in the streets of one city and invites participants to become meta-tourists of another city. So basically there are two interlinked sites (NYC and Baghdad and Tel Aviv and Gaza) where you can be a tourist (though the physical place to follow the symbols are only in NYC and Tel Aviv). You need a map. You get a map. The map, once put up to the light shows two cities/places with symbols that indicate a special spot on the map. You find the physical spot, there is sticker or other sign with a phone number, you call, and you hear a story not about NYC or Tel Aviv (where you would physically go) but about Baghdad or Gaza and a story that pertains to the area of the map that overlaps where you are in NYC or Tel Aviv. We saw a bunch of examples and they were riveting and powerful.

12 March 2010

Russell Coker: CAL Self-Serving and Useless

Me Thinking about Copyright in front of Le Pensevr Brendan Scott linked to a couple of articles about CAL (the Copyright Agency Limited) [1]. I have previously written about CAL and the way that they charge organisations for the work of others without their consent [2]. My personal dispute with CAL is that they may be charging people to use my work, I have not given them permission to act on my behalf and will never do so. If they ever bill anyone for my work then it will be an act of piracy. The fact that the government through some bad legislation permitted them to do such things doesn t prevent it from being piracy you can t disagree with this claim without supporting the past actions of China and other countries that have refrained from preventing factories from mass-producing unauthorised copies of software. The first article concerns the fact that last year CAL paid more than $9,400,000 in salary to it s employees (including $350,000 to it s CEO) while it only paid $9,100,000 directly to the authors [3]. It also spent another $300,000 to send it s executives to a junket in Barbados. It did give $76,000,000 to publishers on the assumption that a proportion of this money will be returned to authors of course said publishers could have used the money to have holidays in Barbados. CAL doesn t bother to check who ends up with shares of the $76,000,000 so it s anyone s guess where it ends up. The second article is by James Bradley who is an author and director of CAL [4]. He claims that much of the $76,000,000 was distributed to authors, although I m not sure how he would have any idea of how much it was which is presumably why he used the word much instead of some other word with a clearer meaning such as most . He also notes that CAL invested $1,000,000 in projects specifically designed to promote the development and dissemination of Australian writing , which sounds nice until you consider the fact that none of the authors (apart from presumably the few who sit on the CAL board) had any say in the matter. Can I take a chunk of the $9,400,000 that is paid to CAL employees and invest it in something? If not then why not? If they can invest money that was owed to other people then why can t I invest their salaries? James also says The issue of how well CAL serves rights-holders and authors and artists in particular is a vital one which is remarkably silly. He is entirely ignoring the fact that some rights holders don t want to be served by CAL at all. The fact that CAL can arbitrarily take money for other people s work is an infringement on their rights. He further demonstrates his ignorance by saying Without CAL and the licences we administer, users educational institutions, government agencies and corporate organisations, to name just a few would be required to seek permission every time they reproduced copyright material or run the risk of legal action for copyright infringement of course any educational institution can use Creative Commons licensed work [5]. I ve previously written about the CK12 project to develop CC licensed text books for free use [6]. There s no reason why the same thing can t be done for university text books. In the discussion following Claudine Chionh s LUV talk titled Humanities computing, Drupal and What I did on my holidays [7] it was suggested that it should be possible to gain credit towards a post-graduate degree based on work done to share information this could mean setting up a Drupal site and populating the database or it could mean contributing to CC licensed text books. Let s face it, a good CC text book will be read by many more people than the typical conference proceedings! James says that CAL is used Instead of having to track down individual rights-holders every time they want to reproduce copyright material . The correct solution to this problem would be to change the copyright law such that if a reasonable attempt to discover the rights-holder fails then work is deemed to be in the public domain. The solution to the problem of tracking down rights-holders is not to deny them their rights entirely and grant CAL the right to sub-license their work! He also makes the ridiculous claim Whereas in the age of the physical book schools and universities could have bought fewer books and made up the difference by using photocopies, it is now possible for an organisation to buy a single set of digital materials and reproduce them ad infinitum which implies that CAL is the only thing saving the profits of authors from unrestricted digital copying. Of course as CAL seems to have no active enforcement mechanisms and they apparently charge a per-student fee they really have no impact on the issue of a single licensed copy being potentially used a million times extra use apparently won t provide benefits to the author and use in excess of the licensing scheme won t be penalised. He asks the rhetorical question After all, why go to the expense of creating a textbook (or some form of digital course materials) if you are going to sell only a half-dozen copies to state education departments . The answer is obvious to anyone who has real-world experience with multiple licensing schemes you can sell one single copy and make a profit if the price is high enough. The smart thing for the education departments to do would be to pool their resources and pay text book companies for writing CC licensed texts (or releasing previously published texts under the CC). The average author of a text book would probably be very happy to earn $100,000 for their work, the editorial process probably involves a similar amount of work. So if the government was to offer $300,000 for the entire rights to a text book then I m sure that there would be more than a few publishers tendering for the contract. According to the CIA World Fact Book there are 2,871,482 people in Australia aged 0-14 [8], that means about 205,000 per year level. CAL charges $16 for each primary and secondary student so the government is paying about $3,280,000 every year per year level. Even in year 12 the number of text books used is probably not more than 10, so it seems to me that if all the money paid to CAL by schools in a single year was instead used to fund Creative Commons licensed text books then the majority of the school system would be covered! The universities have a much wider range of text books but they also have higher CAL fees of $40 per student. After cutting off the waste of taxpayer money on CAL fees for schools that money could be invested in the production of CC licensed university text books.

