Search Results: "ron"

23 February 2010

Thorsten Glaser: Rant about PGP keysigning problems

Update: This wlog entry uses aggressive tone because I somehow needed to vent frustration from using some of the tools. I should probably provide some constructive critics, too... but this is a rant. Be warned. Keysigning is useless. I boot up a suitable live GNU/Linux system, install signing-party, take the trouble that is to set up caff, transfer my secret key from the secure box, sign. I think caff providing the keys in a different order than they're given on the command line sucks and just run caff once per key. I did even start Postwreck. But no, people just don't accept any mail from "EHLO grml" systems, and I still cannot control my reverse DNS despite having a static IPv4 address (and IPv6, which looks to be unused). People also pretend I'm on dial-up. Great! I will no longer participate in any (mass) PGP keysigning but will continue to do so on a per-person basis. Probably sign but one uid, either apply common sense and upload it to t h e keyserver, or mail the entire signed key to one address. By the way, how crazy is it that I need to use the deprecated $CONFIG 'mailer-send' to pass an envelope-from to the mailer? It also suffers from the same delusion as e.g. nmudiff, namely that my Debian box is a fully set up workstation able to send out eMail and configured correctly. At least, it, unlike a number of others, does not assume I use mud (Mutt). grml Oh, and caff does a protocol violation (by always sending out GnuPG/MIME and not offering the standardised Inline OpenPGP), I think people just don't care about such. (There is a notation people can use to signal they want PGP/MIME, Inline PGP which is called "partitioned" or both (and which order of priority) but, alas, despite Inline PGP being the only one useful for the MUAs without integratin, and being more widely spread than that PGP/MIME crap, the followers of the latter do some (FSF-style?) kind of vendor lockin by not speaking anything else. Anyway. I'm all for X.509 except there seems to be no sane CA (Startcom is... trouble, even with Opera; CAcert.org is dying). I'll just buy a certificate (not from Verisign though) for www, and roll my own again (I can do it, I have experience with that actually). On an unrelated side note, still waiting for an OpenSSL patch for that recent TLS extension... ObRant: password policies, be they required characters or any kind of length restrictions, suck. People I will eventually end up with less secure passwords on such systems, because even if some of mine may appear to be derived from some kind of dictionary (what language that is I'd be interested in, though...) they aren't, and I have my schemes. You got to have them with a gazillion of passwords used. And I probably will forget them more often (and sending them via eMail is also not a solution). Unrelated notice: mksh R39c with bug fixes coming RSN. (Updated 24.02. because I was, rightfully, told the language, and the title, were too strong. I also would like to excuse for going so low as to write an ad-hominem attack, which I've since redacted.

Russell Coker: Divisive Behavior

Past Sins Sam Varghese wrote an article about Matthew Garrett s LCA talk The Linux community: what is it and how to be a part of it [1]. In page 2 Sam quotes Martin Krafft as asking about how Matthew s behavior had changed between 2004 and the present, Sam cites some references for Matthew s actions in 2005 to demonstrate. I think that this raises the issue of how far back it is reasonable to go in search of evidence of past behavior, something that I think is far more important than the specific details of what Matthew said on mailing lists many years ago and whether he now regrets such email. If someone did something that you consider to be wrong yesterday and did the same thing five years ago you might consider it to be evidence of a pattern of behavior. If someone s statements today don t match their actions yesterday then you should consider it to be evidence of hypocrisy. But if someone did something five years ago which doesn t match their current statements then in many situations it seems more reasonable to consider it as evidence that they have changed their mind. Then of course there is the significance of what was done. Flaming some people excessively on some mailing lists is something that can be easily forgiven and forgotten if Google doesn t keep bringing it up. But as a counter-example I don t think that Hans Reiser will be welcome in any part of the Linux community when he gets out of jail. For the development of the Linux community (and society in general) I think it s best to not tie people to their past minor mistakes. While it is nice when someone apologises for their past actions, the practical benefits of someone just quietly improving their behavior are almost identical. A particular corner case in this regard is the actions of young people, anyone who was born after about 1980 will have had great access to electronic media for their entire life and will have left a trail. Most people do a variety of silly things when they were young, the older members of the Linux community were fortunate enough not to have electronic records remaining where Google could find them. Back to Matthew, I think that if he is to be criticised about such things then evidence that is much more recent than 2005 needs to be used. Cultural Differences Sam quotes Matthew as claiming that the Linux community was largely a Western, English-speaking one, those who participated in it necessarily had to adapt to the norms of this group . I don t believe that there is a single Linux community. There are a number of different communities that are formed around free software, which have significant amounts of overlap. I don t believe that there s any reason why a Chinese or Indian Linux mailing list should conform to the same standards as those of an American list. But there will be a trend towards meme propagation through people who are associated with the Linux communities in multiple countries every time you meet Linux people in another country you are helping to reduce the cultural differences in the Linux community. Someone from China or India who joins a LUG in Australia will have to adapt to some of the norms of Australian behavior in the same way as an Australian who migrates to China or India would have to adapt to some local norms. On page 4 of the discussion Matthew disagrees with Sam s interpretation [2], maybe Matthew s opinions on this matter are closer to mine than the way Sam describes them. Is Division Inherently Bad? I believe that the word divisive is overused. The only way to avoid division is to have everyone agree with the majority, but sometimes the minority will be right. Note that I am using the word minority to refer to any group of people who happen to disagree with the majority, among other things that includes people who vote for a political party that isn t one of the two biggest ones. An entirely separate issue is that of the treatment of minority groups , one of the most divisive events in history was the US civil war it s good that slavery is outlawed but unfortunate that a war was required to gain that result. On page 4 of the discussion Matthew says to Sam Your writing is influenced by members of the Linux community, and in turn it influences the Linux community. The tone of it is entirely relevant to the behavioural standards of the community [2]. If a community can be easily divided then the real problem probably isn t the person who triggered a particular division. Also there is the issue that even if you could get a general agreement that certain issues shouldn t be discussed in certain ways then with the wide range of cultural attitudes and ages of participants you have to expect someone to raise the issue you don t want raised. Of course it s impossible to objectively determine whether a division is productive or not, so it doesn t seem at all viable to have any expectations regarding outsiders not being divisive. Sometimes you just have to deal with the fact that the Internet contains people who disagree with you. It seems to me that the most divisive issues we face involve people who mostly agree on contentious issues. If someone entirely disagrees with you then it s easy to ignore them (if you even have a conversation with them), but if they are someone that you communicate with and they are almost right in your opinion then there s the potential for a big argument. Probably the best way to minimise division in the community is to have the first people who get involved in a dispute take a Rogerian approach [3]. Failing that a good approach is to respond by writing an essay. When an issue is made popular by services such as Twitter that give little explanation then everyone rushes to the barricades. It seems to me that the unreliability of some blogging platforms is part of the cause of the problem in this regard. I ve just given up on writing comments on Blogger, I m not going to write a good comment only to have it eaten by blogger. There are lots of blogs that have problems which discourage the population from writing anything other than a one-sentence response. The Good that can come from Disputes On page 5 of the discussion there is a comment from Anirudh the Indian student who was criticised by Sam (which ended up inspiring part of Matthew s talk and leading to more disputes) [4]. Here is the start: I am the person who wrote the ill thought-out post that drew criticism eight months ago. There has been some discussion about that, so I wish to say something.

