This blog will soon move to the following address [http://www.gabriellacoleman.org/blog/]

It's been a while since I've posted anything except reviews and I'm overdue for a general update. With the Kerberos upgrade project finished last month, I'm currently in the wonderful situation of not having any large active projects at work and being given time to generally catch up. With luck, I'll have a couple more months of that before things really heat up. I only have to consult on a few projects and otherwise can deal with all the operational issues that I'd been putting off. A lot of my time lately has been spent on Puppet configuration cleanup and improvements, and there's at least another solid week of that to go, as well as a pile of overdue documentation to write. On the Debian side, Lintian has moved to a new Git repository and Adam D. Barratt has started committing directly. Frank has also had time to do a lot of work, which means that Lintian development is proceeding quite well without a lot of active attention on my part. That's been wonderful and has given me time to focus on other things. Most of my Debian effort of late has gone into the new Shibboleth packaging team and review of Shibboleth 2.0 packages, the last of which was uploaded last week and is sitting in NEW. Thanks to Ferenc W gner for the fine work! All the packages are now in Git and migrated to Alioth and there's a wiki page for the packaging team. Scott Cantor, the primary upstream developer, has joined the mailing list and has been extremely helpful and responsive. Sam Hartman has also migrated the krb5 packaging repository to Git and Alioth, and last Friday I finally finished migrating the openafs repository. Both are unfortunately rather huge since they contain all the historic upstream tarballs (extracting that would have been hideously complicated to do as part of the migration), but they shouldn't grow nearly as much now that we can use pristine-tar. This is the heart of the Kerberos and AFS packaging; there's now just kerberos-configs and my two PAM modules to move (more on the complexities of the PAM module Git migration in a later post). On the personal front, I've been travelling a lot lately, but that will now calm down for a while. I have some company next month, though, and hopefully will be up for it by then (right now, I just want to hole up in my apartment and do my own thing and not interact for a bit). I've been reading George Orwell: An Age Like This (1920-1940), the first of a four-volume collection of his letters, essays, and reviews. I was inspired to buy the first volume after reading one of his essays on-line after a Usenet discussion some time back, and I'm delighted I did. It took me a bit to get into it, but now I'm finding it absolutely fascinating. Orwell has a talent for concise and accurate descriptions of life (primarily of the poor) that capture the emotional tone as well as the surface details. That's mixed with interesting book reviews (I love reading book reviews), intriguing tidbits on his writing process and how he viewed being a writer, and snippets of the day-to-day of his life that have survived in letters. It's rather like reading a blog, and Orwell is a good enough writer that even his unparagraphed, abbreviated commentary in letters is full of memorable turns of phrase or observations. If you like that sort of thing, I recommend it highly. I'm going to buy the remaining three volumes and read the whole collection, plus quite likely pick up Orwell's other books besides 1984 and Animal Farm.

---

Still a work in progress, but finally something functional:

$ checkbashisms.pl.4pm --debug --recursive --extra /etc/init.d/apache2
Variable "%bashisms" is not available at (eval 6) line 1.
[recursive mode]Delaying check of /lib/lsb/init-functions for bashisms from:
. /lib/lsb/init-functions
[srecursive mode]Path expanded to: /lib/lsb/init-functions
[recursive mode]Delaying check of /etc/default/rcS for bashisms from:
test -f /etc/default/rcS && . /etc/default/rcS
[srecursive mode]Path expanded to: /etc/default/rcS
[recursive mode]Delaying check of /etc/default/apache2 for bashisms from:
test -f /etc/default/apache2 && . /etc/default/apache2
[srecursive mode]Path expanded to: /etc/default/apache2
[recursive mode]Delaying check of /etc/apache2/envvars for bashisms from:
PFILE= . /etc/apache2/envvars ; echo $APACHE_PID_FILE
[srecursive mode]Path expanded to: /etc/apache2/envvars
status for /etc/init.d/apache2 is: 0
status for /etc/apache2/envvars is: 0
status for /lib/lsb/init-functions is: 1
possible bashism in /lib/lsb/init-functions line 31 (local x y):
local force nice pidfile exec i
possible bashism in /lib/lsb/init-functions line 62 (local x y):
local pidfile line i pids= status specified pid
possible bashism in /lib/lsb/init-functions line 81 (kill -[0-9] or -[A-Z]):
if $(kill -0 "$ pid:- " 2> /dev/null); then
status for /etc/default/rcS is: 1
status for /etc/default/apache2 is: 1

next step: fix remaining bugs, and integrate it in lintian (yes, finally lintian will be able to look for bashisms in all /bin/sh scripts :)

Those wondering what the "Path expanded to" lines are for:

$ checkbashisms.pl.4pm --debug --recursive --extra /etc/init.d/zope3
Variable "%bashisms" is not available at (eval 6) line 1.
[recursive mode]Delaying check of /lib/lsb/init-functions for bashisms from:
. /lib/lsb/init-functions
[srecursive mode]Path expanded to: /lib/lsb/init-functions
[recursive mode]Delaying check of /etc/default/zope$ZVER for bashisms from:
. /etc/default/zope$ZVER
[srecursive mode]Path expanded to: /etc/default/zope3
status for /etc/init.d/zope3 is: 0
status for /lib/lsb/init-functions is: 1
possible bashism in /lib/lsb/init-functions line 31 (local x y):
local force nice pidfile exec i
possible bashism in /lib/lsb/init-functions line 62 (local x y):
local pidfile line i pids= status specified pid
possible bashism in /lib/lsb/init-functions line 81 (kill -[0-9] or -[A-Z]):
if $(kill -0 "$ pid:- " 2> /dev/null); then
status for /etc/default/zope3 is: 1

Btw, srecursive isn't a typo, it stands for "smart recursive" (i.e. replace $vars with * and glob)

alex@brithombar:~$ finger tolimar@db.debian.org
[db.debian.org]
uid=tolimar,ou=users,dc=debian,dc=org
First name: Alexander
Last name: Reichle-Schmehl
Email: Alexander Reichle-Schmehl
URL: http://www.schmehl.info/
IRC nickname: Tolimar
Jabber ID: tolimar@jabber.ccc.de
Fingerprint: 46CD D292 0692 D5A2 8F81 2E48 0717 74E0 00D8 CD16
Key block: finger tolimar/key@db.debian.org

alex@brithombar$ gpg --edit-key 00D8CD16
Secret key is available.

pub 1024D/00D8CD16 created: 2002-09-28 expires: never usage: SC
trust: ultimate validity: ultimate
sub 1024g/C5F3F285 created: 2002-09-28 expires: never usage: E
[ultimate] (1). Alexander Schmehl (university) <schmehl@cs.uni-frankfurt.de>
[ultimate] (2) Alexander Schmehl (privat) <alexander@schmehl.info>
[ultimate] (3) Alexander Schmehl (university) <schmehl@informatik.uni-frankfurt.de>
[ultimate] (4) Alexander Schmehl <tolimar@debian.org>
[ revoked] (5) Alexander Schmehl < deleted >
[ultimate] (6) Alexander Schmehl <schmehl@uni-hildesheim.de>
Please note that the shown key validity is not necessarily correct
unless you restart the program.

Command> adduid
Real name: Alexander Reichle-Schmehl
Email address: tolimar@debian.org
Comment:
You selected this USER-ID:
"Alexander Reichle-Schmehl "

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o

You need a passphrase to unlock the secret key for
user: "Alexander Schmehl (university) "
1024-bit DSA key, ID 00D8CD16, created 2002-09-28


pub 1024D/00D8CD16 created: 2002-09-28 expires: never usage: SC
trust: ultimate validity: ultimate
sub 1024g/C5F3F285 created: 2002-09-28 expires: never usage: E
[ultimate] (1). Alexander Schmehl (university) <schmehl@cs.uni-frankfurt.de>
[ultimate] (2) Alexander Schmehl (privat) <alexander@schmehl.info>
[ultimate] (3) Alexander Schmehl (university) <schmehl@informatik.uni-frankfurt.de>
[ultimate] (4) Alexander Schmehl <tolimar@debian.org>
[ revoked] (5) Alexander Schmehl < deleted >
[ultimate] (6) Alexander Schmehl <schmehl@uni-hildesheim.de>
[ultimate] (7) Alexander Reichle-Schmehl <tolimar@debian.org>

Command> save

alex@brithombar$ gpg --send-key 00D8CD16
gpg: sending key 00D8CD16 to hkp server keyserver.noreply.org

There exist many bayasian/statistical spam filters, ranging from products such as spambayes, and spamassassin, to crm114. Each of them works in their own way. Having used and tested almost all of them I've noticed a common flaw. The vast majority of spam-filters struggle to correctly classify "419 scam" mails, lottery fraud, and similar mails. Why is that? In general, having read hundreds of these mails, I can see several things that are common in these kind of the mails:

• Mention of currency in both numeric and word forms. ($1,000,000 + 1 million US dollars)
• Mention of a country / nationality (Sierra Lione, Nigerian)
• Mention of a reference/claim number and often "official address".
• Christian references.
• Greetings such as "dear friend", and mentions of discretion/secrecy.
• Size. (A scam mail is typically greater in length than an average spam mail).

Whilst none of these individually are indicative of a scam mail it is interesting to count their combined occurance. I've written a toy program to count these things, and so far the success rate is >60% which is a reasonable start - providing this kind of detection occurs after normal filtering. I may experiment further, but I figured a public query on scam detection might be appropriate. Whilst the detecting a scam mail is a subset of detecting a spam email there are probably simplifications that may be made, and exploring those wouldn't be a bad thing. ObQuote: Buffy.