Matt Brubeck: Discovering Urbit: Functional programming from scratch

C. Guy Yarvin is a good friend of Mencius Moldbug, a pseudonymous blogger known for iconoclastic novella-length essays on politics and history (and occasionally computer science). Guy recently published under his own name a novel project in language and systems design. His own writing about his work is entertaining but verbose (as Moldbug's readers might expect), so I will attempt to summarize it here. Nock, Urbit, Watt First there is Nock, a tool for defining higher-level languages comparable to the lambda calculus, but meant as foundational system software rather than foundational meta mathe matics. Its primitives include positive integers with equality and increment operators, cons cells with car/cdr/cadr/etc., and a macro for convenient branching. Nock uses trees of integers to represent both code and data. Next, Guy provides the rationale for Nock. In short, he asks how a planet-wide computing infrastructure (OS, networking, and languages) would look if designed from first priniciples for robustness and interoperability. The answer he proposes is Urbit: a URI-like name space distributed globally via content-centric networking, with a feudal structure for top-level names and cryptographic identities. Urbit is a static functional name space: it is both referentially transparent and monotonic (a name, once bound to a value, cannot be un- or re-bound). Why does this require a new formal logic and a new programming language? In Urbit, all data and code are distributed via the global namespace. For interoperability, the code must have a standard format. Nock's minimal spec is meant to be an un ambiguous, unchanging, totally standardized basis for computation in Urbit. Above it will be Watt, a self-hosting language that compiles to Nock. Urbit itself will be implemented in Watt, so Nock and Watt are designed to treat data as code using metacircular evaluation. The code A prototype implementation of Watt is on GitHub. It is not yet self-hosting; the current compiler is written in C. Watt is a functional language with static types called molds and a mechanism for explicit lazy evaluation. (I was suprised to find I had accidentally created an in com patible lazy dialect of Nock despite its goal of unambiguous semantics just by implementing it in Haskell.) The code is not fully documented, but the repository contains draft specs for both Watt and Urbit. Beware: the syntax and terminology are a bit unconventional. Guy has offered a few exercises to help get started with Nock and Watt:
The Nock challenge:
Write a decrement operator in Nock, and an interpreter that can evaluate it.
Basic Watt:
Write an integer square root function in Watt.
Advanced Watt:
How would you write a function that tests whether molds A and B are orthogonal (no noun is in both A and B)? Or compatible (any noun in A is also in B)? Are these functions NP-complete? If so, how might one work around this in practice?
If you want to learn more, start with these problems. You can email your solutions to Guy. Will it work? I find Urbit intellectually appealing; it is a simple and clean architecture that could potentially replace a lot of complex system software. But can we get there from here? Guy imagines Urbit as the product of an ages-old Martian civilization:
Since Earth code is fifty years old, and Martian code is fifty million years old, Martian code has been evolving into a big ball of mud for a million times longer than Earth software. (And two million times longer than Windows.) Therefore, at some point in Martian history, some abject fsck of a Martian code-monkey must have said: fsck this entire fscking ball of mud. For lo, its defects cannot be summarized; for they exceed the global supply of bullet points; for numerous as the fishes in the sea, like the fishes in the sea they fsck, making more little fscking fishes. For lo, it is fscked, and a big ball of mud. And there is only one thing to do with it: obliterate the trunk, fire the developers, and hire a whole new fscking army of Martian code-monkeys to rewrite the entire fscking thing. This is the crucial inference we can draw about Mars: since the Martians had 50 million years to try, in the end they must have succeeded. The result: Martian code, as we know it today. Not enormous and horrible tiny and diamond-perfect. Moreover, because it is tiny and diamond-perfect, it is perfectly stable and never changes or decays. It neither is a big ball of mud, nor tends to become one. It has achieved its final, permanent and excellent state.
Do Earthlings have the will to throw out the whole ball of mud and start from scratch? I doubt it. We can build Urbit but no one will come, unless it solves some problem radically better than current software. Moldbug thinks feudalism will produce better online reputation, but feudal reputation does not require feudal identity; it is not that much harder to build Moldbug's reputation system on Earth than on Mars. I still have not figured out the killer app that will get early adopters to switch to Urbit.