I am very grateful to Sam Varghese. I say this with utmost sincerity. Read the rest, it s educational. I m sure that there are others who have had similar learning experiences but who don t want to write about them. I m sure that there have been many disputes which would appear to the casual observer to have resulted in no good at all, but which would actually have resulted in people learning things and amending their behavior. The issue of Age Car rental companies generally don t do business with men who are less than 25 years old. Life insurance policies don t offer reasonable rates to males between the ages of about 16 and 25. This is because the insurance companies have good statistical data on the results of the typical actions of people at various ages and know that young men tend to be at a high risk of earning a Darwin Award. The same combination of hormones and life experience that makes a young man a danger on the road will also tend to make him get involved in flame-wars on the net. If we could figure out how to influence teenagers into being less anti-social then it would be a great achievement. The current young people will become older and more sensible soon enough but will be replaced by a larger number of young people who will do the same things. As things stand I don t expect the next cohort of young people to learn from Anirudh.

22 February 2010

Stefano Zacchiroli: RC bugs of the week - issue 22

RCBW - #22 With a mini-rush in the week-end, I'm now back on track to the weekly schedule of RCBW; here are this week's squashes: About this week highlights:

21 February 2010

Biella Coleman: Logos of our Lives

Two of the more influential books that have taken swipe at our contemporary intellectual property landscape concerned themselves with trademark, logos, and capitalism. Here i am thinking of Rosemary Coombe s seminal The Cultural Life of Intellectual Property Law and Naomi Klein s more activist take on the subject, No Logo. What would happen if you condensed the arguments in these two books into a 15 minute video? Well, this morning I found out what this might look like. Someone pointed me to a mind blowing video that might be called All Logo, All the Time: an amazing visual and dystopian rendition of the alphabet soup of logos, trademark acronyms, corporate mascots that pervade our landscape, one might even say consciousness. I would take a whirl and watch before the IP police take it down.

Biella Coleman: Logos of our Lives

Two of the more influential books that have taken swipe at our contemporary intellectual property landscape concerned themselves with trademark, logos, and capitalism. Here i am thinking of Rosemary Coombe s seminal The Cultural Life of Intellectual Property Law and Naomi Klein s more activist take on the subject, No Logo. What would happen if you condensed the arguments in these two books into a 15 minute video? Well, this morning I found out what this might look like. Someone pointed me to a mind blowing video that might be called All Logo, All the Time: an amazing visual and dystopian rendition of the alphabet soup of logos, trademark acronyms, corporate mascots that pervade our landscape, one might even say consciousness. I would take a whirl and watch before the IP police take it down.

20 February 2010

Roland Mas: FusionForge news, February 2010

This is getting old news, and others have blogged about them before I did, but here's my summary of the recent activity in and around FusionForge. The early February meeting was a success, and gathered about twenty people on the first day and a dozen or so on the second day (not planned initially). My impression is that there was a healthy mix of FusionForge hackers, FusionForge users, and people from other forge communities (Codendi, NovaForge, and even one representative from nFORGE, from South Korea). I'm not going to repeat all that was said then, especially since the proceedings are online. Beyond the technical points, I'll just advertise PlanetForge again, since everyone present agreed we had lots to share and that this site would be a good and relatively neutral place. If you're into forges, I recommend joining us in that community. On the purely FusionForge front, news are good too. Most of the major pieces we want to see in the next release (which is probably going to be called 5.0) are in place. The last blocker we had was the merge of the rework of the default theme for better accessibility and easier maintenance and customisability (most of the theming now happens in CSS). This merge has been completed this week, and although there are still a few rough edges, it's mostly done. We'll try to fix most of these rough edges soonish, then start a stabilisation branch towards 5.0, so more experimental work can start again on trunk. For the impatient and the curious, there's a list of new features on the fusionforge.org homepage, and the site is now running code from trunk. Of course, we're eager to get testers for that, which is why I prepared snapshot packages. They are currently stuck in NEW on their way to the official Debian experimental repository due to the renaming of the source package and the introduction of plenty of new binary packages, but they can already be obtained from my unofficial repository at people.debian.org. The packages are built for Debian unstable, but they seem to run just fine on Lenny if you grab mediawiki from backports.org (only required for the Mediawiki plugin, of course), and libnusoap-php and php-htmlpurifier from Debian testing (they don't drag any extra dependencies). I'll end this note by reminding people of the announcement I did three months ago: as of this week, Debian Etch is no longer officially supported security-wise, and so neither is GForge 4.5. As far as I know, I was the last person doing that, and my incentives have gone away on the day Etch ceased to be supported, since it was also the day the Adullact forge finally migrated from Etch with GForge 4.5 to Lenny with FusionForge 4.8. If you're still using 4.5, well I think you should be aware of that. That more or less wraps it up for now. The next announcement is likely to be about a release candidate