A number of weeks ago, I asked for some help concerning good, geeky web comics and got some nice responses. While in Brazil, Pablo pointed me out to a home-grown strip, Nerdson. Makes me wonder about the other non-English geek comics out there.

It's interesting to think about Bill Gates retiring. When I think back to how much Microsoft has brought us over the years, both happiness and grief, it's a bit of a happy/sad end to an era for me.

Microsoft is what saved us from the TRS-80, and brought us into a world where clone hardware drove prices down to where everyone could afford them. MS-DOS may have been a bad rip off of CP/M and Unix, but to business operations brought us the ability to bring computing power right down to the desk and generally got out of the way. Dos had the neat ability to have TSRs that could deliver waiting applications at a keystroke (remember Sidekick?) Windows 386 and 3.0 brought us preemptive multitasking for DOS apps that weren't written for that in mind, and brought us the first environment the mass market had seen where any manufacturer could write drivers to a known programming interface and bring their hardware to the world. They brought us a world where hardware innovation was bringing crazy new things to us that had only been possible in Sci-Fi movies before. My first voice-recognition system on the computer was in 1990. =)

Windows 95 pushed that even further. No longer were drivers crazy TSRs, but actually loaded into the control panel with standard was of using them for established services such as Networking and Sound. For everything else, the model was extensible so that if you had a neat idea, you could bring it out to the world. I remember installing TwinBridge at work so that people could type in double-wide Chinese characters, despite the OS not being intended for that in the slightest.

Windows 98 brought us games that were better than we were seeing in DOS. DirectX and DirectSound were finally providing a good enough abstraction on top of the hardware that it was easier for authors to code to that than to code right to your Adlib card and whatever display adapter you had (were we using S3s yet, then?)

But that seems to have been the top point of their reign. At this point, as a user I was now so far from the guts of the machine, I no longer could easily tinker. I'd once coded in Z80 asm and 8086 asm to write little hacks, but Windows 98 was getting to the opinionated software stage: There were things you just couldn't do, for no reason other than the designers at Microsoft didn't think it was important.

I realise I'm not the usual mass-market type, but now the system that had been such a source of inspiration was now becoming a barrier to trying new ideas.

I had started playing with Linux in 1995, but 1998 had started to use it as my main machine at home. I had a roommate who had a dumb cheap machine that was slaved off of my main machine so that he could play Medievia all day and night. Setting up this networking, and the on-demand ISDN dialing was trivial to do under Linux, and nearly impossible under the Windows systems of the time.

The only thing one could say for FVWM95 at the time was that it was better than twm. We suffered through Enlightenment, said hello to wine, and joined an online community of people who'd all come together from various places in order to be free to play with the systems we had.

Microsoft became steadily less relevant to my day to day computing. My girlfriend (now wife) suffered through early incarnations of MS Word for windows 2.0 under Wine because it was still easier than teaching her emacs. And steadily, the system got better until we could honestly look at our family members and tell them that if they wanted to run Windows that was fine, but please don't call me about it.

We need to both say thank-you to Microsoft and learn from it. Microsoft made a business model of bringing us the technology we craved as geeks, and that society wanted to play with and integrated into our lives. Microsoft also taught us what it means to be the dominant player. For most of us, I suspect it was our only view into the world where a single player dominates and strives to cut down its competition. It's easy to romanticise the small business owner, and just as easy to forget that just about every small business owner wants to be a millionaire and a large business owner.

We need to remember that the pretty fancy interfaces can be as much about helping people do things as keeping them from doing things. We need to demand the freedom to tinker with our software and our devices, even if we choose to never do so. And after all that, we need to be able to take our data from a device, and take it to somewhere else. I think ultimately, this is what Microsoft has taught us. As we look for new companies to deliver us greater and shinier technology, this is a lesson we need to keep close at hand.

Who knew that rants at Starbucks could be the subject of a seemingly interesting lingustic article.

I put the Nokia E51, which I had previously acquired, onto Ebay last night, and it sold within minutes. Even though I made a 50 loss on the whole affair, this made me very happy! The phone is crap in so many ways that it made me quite angry. I now consider those 50 the investment I had to make to bring you this post: First of all, the reason why I bought the phone was because it sports wireless LAN as well as Voice-over-IP. Since I ve recently gotten into VoIP, I was looking for reasonable VoIP phones and even though the Siemens C450IP DECT phone works very well, it only does so at home, or where I find a switch port for it. So my theory was to get this Wifi+VoIP phone and be able to use my VoIP infrastructure from anywhere around the world. Penny has the Nokia E65 and loves it, so I went for the E51, a newer model that promised to address some of the issues she had with hers. All of the following is based on the E51 with the 100.34.20 firmware dated 29 September 2007, which runs the (crippled) Symbian S60r3 operating system.