Stefano Zacchiroli: RC bugs of the week - issue 24

RCBW - #24 Some pause, and here we go with another RCBW issue. The pause has involved various Debian-related work, such as preparing OCaml batteries included for Squeeze and of course preparing my DPL platform. Without any further ado, here are this week's squashes: Random points:

Dirk Eddelbuettel: RcppArmadillo 0.1.0

Besides the new RcppExamples, another new package RcppArmadillo got spun out of Rcpp with the recent release 0.7.8 of Rcpp. Romain and I already had an example of a simple but fast linear model fit using the (very clever) Armadillo C++ library by Conrad Sanderson. In fact, I had used this as a motivational example of why Rcpp rocks in a recent talk to the ACM chapter at U of Chicago which, thanks to David Smith at REvo, got some further exposure. Now this example is more refined as further glue got added. Given that both Armadillo and Rcpp make use of C++ templates, the actual amount of code in RcppArmadillo is not that large: just over 200 lines in a header file, and a little less for some testing accessor and example functions in a source file. And this makes for some really nice example code: the 'fast regression' example becomes this (where I simply removed two blocks with conditional on the Armadillo version):
#include <RcppArmadillo.h>
extern "C" SEXP fastLm(SEXP ys, SEXP Xs)  
    Rcpp::NumericVector yr(ys);			// creates Rcpp vector from SEXP
    Rcpp::NumericMatrix Xr(Xs);			// creates Rcpp matrix from SEXP
    int n = Xr.nrow(), k = Xr.ncol();
    arma::mat X(Xr.begin(), n, k, false);   	// reuses memory and avoids extra copy
    arma::colvec y(yr.begin(), yr.size(), false);
    arma::colvec coef = solve(X, y);            // fit model y ~ X
    arma::colvec resid = y - X*coef; 		// residuals
    double sig2 = arma::as_scalar( trans(resid)*resid/(n-k) );
    						// std.error of estimate
    arma::colvec stderrest = sqrt( sig2 * diagvec( arma::inv(arma::trans(X)*X)) );
    Rcpp::Pairlist res(Rcpp::Named( "coefficients", coef),
                       Rcpp::Named( "stderr", stderrest));
    return res;
 
No extra copies! Armadillo instantiates directly from the underlying R objects for the vector and matrix, solves the regression equations, computes the standard error of the estimates and returns the two vectors. Leaving us to write about eleven lines of code. Moreover, as Armadillo is well designed and uses template meta-programming to avoid extra copies (see these lecture notes for details), it is about as efficient as it can be (and will use Atlas or other BLAS where available). And, this is just one example. Rcpp should be suitable for other C++ libraries, and provides an easy to use seamless interface between C++ and R. However, we should note that (at about the last minute) we found out about some unit test failures in OS X as well as some issues in a Debian chroot -- cran2deb ran into some build issues on i386 and amd64 in the testing chroot even this 'it all works' swimmingly on our Debian, Ubuntu and Fedora build environments. A follow-up with fixes for either Rcpp and/or RcppArmadillo appears likely.