John Goerzen: Is the Roman Emperor Still Your God?

In ancient Rome, the Imperial cult was the worship of the Roman emperor as a god. It came to be at roughly the same time as Christianity. In the cult of the emperor, Caesar was revered as a deity. According to Harvey Cox, This was what we might today call a civil religion it had its holidays, processions, and holy sites throughout the empire. Adherence to it was required of all of the emperor s subjects, wherever they lived and whatever other deities they also worshiped. It was the religious and ideological mucilage that held the far-flung empire together. Perhaps you see where this is going. There was a certain group that found the imperial cult, well, repugnant. They felt their own goals bringing their god s peace and justice to the world were incompatible with this sort of devotion to a human institution, and the very institution that had killed their leader at that. Their reaction went like this:
Regarding worship of the emperor, Christians responded with an unequivocal no. They claimed that Jesus Christ was God s kyrios ( anointed one in Greek), but since kyrios was one of the titles attributed to Caesar, they refused to participate in the imperial cult. They were willing to pray for the emperor and for his health, but they stubbornly refused to pray to him or offer ritual tribute. They recognized that one could not be a follower of Jesus while also honoring a rival to the loyalty their faith in him and his Kingdom required; therefore, not even one pinch of incense on the imperial altar. This defiance of the political religion of the empire, which led their critics to brand them subversive, landed many of them in arenas with salivating lions. Harvey Cox in The Future of Faith
Now, you may be wondering, why am I asking if anyone still worships the emperor of a long-extinct empire? I maintain that this practice is still alive and well, just under a different name. I have been interested in some of the debates about American institutions that choose to perform neither the national anthem nor the pledge of allegiance. Many of these institutions are Mennonite, and their reason for not participating in these two particular acts mirrors that of the early Christians refusing to worship Caesar: namely, their goal is to bring about God s peaceful and just kingdom on earth, and no country, no human institution at all, can ever command greater loyalty than that cause. Moreover, the American national anthem is a particularly violent one, celebrating the taking of life right there at the beginning. Not completely compatible with the ethics of a church trying to bring about a more peaceful world, right? It is from that basis that many Mennonites, and our institutions, do not perform the national anthem or say the pledge of allegiance. For myself, when the national anthem is being performed, I will stand out of respect for those around me for whom the moment is important, but I do not sing. I am deeply appreciative that the United States, like many other countries, makes it legal to do this. I am heartened by the fact that I do not risk a confrontation with the lions over my religious stance today. Goshen College, a Mennonite institution, recently decided to go back on a century of history (which goes back farther than the anthem itself, which was only adopted in 1931) and will now be performing the anthem, followed by a prayer, before select sporting events. And by so doing, they fail both to act in accordance with the way of Christ, and to be a patriot. They fail to act for peace and justice by playing an anthem that supports and glorifies war and violence. And they fail to be patriotic. Patriotism and nationalism are different things. It s easy to be nationalistic to get up there and sing a song that everyone wants you to sing. It is far more difficult to be patriotic. Being patriotic in the United States means using the freedoms we have to improve our country. Goshen ought to use its freedom to not observe the national anthem as a way to try to draw a line in the sand against violence, to suggest that our anthem fails to adequately recognize the character of the American people and who we want to be, and to suggest a better alternative. After all, those people who are venerated today as patriots anyone from Martin Luther to Thomas Jefferson to Martin Luther King stood up to their fallible human governments to seek positive change. Instead of a route both religious and patriotic, Goshen College has chosen one that is neither. I am deeply disappointed that 300 phone calls have apparently cowed their leadership. What have we come to when our ancestors braved the lions, and we give up our principles over the fear of bad publicity? Ah, Goshen, perhaps you are thinking that you could spare a few pinches of incense for Caesar after all?

19 February 2010

Gustavo Noronha Silva: WebKitGTK+ testing

Most times when I blog about WebKitGTK+ it s to talk about new features, and their usage in Epiphany. This time I d like to tell those who care more about our test infrastructure. Like I said in my previous post, testing is something we take very seriously in WebKit land. It would be hard to get such a complex project, with such diversity of platforms moving forward without automated testing. Apple hosts a buildbot master that controls a whole lot of build slaves, for many platforms. Today we added the fourth WebKitGTK+ build slave to the family: 64bits release. This makes up for 4 build slaves in total, 2 release bots sponsored by Collabora, and 2 debug bots sponsored by Igalia. These bots build WebKitGTK+, and then run what we call the layout tests . I use quotes there because the name is a bit misleading. Despite being HTML/JavaScript tests, they cover a whole lot of functionality, and tests for regressions in many areas, including security, crashes, animations, media playing, DOM behaviour, and javascript API behaviour. WebKitGTK+ bots currently run 6397 tests, which represent about half the available tests. Our bots are also, as of today, the first ones to run platform-specific API tests. Almost a year ago we started writing small tests based on glib s GTestSuite, and they have been very valuable in helping us make sure our API expectations aren t breaking (at least unknowingly), and to be able to test things that would be very hard to have Layout Tests for. So, yay! Thanks to everyone involved. Back to layout tests, now: the other half is currently skipped because of one of three main reasons: The first one is the worst of all. It means we have broken functionality, or lack web compatibility. The second one is less bad, we can usually trust layout, and rendering to be good because most of the rendering code is shared (thought there are exceptions, of course). Render dumps are a special way of representing the render tree as text, and we need to generate our own results because of differences in things such as font sizes. The third one is also pretty bad - it means we cannot test some features; DumpRenderTree is an application that uses the port s API to run the tests, and provide additional JavaScript API through JavaScriptCore. If you feel like helping WebKitGTK+, choosing a bunch of these (specially non-render-dump) skipped tests to make them pass could likely be a good first step =).