Good things Let s start with the few good things up front: the E51 comes with a regular USB jack, allowing you to plug it into any computer and use it as mass storage device without the need for any Nokia-specific cables. I also liked the remote lock functionality: in the event of a stolen phone, you could send it a pre-defined passphrase that would cause the phone to lock itself. Also, the phone could be configured to lock itself (like a screensaver) after a given amount of idle time. Other than that, I could not find anything outstanding, so let s turn to the downsides, of which there are many more:

VoIP/SIP shortcomings I had previously dismissed the E series phones for good reasons, but both the E65 and the E51 improved their SIP clients a fair bit, and with the SIP VoIP settings utility, it was even possible to configure STUN. But unfortunately, the SIP client, while a nice toy, ended up being unusable in production. Here are some of the reasons: I got VoIP working at home and in some other places, but definitely not everywhere. It may be that some of those networks blocked the SIP port (5060/udp), or that the phone didn t feel well on the day, but in the majority of cases, I could not get the SIP client to connect. And there was no way to find out what was going on, as the client would just claim that registration failed without any additional information. It was also hard to retry, often requiring the phone to be restarted. Whenever if failed, the client would helpfully tell me that it could not establish a connection to the connection network . To get the phone to log on to the SIP server automatically, I had to define a home network for the SIP profile. Changing the access point for that network required a phone reboot to get SIP working again. It was possible to define multiple SIP profiles with different access points and add them all to the one, global VoIP profile, and theoretically get auto-login to work across multiple Wifi networks; unfortunately, I cannot say that this worked, there were always some problems requiring me to change defaults and shift things around. Also, after I had defined a few of those profiles and needed to make a change to the SIP settings (move the SIP port to 53/udp), I had to modify all profiles in turn; it was not possible to share settings. On the other hand, NAT traversal settings and timeouts, which can only be configured with the aforementioned SIP VoIP settings utility, applied to a VoIP profile and thus to all SIP profiles, without exception. I found it mildly annoying that I couldn t use # and * as part of the number/SIP address to call, nor was it possible to dial single-digit extensions the phone will ask you to associate a quick dial number with the key, even if quick dial has been explicitly disabled). I could also not dial a SIP address ad-hoc if I wanted to call sip:someone@sip.somewhere.org, I had to define a contact and add the Internet phone address. One can define Internet calls to be the default call type, thus routing all calls via VoIP if available. Unfortunately, once I dialed a number, the event was hardwired to the call type: I could not redial a number used previously for a VoIP call when all I had available was GSM coverage.

Gripes with the IMAP client The IMAP client, while an interesting addition to my day, turned out to be pretty unusable. The first mistake I made was to tell it to synchronise all messages in some of my larger mailboxes, which caused the phone to take tens of seconds until it switched a folder, and a few seconds just to scroll to the next screen in any given folder. I found that once any mailbox accumulates more than 100 messages, the client turns useless (Nokia s default is to synchronise 30 messages). I could tell the client to synchronise every hour, but only if I locked it to an access point, the home network . If I roamed to a different Wifi network, I could no longer connect to the IMAP server, as this access point would not be found. The phone would not let me use a different access point unless I changed the home access point, but changing that turned off the automatic mail sycnhronisation. If I say mail synchronisation, I mean header synchronisation. Even though there is an option for Headers only , it only applies to POP3; it is impossible to have the phone download message bodies automatically, only manually and then only per-message or per-folder, not for all folders at once. The IMAP client could delete messages, but it could not move a message to a different folder, nor create or delete folders. And even though I could turn off the message tone the phone would play when it received new email, it insisted on vibrating nevertheless. The only other IMAP client I found for Symbian phones is ProfiMail, which looked interesting and much more powerful, but which would randomly crash on me while browsing or operating on larger mailboxes.

Connection hickups While the an application was running that was using the network, the Wifi connection stayed open, but I could not make it stay open between sessions. The phone would obtains an IP, do what I asked it to, and then immediately close the connection. From a power management perspective, this makes sense, but not from the usability angle. I could not make the phone connect to a Wifi network that advertised both, WPA and WPA2 and had to disable WPA at home to let it connect. At times, it was not possible to reuse an existing connection. I haven t been able to figure out the details, but it seemed to me that whenever an application like the IMAP client was locked to an access point, it would be unable to make a connection to the IMAP server, even if e.g. the VoIP client was connected to the server by way of exactly the same access point. The phone would just say that a connection was already active and that I should close it and try again . I had a really hard time working with SSL-enabled websites and IMAP servers, because even though the phone presented me with the server certificate and offered the choice of accepting it permanently, it didn t and would ask the question again and again (which made the phone pretty unusable if the IMAP client was running in the background). Only after I had found out how to import the CACert root certificates, did this problem become irrelevant.