Update: The build issues seems to be with 64-bit systems and everything appears cool in 32-bit.

11 March 2010

Sam Hartman: Kerberos 1.8: Anonymous and the Cloud

The Kerberos team recently released Kerberos 5 1.8. This is the first of a couple of posts talking about features in the new release and how they significantly enhance what you can do with Kerberos. Before I get to that though, I d like to wax excited for a moment on the development process. There is much more of a community actively involved in the development process. As with the last release, MIT, Painless Security and PADL Software made contributions along with a number of others.. However the biggest change is the number of parties actively working with each other on designs, design reviews, testing and debugging. There was also a lot more real-time collaboration. It was great to see people from Sun, Debian and Redhat all actively bringing their prospectives to the discussion. My thanks to the Kerberos Consortium for pulling everyone together and for livening up the development process. Kerberos 1.8 testing releases are already available in Debian Squeeze and Ubuntu Lucid. I will be updating Debian to the final release soon, but everything discussed here should already work in both Debian and Ubuntu. I don t know about the state of other distributions, although given how heavily Redhat was involved in the process, I m sure they have 1.8 internally. One of the frustrating problems with previous versions of Kerberos was the need to key hosts before they could run Kerberized services. An administrator needed to set up a keytab and securely get it on the machine. That creates problems for automated installs of services, virtual services in the cloud, and environments where people installing servers are not the same as those running the Kerberos realm. Kerberos 1.8 still requires servers be keyed, but the need for the administrator is removed. Anonymous Kerberos provides a way for a machine to authenticate to Kerberos without an existing account. That page shows how the Kerberos administration server can be configured to permit machines to create their own keytabs. Anonymous Kerberos does require pkinit be configured and that the client know the public key of the KDC. However it is easy to build the KDC public key into an auto installer image or place it onto a USB key. I think it would be really neat to build a Debian image for Amazon EC2 that would show how easy it is to boot a virtual machine, have it register itself with a Kerberos realm, use something like remctl to request a work load and then begin serving that work load. The work load could include both clients for distributed computation or even services provided to the world, all secured by Kerberos with automatic bootstrapping. I don t know if I ll have time to put this together, but if someone were interested in helping or paying for the work it would be much more likely to happen. I believe the links above are enough that you should be able to get Anonymous Kerberos working and minimally configured. If not, feel free to send questions; I ll focus more on updating the public instructions than on providing individual help, but I m definitely interested in making this easy to use.

Martin F. Krafft: Splitting puppetd from puppetmaster

My relationship with Puppet is one of love and hate. I am forced to use it simply because there is no better tool around, but I hate it in so many ways that I don t even want to start to enumerate (hint: most have to do with Ruby, actually). Today I decided to put an end to one thing that has been driving me insane: the fact that puppetd (the client) and puppetmasterd (the server) use the same working directory, /var/lib/puppet. Since I consider and would like to treatthe machine on which puppetmasterd is running just another puppet client, I was running into funky issues related to SSL certificate confusion, obscure errors, and SSL revocation horrors. The following hence assumes that you have installed or are planning to install puppetd on the machine running your puppetmaster, and that you have two fully-qualified domain names for the machine. For instance, I run puppetmaster on vera.madduck.net, and puppetmaster.madduck.net is an alias for the same machine. I ll use these names in the following as examples. The following may be Debian-specific, as I am solely using the puppet and puppetmaster packages for my experimentation and verification. Your mileage may vary, but the concept shall be the same.
  1. Stop everything:
    /etc/init.d/puppetmaster stop
    /etc/init.d/puppet stop
    
    
    (also verify that you have not instructed cron to restart these services)
  2. Rename the working directory:
    mv /var/lib/puppet /var/lib/puppetmaster
    
    
    and amend /etc/puppet/puppet.conf accordingly:
    [main]
    #  
    vardir=/var/lib/puppetmaster
    ssldir=$vardir/ssl
    #  
    [puppetmasterd]
    certname=puppetmaster.madduck.net
    #  
    