Steve Kemp: If you were a comic book character, what character would you be?

I've been overhauling the way that I am host a number of virtual websites upon my main box. Partly to increase security, and partly for a cleaner separation or roles, ownership, and control. (In general everything on my box is "mine", but some things are "ours"...) After a fair amount of experimentation I decided that I wasn't willing or able to rewrite all my Apache mod_rewrite rules just yet. So my interim plan was to update each existing virtual host: To make it clear what the users were for I decided that every hosting-user would have an "s-" prefix. So the virtual host "static.steve.org.uk" was initially going to be served by the s-static user. The thttpd configuration file would look like this, and would be located in /etc/thttpd/sites/static.steve.org.uk: 
host=127.0.0.1
port=1008
dir=/home/www/static.steve.org.uk/htdocs/
chroot
user=s-static
throttles=/etc/thttpd/throttle.conf
logfile=/home/www/static.steve.org.uk/logs/thttpd.log
pidfile=/home/www/static.steve.org.uk/pid/file
(I wrote a trivial script to stop/start all the sites en mass, and removed the default thttpd init script, logrotation job, and similar things.) How did I decide which port to run this instance under? By taking the UID of the user: 
steve@skx:~$ id s-static
uid=1008(s-static) gid=1009(s-static) groups=1009(s-static)
With this in place I could then update the Apache configuration file from serving the site directly to merely proxying to the back-end server: 
<VirtualHost *>
    ServerName  static.steve.org.uk
    # Proxy ACL
    <Proxy *>
        Order allow,deny
        Allow from all
    </Proxy>
    # Proxy directives
    ProxyPass          /   http://localhost:1008/
    ProxyPassReverse   /   http://localhost:1008/
    ProxyPreserveHost on
</VirtualHost>
So was that all there is to it? Sadly not. There were a couple of minor issues, some of which were:
cronjobs
I have various cron-jobs in my main steve account which previously updated blog indexes, etc. (I use namazu2 to make my blog searchable.) I had to change the ownership of the existing indexes, the scripts themselves, and move the cronjob to the new s-blog user.
cross-user dependencies
I run a couple of sites which pull in content from other locations. For example a couple of list summaries, and archives. These are generally fed from a ~/.procmail snippet under my primary login. Since my primary login no longer owns the web-tree it is no longer able to update things directly. Instead I had to duplicate a couple of subscriptions and move this work under the UID of the site-owner.
I'm no longer running apache
For a day or two I'd forgotten I was using the apache facility to include snippets in my site; such as links to my wishlist. Since I'm not using Apache in the back-end server-parsed files no longer work. Happily I'm using a simple template-based setup for my main sites, so I updated the template-parser to understand "##include ./path/to/file". For example this source file produces my donation page. The upshot is my "static" site is even more static, which is a good thing.
uploads are harder
Several of my domains host entirely static content which is generated on my main desktop machine, and then uploaded via rsync post-build. I had to add some more accounts and configure SSH keys, then update the uploading routines/Makefiles appropriately. Not a major annoyance, but suddenly my sshd_config file has gone from "PermitUser steve,backup" to including many additional accounts.
The single biggest pain was handling my my mercurial repositories - overhauling that took a bit of creativity to ensure that nothing was broken for existing or new checkouts. I wish that a backport of mercurial-server was trivial because I'd love to be using that. In general though watching the thttpd logs has been sufficient to spot problems. I had to tweak things a little to generate statistics properly, but otherwise all is good. Why thttpd? Well small, lightweight, and the ability to run CGI scripts. Something missing from nginx for example. I'm still aiming to remove apache2 from the front-end - it is mostly just a dumb proxy, but it does perform some ACL operations and expand mod_rewrite rules. I could port those to another engine .. but not today. The most likely candidates are nginx, perlbal, or lighttpd - each of these should be capable of doing simple ACL checks, and performing mod_rewrite-like rules. ObFilm: Mallrats

Olivier Berger: Vid os de certaines confs du th me D veloppement des RMLL 2009

Free Electrons vient de mettre en ligne des vid os des conf rences qu ils ont film es aux RMLL 2009.
Une partie des vid os porte sur le th me D veloppement que j ai coordonn . Voici la liste des interventions film es : Le son n est pas toujours top, mais c est fait avec les moyens du bord, b n volement ;) Vous trouverez les pointeurs vers les vid os et les slides chez Free Electrons (en bas de liste). Et n oubliez pas : l dition 2010 remet a, avec un appel contributions toujours ouvert.

18 February 2010

Martin F. Krafft: Thank you, Catalyst!