Other pet-peeves The phone came with a lot of smaller issues that made me ask the question of whether its designed ever had to use it too often. Possibly the most annoying aspect of the phone was its speed. It s a lot faster than the E61, but it still takes on the order of seconds to update screens or display simple text messages. Speaking of text messages, I am a little spoiled by the Sony Ericsson K610i (to which I now return), which would offer the contacts with whom I d recently interacted instead of presenting me with the full list, like the E51 does. I could filter the full list, but only by typing the start of the name substring matching was not implemented. It was impossible to receive text files via bluetooth and have them put onto the filesystem. On receipt, the phone just said text file saved , and it took me a while to figure out that it had stored them into the notepad, from where it could not be exported. To get my SSH identity onto the filesystem for PuTTY to use required me to access the phone via USB. The phone could receive vCards with new contacts, but it only offered to import the first contact, even though the standard allows for an arbitrary number of contacts per file. What s even worse though is that the phone silently failed to import contacts with non-ASCII characters in their name, such as or they just didn t show up even though the phone gave every indication of a successful import; creating such contacts on the phone worked, on the other hand. Each time I started the phone, the Nokia greeting screen would show up, accompanied with the Nokia tune, which could not be disabled. Enough said. The last problem I feel worth mentioning is hardly a Nokia or Symbian problem: battery life. With Wifi turned on, the phone would last about 24 hours on standby, which makes it pretty unusable for roaming Wifi or even VoIP usage.

Summing up I am happy to have sold the phone and look forward to returning to my Sony Ericsson K610i. After checking out the E61/E71 a bit, playing with the E65, and trying the E51 out for several weeks, I can conclude that Nokia has a long way to go before they can offer a usable smartphone with Wifi/VoIP capability. It would be a good step forward if they would open-source the Symbian operating system, but until that s done, I am going to look at the OpenMoko FreeRunner next. The E51 once again made it perfectly clear for me that proprietary software is no alternative for my use case. NP: Fat Freddy s Drop: Live at the Matterhorn

When you are in a foreign city, Dakar, Tunis, Tokyo, the spaces and sights are disorienting for they unfamiliar. But there are a few spots (hotels, supermarkets), that bring you back the familiar and these places have been theorized by French Anthropologist Marc Auge as non-spaces. Here is a nice interview with Auge on the difference between ethnology, anthropology, as well as his description of non-places:

I tried to characterize these new emerging spaces by the term non-places which empirically makes note of the extension of these new spaces in our world; spaces of circulation giving us the sense that the earth is small, spaces of communication (possibly virtual spaces), or even of consumption, since a large part of what circulates aims to put products into circulation (and possibly the men who produce them) such that the activity of consumption reproduces society itself. Such spaces of circulation, of communication and consumption, including the technical capabilities that make it possible for them to be visited or concentrated (the airport, the supermarket, the freeway, etc.), are what I have designated by the term non-place .

Well, I was hoping to get Yet Another Blog Reorg done before posting this, but it just hasn't happened, so here are a few more thoughts on Firefox 3 on this ol' blog. In fact, I'll probably finish the FF3 series here before I switch over. I was in central London on Tuesday and suffered both the rudeness and the black snot (which no-one else I know seems to suffer) so maybe that's why I've been underachieving this week. I've had London lethargy. I had a report about online banking that doesn't work with FF3. NPBS will move into the hall of shame, sadly. I'm almost certain I warned them months ago that their online banking was doing Javascript stunts that aren't going to work forever. I emailed them and haven't heard back since. Back to the browser: I share the contempt for the Firefox 3 and SSL problems and I like the new URL bar too. However, I am finding the FF3 seems to use more CPU (and so power) than FF1.5 and there seems to be some frustrating delays in FF-clipboard communications, so I'm looking at other browsers. Conkeror looks interesting. Still Gecko (useful for work) but stripped down. I spotted another post about microformats, which I mentioned in my last post, about the BBC dropping support for microformats [John Resig] and I also noticed just how good SVG and Minimalist Markup looks in FF3 [Sam Ruby] - I'd love to try it, but my IE-using clients probably wouldn't understand and I hate making single-browser special editions.

I think it is time for me to upgrade my digital camera and while I would like a SLR, I think I am going to stick to a small non-SLR digital camera. I am looking for a high quality one, preferably with a wide-angle lens such as with this camera (which is one of my choices). Are there any cameras that folks have that they love?/hate?/recommend? Feel free to leave comments or drop me a line

Katherine Lawrence and Marianne Schreiber, two women at Hewlett-Packard, used the term Glass Ceiling to to refer to invisible barriers that impede the career advancement of females. While on the surface there seems to be a clear path of promotion, in fact women seem to hit a point where there is no way to progress beyond. Carol Hymowitz and Timothy Schellhardt used the term again afterwards in the March 24, 1986 edition of the Wall Street Journal, which is considered by many people the starting point of the usage of that term. Even though the term Glass Ceiling was originally specifically applied to discrimination against women, its meaning has expanded to describe similar situations of other collectives. I was wondering whether there might be a Glass Ceiling in Debian too. I know some of you will be tempted to answer “no way!” or “yeah! of course!” without even thinking about it. Please don’t. Keep in mind that a Glass Ceiling situation is referred to as a “ceiling” as there is a limitation blocking upward advancement, and “glass” (transparent) because the limitation is not immediately apparent and is normally an unwritten and unofficial policy. Give a serious and deep thought about it before commenting. It’s quite likely that if you are too sure about what the answer might be, one way or the other, that you might be wrong. I just wanted to make us think a bit about it.