    
    I am doing this in [main], planning to override it for puppetd later, because puppetd is the only program which makes sense to be separated from the rest. Since only the puppetmaster needs a special certificate name, that is set specifically in the [puppetmasterd] section. If you use apache2 or nginx in front of your puppetmasters, make sure to amend the SSL file locations in the virtual host definition and restart (!) the service. You can verify that the configuration has been amended by making sure that there is no output from the following command:
    # puppetmasterd --genconfig   grep -q '/var/lib/puppet/' && echo SOMETHING IS WRONG
    
    
  3. Now restart puppetmaster:
    /etc/init.d/puppetmaster start
    
    
    and verify that it starts. If your puppetmaster previously ran under a different name, it will create itself a new certificate and sign it. Since the client will get its own working directory (and thus a new SSL certificate), you want to remove all records of the old certificate:
    # puppetca --list --all
    + puppetmaster.madduck.net
    + vera.madduck.net
    # puppetca --clean vera.madduck.net
    
    
  4. Change the configuration file to tell puppetd about its working directory:
    [puppetd]
    server=puppetmaster.madduck.net
    vardir=/var/lib/puppetmaster
    ssldir=$vardir/ssl
    #  
    
    
    This you can verify with the following command, which should not print anything:
    # puppetd --genconfig   grep -q '/var/lib/puppet[^/]' && echo SOMETHING IS WRONG
    
    
  5. Now install puppet, or (re)start it if it s already installed:
    # /etc/init.d/puppet stop
    # puppetd --no-daemonize --onetime --verbose --waitforcert 30 &
    info: Creating a new SSL key for vera.madduck.net
    warning: peer certificate won't be verified in this SSL session
    info: Caching certificate for ca
    info: Creating a new SSL certificate request for vera.madduck.net
    # puppetca --list
    vera.madduck.net
    # puppetca --sign vera.madduck.net
    notice: Signed certificate request for vera.madduck.net
    notice: Removing file Puppet::SSL::CertificateRequest vera.madduck.net at '/var/lib/puppetmaster/ssl/ca/requests/vera.madduck.net.pem'
    # fg
    info: Caching certificate for vera.madduck.net
    info: Caching certificate_revocation_list for ca
    [ ]
    # puppetca --list --all
    + puppetmaster.madduck.net
    + vera.madduck.net
    # /etc/init.d/puppet start
    
    
    Do yourself the favour and check that it s all working.
  6. Optionally, you can now clean up the client stuff in the server s working directory, for instance like this (it worked for me, but this is the sledgehammer approach):
    # /etc/init.d/puppetmaster stop
    # cd /var/lib/puppetmaster
    # tar -cf /tmp/puppetmaster.workingdir-backup.tar .
    # find ../puppet -type f -printf '%P\n'   xargs rm
    # /etc/init.d/puppetmaster start
    
    
  7. If you stopped cron before (and your puppet recipes have not since restarted it):
    /etc/init.d/cron start
    
    
All done. I wish puppet, or at least Debian s puppet packages would do this by default. Please let me know if the above conversion works for you. Then I might start working on an automated migration. NP: Genesis: Selling England by the Pound

C.J. Adams-Collier: dlr-languages_20090805+git.e6b28d27+dfsg-1_amd64.changes ACCEPTED

I m happy to announce that after the filing of an Intent to Package and nearly 2 years of work, IronRuby 0.9, IronPython 2.6b2, and the DLR are now in Debian. To my knowledge, this is the first package in Debian with direct and active upstream support from Microsoft. Kudos for this release go to Jo Sheilds (package sponsorship & mentoring), Mirco Bauer (package sponsorship & mentoring), Matthias Klose (IronPython package review), Ivan Porto Carrero (IronRuby build/test support), Jim Deville (IronRuby build/test support), Jimmy Schementi (upstream point of contact @ Microsoft), Dino Viehland (IronPython build/test support), Michael Foord (IronPython build/test support), Marek Safar (mono c# compiler support), Ankit Jain (xbuild support), the folks on OFTC s #debian-cli, Freenode s #ironruby and GimpNet s #mono, and the folks on the IronRuby and IronPython mailing lists. This is my first package in Debian, too. I m pretty ecstatic ;)

Next.

Previous.