Tomorrow, Penny and I head off back home, and two months of living in NZ come to an end. (did you hear that, pleaserobme.com?) Maybe I ll find the time to write about my impressions of living on this side of the planet, and being immersed in Kiwi culture while going after my daily routine and trying to work as much as I could. But there is one thing that should not wait: Thank you, Catalyst IT for giving us workspaces! For the better part of 6 weeks, you gave us our own room, monitors, keyboards, mice, and connectivity. And more than that: you welcomed us, let us participate in sessions, invited us to your parties, received our parcels, sent out letters, and generally provided us with a great environment to work. This was certainly well above what we had dreamed of. At times, I was forced to stay into the middle of the night 12 hours time difference with Europe is not always easy and spent waking hours in your building alone. Thank you for your trust! Catalyst is a fully New Zealand owned company who deliver critical open source business systems to some of NZ s largest organisations, and organisations worldwide. Catalyst was also a major enabler of LCA2010, and a sponsor of Kiwi Foo Camp, both events that I had the privilege to attend. Let me know when you re in my part of the world. ;) NP: The Mamaku Project: Karekare

17 February 2010

Stefano Zacchiroli: RC bugs of the week - issue 21

RCBW - #21 I've accumulated one more day of delay, but here is a full RCBW issue. Still, I've a nice good excuse for the extra delay: I've changed house in Paris, the new one is very small (a chambre de bonne), but also very comfortable. Without any further ado, here are this week's squashes: And here are the usual highlights:

Russell Coker: Can the NBN Ever Break Even?

I previously wrote about how the National Broadband Network (NBN) seems more suited to porn delivery than regular Internet use [1]. It doesn t seem to be of much use really. In a particularly insightful comment John Hughes suggested that the real purpose would be TV delivery. The ABC is currently delivering 640*360 resolution MPEG4 files via iView for it s TV content. To use iView on Linux you need Jeremy Visser s Python-iView program [2] in conjunction with Luke Kenneth Casson Leighton s rtmp program [3]. Note that to get this working on Debian/Lenny you need to install the python-simplejson package as well. For the current ABC service it requires 251652 of data for a 3167.6 second Torchwood episode, that averages to 79.4KB/s of data. In contrast a video of Dan Gilbert from TED.com at high quality was in 640*480 resolution and required 301652KB of data for 1276.5 seconds which averaged out to 236.3KB/s. My ADSL2+ connection is theoretically capable of something over 1MB/s and occasionally gets such speeds for unusual download situations (such as downloading multiple large files at the same time). But generally I can t rely can t rely on sustained transfer rates of more than about 200KB/s. So I could watch streaming TED talks at reasonable quality, but for the best results I have to download them and watch them from disk. Assuming the same ratio of compressed data to raw pixels used for HDTV as used for TED talks a 1920*1080 HDTV resolution MPEG4 with the same quality as a TED talk would take 1600KB/s. It is possible to vary the compression level and possibly the usage of a TV stream would permit better compression than the usage of a TED talk for the number of pixels. But it seems reasonable to assume that something like 1600KB/s is needed for best HDTV, that is more than the vast majority of ADSL2+ installations can be relied on to sustain. But 100Mb/s would allow at least two 1920*1080 HDTV transmissions to be viewed at the same time, and maybe three or four as few homes have only one TV this should be of great interest. Now the question is how much people would pay for this. Currently there are two main pay TV companies in Australia, Foxtel which charges $916 for a 12 month plan [4] and Optus who s web site is so awful that I gave up before discovering what they cost (I will assume that they are competitive with Foxtel). Now I think it s reasonable to assume that $916 is at the high end of what potential customers are prepared to pay, as they are competing with free to air TV, DVD sales, Youtube, and downloads of pirate content. The current bank interest rate on term deposits from the Commonwealth bank is 6.3%, the interest rate on raising the finance would have to be greater than that let s assume 7%. So the $5000 per household will require an interest payment of $350 per annum. If a household signs up to pay TV services at a cost of $1200 per annum that might be enough money to pay slightly more than $350 to the NBN plus make a profit for the pay TV company. So if every household in Australia signed up for pay TV over the NBN it should be profitable. But that seems unlikely. The majority of the Australian population (IE the majority of the city population) is used to paying not much more than $240 per annum for a basic phone service and not much more than $360 per annum for a basic broadband Internet service. A bundled deal of $1600 per annum for phone, Internet and pay TV should allow the pay TV company and the NBN to be barely profitable if everyone accepts the deal (unless of course interest rates rise). If half the population aren t interested then the bundled deal would have to cost $2000 to have the potential for being profitable. If three quarters of the population aren t interested then it would have to cost $2300 or more! The Australian Bureau of Statistics documents that in 2008 the median household disposable income in capital cities was $593 per week [5]. So it seems that the idea of the NBN being profitable is based on plan to have more than three weeks of household disposable income per year being spent on Internet/phone/TV services. But fortunately for the pay TV companies and the content companies there is no requirement for the NBN to be profitable, it s being paid by tax money so if it loses money then we can just pay more tax! It s the ideal public private partnership , the citizens take all the risk and the corporations reap all the profits! James Purser describes how Stephen Conroy gave the TV networks something between $250,000,000 and $500,000,000 a year for the next two years [6]. It was claimed that this huge gift would be conditional on the production of more Australian content but they ended up not putting any conditions on it. In a strange coincidence Stephen Conroy did this a month after having a meeting with Kerry Stokes (head of Channel 7). Based on this I don t believe that there was ever a serious plan to make the NBN profitable. I think that the plan was just to take our tax money and spend it on things that benefit friendly corporations. Really it s better for us if the government just hands out $500,000,000 at a time instead of spending $43,000,000,000 on a project that has the same aim of giving a few hundred million to cronies.

16 February 2010

Steve Kemp: I am lightened, can we drop this?