The Age has an interesting article about proposed DNS changes [1]. Apparently ICANN is going to sell top level DNS names and a prediction has been made that they will cost more than $100,000 each. A suggestion for a potential use of this would be to have cities as top level names (a .paris TLD was given as an example). The problem with this is that they are not unique. Countries that were colonised in recent times (such as the US and Australia) have many names copied from Europe. It will be interesting to see how they plan to determine which of the cities registers names, for the .paris example I’m sure that the council of Paris Illinois [2] would love to register it. Does the oldest city win an international trademark dispute over a TLD? The current situation is that French law unambiguously determines who gets to register paris.fr and someone who sees the URL will have no confusion as to what it means (providing that they know that fr is the ISO country code for France). As well as city names there are region names which are used for products. Australian vineyards produce a lot of sparkling wine that they like to call Champagne and a lot of fortified wine that they like to call Port. There are ongoing battles about how these names can be used and it seems likely to me that the Australian wine industry will change to other terms. But in the mean-time it would be interesting if .champagne and .port were registered by Australian companies. The fuss that would surely cause would probably give enough free publicity to the Australian wine industry to justify an investment of $200,000 on TLDs. The concern that is cited by business people (including the client who forwarded me the URL and requested my comments) is that of the expense of protecting a brand. Currently if you have a company named “Example” you can register example.com, example.net, and example.org if you are feeling enthusiastic. Then if you have a significant presence in any country you could register your name in the DNS hierarchy for that country (large companies try to register their name in every country - for a multinational registering ~200 domains is not really difficult or expensive). But if anyone can create a new TLD (and therefore if new ones are liable to be created at any time) it becomes much more difficult. For example if a new TLD was created every day then a multi-national corporation would need to assign an employee to work full-time on investigating the new TLDs and deciding which ones to use. A small company that has an international presence (IE an Internet company) would just lose a significant amount of control over their name. I don’t believe that this is as much of a concern as some people (such as my client) do. Currently I could register a phone line with a listed name indicating that it belongs to the Melbourne branch of a multi-national corporation. I don’t expect that Telstra would stop me, but the benefit from doing this would be minimal (probably someone who attempted fraud using such means would not gain much and would get shut down quickly). I don’t think that a DNS name registered under a .melbourne TLD would cause much more harm than a phone number listed in the Melbourne phone book. Incidentally for readers from the US, I’m thinking of Melbourne in Australia not a city of the same name in the US - yet another example of a name conflict. Now I believe that it would be better if small companies didn’t use .com domains. The use of country specific names relevant to where they work are more appropriate and technically easier to implement. I don’t regret registering coker.com.au instead of some name in another country or in the .com hierarchy. Things would probably be working better right now if a .com domain name had always cost $100,000 and there were only a few dozen companies that had registered them. But we have to go with the flow sometimes, so I have registered RussellCoker.com. Now when considering the merit of an idea we should consider who benefits and who (if anyone) loses. Ideally we would choose options that provide benefits for many people and losses for few (or none). In this case it seems that the suggested changes would be a loss for corporations that want to protect their brand, a loss for end-users who just want to find something without confusion, and provide more benefits for domain-squatters than anyone else. Maybe I should register icann.port and icann.champagne if those TLDs are registered in Australia and impersonate ICANN. ;)

• [1] http://www.theage.com.au/news/web/rule-changes-to-spark-domain-name-goldrush/2008/06/27/1214472719636.html


• [2] http://parisillinois.org/

Share This

Steve,

If you don't like seeing cumbersome security warnings for insecure https connections, how about not using https when what you really want is http in the first place?