As part of some house-keeping I've been checking over my systems and ensuring they're all tickity-boo for the past couple of days. One thing that I'm getting increasingly tempted by is converting my kvm guest to a 64-bit system. I've not quite sold myself on the prospect of what will be a fair amount of downtime, but I'm 90% there. I do think that a lot of my setup needs an overhaul, for example: One possible plan is to wipe my system, and then restore data from backups. A perhaps saner approach is divide my guest into two smaller ones, and migrate services over one by one (e.g. website1, website2, .. websiteN, email, etc). For the moment I've taken a complete dump of my existing guest, and I'm running it with an IP in the 10.0.0.0/24 range on my desktop. That's at least given me a clear idea of the amount of work involved. I'm still a little unclear on how best to manage running N websites with the intention they'll each run under their own UID. I guess it comes down to having a few instances of nginx/lighttpd/apache and then proxy from *:80 to the actual back-end. Precisely which mixture of services to use is a little overwhelming. Though at some point soon I need to start enabling IPv6 support, and that changes things a little. (Not least because nginx has no IPv6 support present in the Lenny release - I've got a backported package which I run on the Debian Administration website.) It's possible I could hack mod_vhost_alias to redirect/proxy to a local port based upon the virtual hostname present in the request - that's pretty trivial and I've already done something similar for work purposes. Though something like that should presumably already exist? I would expect a map of some form: 
example.org: 127.0.0.1:8080
example.net: 127.0.0.1:9090
That has to be about the minimum necessary information to make the decision; a pair of vhost name & local destination. /me googles some.. Update
OK quick update I've added local users for some of my sites, and now have them running under thttpd. 
skx:/etc/thttpd# ls -ltr /home/www/   tail -n 4
drwxr-sr-x  4 s-static   s-static   4096 Jan 15 01:41 static.steve.org.uk
drwxr-sr-x  5 s-openid   s-openid   4096 Feb 16 21:31 openid.steve.org.uk
drwxr-sr-x  6 s-images   s-images   4096 Feb 16 21:52 images.steve.org.uk
drwxr-sr-x  5 s-packages s-packages 4096 Feb 16 22:03 packages.steve.org.uk
That seems to work well, with a small wrapper script to start N instances of thttpd instead of a single one. Minor issues are that I'm using mod_proxy to forward requests to the thtpd instances running upon the loopback - and it was initially logging 127.0.0.1 as the source IP. A quick patch later all is well. I'll leave it running a couple of the simple sites for the next few days and see if it kills children. If it does I'll convert the rest. Probably will aim to have nginx in front of thttpd, instead of Apache, but this way I don't have to worry about mod_rewrite rules just yet.
ObFilm: Cruel Intentions

Russell Coker: National Broadband/Porn Network

Currently we have a new National Broadband Network under construction in Australia [1]. It is going to cost $43,000,000,000 which is $5,000 per household. It is designed to deliver 100Mb/s speeds to most homes that is the homes that can currently get more than 8Mb/s through ADSL2+ or cable connections. The question is, what can we do with 100Mb/s that we can t do with 8Mb/s? It seems that ADSL2+ works pretty well for VOIP, video-conferencing, online games, and transferring CD/DVD images (with a little patience). It seems to me that the only benefit in having download speeds faster than 8Mb/s is for downloading high resolution images and video files in a small amount of time and porn surfing seems likely to be the only reason for someone being so impatient to get high resolution images! Now there are some potential technical benefits to this, FTTH will allow synchronous upload and download speeds and being able to transmit data at 100Mb/s will be a significant benefit. If the data transfer quota was reasonable then I could run my blog, my web site (including my Debian package repositories), and some other new projects from a server in my own home. Currently Internet access in Australia sucks mostly because of the cost of international bandwidth [2]. Also while Telstra was run by the awful Sol Trujillo it was trying to gain a monopoly on domestic services via it s Fiber To The Node (FTTN) scheme, it seems that one of the biggest benefits of the NBN is to prevent Telstra gaining such a monopoly but as they are going to pay the NBN CEO a $2,000,000 salary [3] it seems that some of the same mistakes are being made. In any case $43,000,000,000 is a lot of money to pay to break a monopoly, there are much cheaper ways of doing this. Now if the money was to be spent intelligently on Internet access the first area would have to be submarine cables, if the capacity of the connections between Australia and the rest of the world could be significantly increased then it would change the way the Internet is used. I have a US-based colleague who transfers more data from his mobile phone than I do through my home ADSL connection and he pays about the same amount of money as me! I think that most serious Internet users would rather have an ADSL2+ connection that is cheaper and has a larger bandwidth quota than a FTTN connection with a high transfer rate but a small quota of data that can be transferred from what I ve read about the NBN it doesn t sound like a service I would want to sign up for. Then there is the issue of servers, currently for most uses Australia is not a viable location for a server due to bandwidth costs. This decreases the job opportunities for Australian system administrators and decreases the Australian IT skills base. The next area that needs attention is wireless net access. The first issue that should be addressed is the minimum cost, the cheapest net access in Australia is via 3G because it avoids all the costs of wiring [4]. It would be good if instead of paying about $150 per annum for 3G net access there were some options for cheaper plans, maybe $60 per annum for 6G of data. In many ways the current Australian lifestyle requires Internet access, and many aspects of interaction with government organisations requires net access, so it seems that the government should make it a priority to provide cheap net access to the entire population. A 3G net access plan of $60 per annum plus a subsidised purchase plan for cheap PCs (maybe taking a Netbook from $350 to $250) should significantly decrease the number of people who can t use the Internet. 3G access (both Internet and telephony) also needs to be available in more areas. Currently Telstra has the widest coverage of any mobile phone company, but it uses a non-standard frequency which limits the availability of suitable phones and it doesn t compete on price [5]. So rural users have to pay through the nose for Telstra mobile telephony and they get a limited choice of phones. It would be really good if we had a NBN for 3G phones that covered the areas surrounding most rural population centers to compete with Telstra. If rural users could pay $60 per annum for 3G Internet access and a reasonable rate for mobile phone access (maybe a combined phone/data plan similar to those offered by Three and Virgin) then it would significantly improve the rural access to services that urban residents take for granted. The NBN plan does include providing wireless and satellite net access to the 10% of the population who will be out of range of FTTH. But I am concerned that it will provide a bare minimum of service and not an integrated voice/data service that permits using the newest features of phone OSs such as Android. In the past I ve had some commercial experience with satellite Internet access and I have not been impressed with it, the response times were very poor and fully interactive services were almost unusable. The government should aim to provide support for interactive services that facilitate business operations (including video-conferencing and remote server access via ssh, VNC, etc) to as much of the population as possible. I expect that a significant portion of the Internet using applications on smart-phones such as those running the Android OS will require fast response times, so even if a satellite version of an Android phone is ever produced it still wouldn t be as useful as the current phones. Finally the government should offer free wireless net access in all major urban areas for the purpose of accessing government services, Australian content, and Australian mirrors of foreign content. This would be a convenience feature for most people and would also be good for emergency access I shouldn t have been denied access to government services when the PSU for my ADSL modem died in the heat last week, I should have been able to take a laptop to the nearest government Wifi access point! In conclusion I think that the government should spend money on lowering the cost of Internet and mobile telephony access for everyone and granting greater access to government services. I am not aware of any evidence to suggest that the current NBN plan will do anything to achieve such aims. But it should be really good for accessing porn sites that use a CDN with an Australian presence. Update: John Hughes pointed out in an insightful comment that 100Mb/s can be used for watching TV. So this could be a ploy to try and convert Internet access into better TVs paid for by our tax money!

Christian Perrier: Bug #570000

(you were awaiting this one, weren't you?) Ron Murray reported the Debian bug #570000 on Monday February 15th, against the gnome-keyring-daemon package. Bug #560000 was reported as of December 8th 2009. We're behind our "10,000 bugs in 2 months" pace by one week, so that's a small drop in the bug reporting rate, this time. I hope that people remember the Bug #600000 contest. Bets are closed now (the wiki page is still opened for modifications but I'll revert them if they are late bets). Being 30,000 bugs away from #600000, it's time to image when that bug could happen. The current "2 months+1 week/10,000 bugs" says it would happen around September 10th. With the "2 months/10,000 bugs" that would be August 15th, just after DebConf 10. The closest bet as of now seem to be either Miod Vallat or Kanru Chen. I probably lost already (I did bet June 30th) unless I imagine a very massive bug filing. Too bad Matt Arnold, Thomas Preudhomme, Nicolau Werneck and Odd Henriksen, you already lost!

Ingo Juergensmann: StrongSwan and L2TP/IPsec on Debian

Mac OS X and other operating systems are using L2TP/IPsec for VPN connections. I'm running StrongSwan as my IPsec stack of choice, so I wanted to setup a VPN between my Debian lenny server and OS X as my roadwarrior. There's a nice howto on nielspeen.com. Everything is fine except for one thing:

Q: I want to set up strongSwan to interoperate with Microsoft Windows using L2TP/IPsec. I'm getting the error message "NAT-Traversal: Transport mode disabled due to security concerns" which results in strongSwan sending an encrypted notification BAD_PROPOSAL_SYNTAX

A: Here is a quote from strongSwan lead developer Andreas Steffen on how to deal with this problem:
NAT-Traversal with IPsec transport mode has some inherent security risks. Since Microsoft doesn't care about this please compile strongSwan with the option

./configure --enable-nat-transport


So, there's the inherent security risk, but without --enable-nat-transport L2TP/IPsec doesn't work at all with StrongSwan on Lenny. Is there anything I can do, dear LazyWeb, to be able to use L2TP/IPsec VPN connection with OS X and Linux (StrongSwan) to have a really secure connection? Being able to use Windows as VPN roadwarrior clients is optional, but no requirement.