Because I don't necessarily have the choice. When I'm reporting a bug on a given open source Trac, they often put https on them because they think it's better for them (and for them it is because they generated the certificate and so on), and there is no http version. Note that when I use https for myself, I import my CA in firefox, so I don't have a single warning, so I kind of know how to avoid them when I care about https. But there isn't always a plain HTTP alternative, and that is what makes it a real PITA. Okay, you want to warn the user the https isn't secure, there are plenty of ways that don't require you to add an exception on a certificate. I spoke of the little lock, because that's what is even on IE, but please remember than when you browse trusted https, the URL bar is in this kind of yellow. Well, if the https is unsecure, just don't put that background. If you really want, you can add some kind of rosa color to mark that it's "bad" but it in a not too terrible way (in opposition to a broken/invalid certificate and where the URL bar should be blinking red with an air-raid like siren). I repeat, the fact that the HTTPS certificate is self-signed never changes the fact that when a given user goes on this kind of https site, he wants to be there, and HE WILL click on the 5 silly steps of the SSL exception thing. So why bother ? It serve one single purpose: pissing users off. And for what it's worth, I disagree with you, most of the people that are not computer related I know absolutely don't know they could think that http_s_ is more secure than http. Each time I give them an URL without the http:// part they ask, is this https or http ?, because they absolutely don't get the difference, and I don't try to explain it to them, because this would lead them to think https is better. Those kind of people only rely on visual helpers from the browser part. They really do. PS: yes I also believe that bad security is worse than no security because it gives the illusion for people to be safe, and then they have bad behavior. When your condom is broken, things can go really wrong. But you missed my point, in the sense, probably because I'm too annoyed to make it clear inbetween rants. My point really was what I tried to explain, namely that if people don't know they should think there is security in the first place, your remark is moot, and for the other you can activate the different URL background, it's just fine. Of course, invalid certificates must remain a pain to go through, this whole thing is only about the untrusted ones.

You know what the problem is? Webbrowser developers think they're developing the most important application for any computer. -Wouter

Weeelll.. Looking at the the long posts you and others on planet.d.o have written about a browser, one might get the opposite conclusion :) Considering the amount of work and daily business (online banks, shops, news, other services), browser is the most important application after email - and even for email many people use a browser...

Users are good at noticing usability problems. However, their proposed solutions are usually unreliable.

I'm just as annoyed as the next planet writer about the new self-signed SSL dance of FF3. But I do not pretend to know the correct solution. When dealing with security issues, knee-jerk fixes can lead to disasters. Likewise in UI design, the first idea that gets into mind probably isn't the best one.

I wanted to be able to not only bind with the normal dn, but also to attributes. This means I e.g. have an attribute mail, and want the people to be able to login with their mailaddress as username. Stephen Gran gave me some valuable hints to using the rwm-rewriting engine. After some time, I ended up with this setup:

overlay rwm
rwm-rewriteEngine on
rwm-rewriteMap ldap attr2dn "ldap://127.0.0.1/ou=myorg?dn?sub"
rwm-rewriteContext bindDN
rwm-rewriteRule "^anyid=([^,]*@[^,]*)" "$ attr2dn(mail=$1) " ":"
rwm-rewriteRule "^anyid=([^,@]*)" "$ attr2dn(uid=$1) " ":"
rwm-rewriteRule "^(uid=[^,]*)" "$ attr2dn($1) " ":"
rwm-rewriteRule "^(mail=[^,]*)" "$ attr2dn($1) " ":"

The only thing that doesn't work is to make rwm using ldap version 3 to log into itself, so I had to allow read-only access to the relevant attributes from peername.ip=127.0.0.1 - but well, I can live with that. Update: Added anyid for not thinking in client code, and made sure only the start of entries is used.

Warning: big rant ahead. I received some comments on my previous post, as expected. Most of them were helpful; e.g., the oldbar extension is very useful. One of them was silly.

It depends: If your application is "fullscreened", clicking on the link without having the focus could lead to interesting situation like "Hey, It does nothing?"

Just to make a point here, let me reiterate: There is no excuse whatsoever to steal the focus Sorry for the shouting, but seriously. I have the following in my icewm configuration:

ClickToFocus = 0
RaiseOnFocus = 0
FocusOnMap = 0
FocusOnAppRaise = 0
FocusOnMapTransient = 0
FocusOnMapTransientActive = 1
RaiseOnClickClient = 0

What this means is that I don't want anything to either get the focus or get on top of anything else all by itself, unless it happens to be a new dialog box created by an application that already has the focus. I also don't want windows to appear on top of anything else just because they received the focus. I also happen to prefer focus-follows-mouse, which you can get by way of the ClickToFocus thing. The reason I prefer it this way, is that often I have several applications open all at once. For instance, when I read RSS feeds, I have my RSS reader open on one virtual desktop, and read through the articles. Since my laptop's processor is much, much faster in certain things than is my network, I also make use of its multitasking abilities to have it preload links in the background (on another virtual desktop, preferably). Unfortunately, somehow, firefox manages to bypass all that configuration and shows up in front, stealing the focus; and in the process, it completely interferes with the way I work. No doubt they do this in order to help some hypothetical "grandma" or other stupid clueless person who's never used a computer before, but let me tell you something: software should be written for people who actually do use software, not for stupid nitwits who can't even read an error message that tells them "you cannot do A, please go ahead and do B instead". But I guess I'm too stupid or something to understand the usability "experts" who know it all best and say that software should be "intuitive" so that those who are 53 and see a computer for the first time in their live can sit right next to it and start emailing. Hah. As if the above wasn't enough, firefox 3 also is a crashing load of shit. I just spent the better part of an hour to try and make a payment using my bank's excellent online payment software which requires nothing more than javascript, SSL, and a digipass 810 that is provided by the bank as part of the online banking contract. Unfortunately firefox insisted on crashing halfway through entering the required information, for six times in a row. You'd think I'd be filing a bug now, but no, it managed to crash in a different location every time. I'd probably have to start debugging firefox to get this done, which is not something I'll do in this life. You know what the problem is? Webbrowser developers think they're developing the most important application for any computer. They're not. It's just a webbrowser, no more important than an xterm or a mail client: a tool to get a job done. Period. Grunt.

Today I received a Dell PowerEDGE T105 for use by a client. My client had some servers for development and testing hosted in a server room at significant expense. They also needed an offsite backup of critical data. So I suggested that they buy a cheap server-class machine, put it on a fast ADSL connection at their home, and use Xen DomU’s on that for development, testing, and backup. My client liked the concept but didn’t like the idea of having a server in his home. So I’m going to run the server from my home. I selected a Dell PowerEDGE tower system because it’s the cheapest server-class machine that can be purchased new. I have a slight preference for HP hardware but HP gear is probably more expensive and they are not a customer focussed company (they couldn’t even give me a price). So exactly a week after placing my order I received my shiny new Dell system, and it didn’t work. I booted a CentOS CD and ran “memtest” and the machine performed a hard reset. When it booted again it informed me that the event log had a message, and the message was “Uncorrectable ECC Error” with extra data of “DIMM 2,2“. While it sucks quite badly to receive a new machine that doesn’t work, that’s about the best result you can hope for when you have a serious error on the motherboard or the RAM. A machine without ECC memory would probably just randomly crash every so often and maybe lose data (see my previous post on the relative merits of ECC RAM and RAID [1]). So I phoned up Dell (it’s a pity that their “Packing Slip” was a low quality photocopy which didn’t allow me to read their phone number and that the shipping box also didn’t include the number so I had to look them up on the web) to get technical support. Once we had established that by removing the DIMMs and reinserting them I had proved that there was a hardware fault they agreed to send out a technician with a replacement motherboard and RAM. I’m now glad that I bought the RAM from Dell. Dell’s business model seems to revolve around low base prices for hardware and then extremely high prices for extras, for example Dell sells 1TB SATA disks for $818.40 while MSY [1] has them for $215 or $233 depending on brand. When I get the machine working I will buy two 1TB disks from MSY (or another company with similar prices). Not only does that save some money but it also means that I can get different brands of disk. I believe that having different brands of hard disk in a RAID-1 array will decrease the probability of having them both fail at the same time. One interesting thing about the PowerEdge T105 is that Dell will only sell two disks for it, but it has four SATA connectors on the motherboard, one is used for a SATA DVD player so it would be easy to support three disks. Four disks could be installed if a PCIe SATA controller was used (one in the space for a FDD and another in the space for a second CD/DVD drive), and if you were prepared to go without a CD/DVD drive then five internal disks could probably work. But without any special hardware the space for a second CD/DVD drive is just begging to be used for a third hard disk, most servers only use the primary CD/DVD drive for installing the OS and I expect that the demand for two CD/DVD drives in a server is extremely low. Personally I would prefer it if servers shipped with external USB DVD drives for installing the OS. Then when I install a server room I could leave one or two drives there in case a system recovery is needed and use the rest for desktop machines. One thing that they seem to have messed up is the lack of a filter for the air intake fan at the front of the case. The Opteron CPU has a fan that’s about 11cm wide which sucks in air from the front of the machine, in front of that fan there is a 4cm gap which would nicely fit a little sponge filter. Either they messed up the design or somehow my air filter got lost in transit. Incidentally if you want to buy from Dell in Australia then you need to configure your OS to not use ECN (Explicit Congestion Notification [2] as the Dell web servers used for sales rejects all connections from hosts with ECN enabled. It’s interesting that the web servers used for providing promotional information work fine with ECN and it’s only if you want to buy that it bites you. But in spite of these issues, I am still happy with Dell overall. Their machine was DOA, that happens sometimes and the next day service is good (NB I didn’t pay extra for better service). I expect that they will fix it tomorrow and I’ll buy more of their gear in future. Update: I forgot to mention that Dell shipped the machine with two power cables. While two power cables is a good thing for the more expensive servers that have redundant PSUs, for a machine with only one PSU it’s a bit of a waste. For some time I’ve been collecting computer power cables faster than I’ve been using them (due to machines dying and due to clients who want machines but already have spare power cables). So I’ve started giving them away at meetings of my local LUG. At the last meeting I gave away a bag of power cables and I plan to keep taking cables to the meetings until people stop accepting them.

• [0] http://etbe.coker.com.au/2008/06/13/ecc-ram-vs-raid/


• [1] http://www.msy.com.au/


• [2] http://www.ietf.org/rfc/rfc3168.txt

Share This