15 February 2010

Gustavo Noronha Silva: WebKitGTK+, and the Page Cache

So, one of the things I get to do during work hours for Collabora is to contribute code, and do maintenance tasks for WebKitGTK+, and have been doing so since early last year, working on all kinds of things, from improving the network backend to handle the real-world web, to fixing scrolling problems, while reviewing patches from the many awesome developers who have been joining us (more on that later =D). One of the big features I have worked on this past month or so, along with Xan Lopez is the Page Cache. The page cache is a feature of web browsers that makes going back, and forward between pages in the same view very fast. It s better explained in this post, but to summarize, the idea is that instead of destroying all the work you have done since downloading the resources, and having to reparse/rebuild the structures the view uses to display the page from the cached resources, you hit pause on the page, and store the whole thing as is, and when coming back to it, you just hit play. You can see in the video two instances of Epiphany, one with the page cache enabled, one with it disabled. Easy to see which was has it enabled. Thanks to KiBi for the suggestion regarding a page that shows this easily =D. <video controls="controls" height="302" src="http://kov.eti.br/media/webkit/page-cache.ogv" width="450"></video> We initially thought we had this feature enabled, since our initialization functions (that exists since before the current maintainers were involved) did setup the number of desired pages in the cache, but during the hackfest we held in December we found out we were fooled all this time. Enabling the page cache does make going back faster, but also made lots of things become unstable and crash. Since then, we have been working on figuring out all the problems, and fixing them, using help from adventurous users of in-development software ;D. I believe we re now at a point in which I can happily declare the GTK+ port has a working page cache in trunk! If you re interested in the nasty details, bear with me! Let me go back in time a bit, and show you what problems we had. First, some background: the GTK+ port deviates a lot from the other ports when it comes to scrolling. This is because, when designing this part of the port, Holger Freyther had a very nice idea in mind: that the WebView should be a first-class citizen GTK+ scrollable widget. Meaning it would use GTK+ s adjustments for scrolling, and be able to interact with any parent scrolling widget, be it a GtkScrolledWindow, or a MokoFingerScroll. We cannot just throw away all the rest of the scrolling code in WebCore, though, that deals with all the details related to interacting with the DOM, and JavaScript code. This means our WebView contains adjustments that need to be set, and unset on our port s version of WebKit s own representation of the view, called the FrameView, to interact with it, and to get updates on the bounds of content, and such. For every load, in the non-page-cache case, a new FrameView is created, the previous one is destroyed - this means we need to set the adjustments on every load. The problem starts when you have the page cache enabled, because the code path used to do what is called commit the load of a cached page (that is, start replacing the content that is currently being displayed by the one that should now be displayed) is completely different, and we were not setting the adjustments on this new view, so we started with that. But all was not well. We were still having weird behaviour with scrollbars disappearing, and becoming the wrong size, and worse, crashes when back was hit. We then started investigating in more detail how it is that the page cache does its magic, to try and figure out the source of all evil. It turns out that when you leave a page that can be cached, the existing FrameView is no longer destroyed - it is stored as is in a CachedFrame to be restored if you go back, and a new one is created for the new page. This was having the undesired effect of having the adjustment be set in more than one FrameView at once, causing all kinds of (predictable, after we knew for real what was going on) unwanted effects. Thus, we reworked the code to make sure the adjustments are only ever set in one FrameView at once, making sure they are unset when the FrameView is being frozen, and reset when it s being restored from the page cache. Last, but not least, it was discovered that going back to a page that contained resources with data: URIs (such as Google results pages which contain a small number of image hits) also caused a crash. This was because our network backend was not storing the data: URI in the ResourceResponse objects it fed into WebCore. The page cache relies on those responses to recreate the requests it uses to artificially replay the load when restoring the page from the page cache, so we fixed that as well. What can be taken from all this? Building browsers is a lot of hard work! I can t think how we could deal with this level of complexity without the awesome testing suite of WebKit. The good news is all of those issues I talked about in this post are now covered by the automate tests that run as part of the normal buildbot cycle in our bots, so we re covered for the future, at least for these specific problems =D.

Biella Coleman: Timing Life

The Chronicle recently published a piece that drew a lot of attention on the difficulties that female academics with kids face during the first 4-7 seven years of their job when academics are expected to do nothing but produce, produce, and produce and yet because they have produced children, they can t produce all that much writing. I don t share the author s predicament in that I don t have kids. But I have had to be an (often long-distance) caretaker for the last 8 years, 4 of which I spent considerable time in PR taking over my mom s caretaker s duties. Although when it comes to female academics and kids there is a lot that can (really must) be done to facilitate a career and motherhood, when it comes to taking care of my mom, being an academic has been an odd and mixed blessing, although it did require me to play with the system self-consciously or else it would have been an early academic death. When my mom was first falling pretty ill, I was wrapping up my dissertation. Though I was ready (on paper at least) to go on the market, I did not step foot in it. I knew that if I landed a job it would be the end of seeing my mom and since she only had a few years of capacity left, I decided to 1) apply only for one postdoctoral position (that had no teaching and was in NJ making it very easy to fly home frequently) 2) if I did not land it, I would return home to spend time with her, keep on writing but not graduate. If I had started a job right after my dissertation, I would have killed my chances of churning out articles, and worse, not have seen much of my mom. I was lucky enough to land this postdoctoral fellowship, which was a life savior. I was able to get a heck of a lot of work done that I would never ever would have been able to do my first two years of teaching (kids or no kids) and I spent many months in PR as well. I always encourage graduate students to apply for these positions because the payback is enormous (with the exception of fellowships that require a ton of teaching), even if the applications are really time consuming, more so than applying for jobs. Though rarely stated in such terms, the first few years of an academic position is not unlike medical residency. It takes a brutal amount of time, not only because of the sheer time you have to work but also because there is so much new to learn and so many different responsibilities to juggle. It is exhiliarting but draining, even disorienting. But there is one important difference from our medical school counterparts (aside from the blood and guts and gore :-)): their hell continues throughout the year, while our hell diminishes during the summer when classes end and writing is supposed to dominate your attention. Also since I am not required to be here once classes ended, I am able to leave NYC and spend it back home. I would simply not be able to do this with most any other full time job (unless it involved telecommunting) and for that I am grateful I landed the job I did. Academia, despite its rat race quality, has allowed me to visit my mom throughout the year and summer. Given the importance of summers for writing it seem that departments/universities can do a lot for female faculty simply by sponsoring or helping to pay for summer day care for two years, thus offsetting some of the costs and then providing them with the space needed to write/produce.This can accompany the policy that some, though not enough schools have, which is turning off your tenure clock for the year you are pregnant, and in some cases, even giving you leave. Thankfully at NYU you can stop your clock not just for pregnancy (which they now automatically do because when it was optional some female professors were not taking it!) but also for circumstances like mine. I was given a short tenure extension, which was not easy to ask for but it is important to do so. I am extremely grateful they have this policy. Something else partially unique about caring for a parent is the perspective it affords. Although it would be a lie to say I suffer no anxieties about my job, I find it hard to get embroiled in a lot of the petty politics of academia, a perspective that clings to me, especially after having to take care of someone with Alzheimers, and especially my mom who we nicknamed the Russian Terror for her turbulent (but really fun) personality. Sitting in front of your computer to write and think about some obscure academic topic feels not only easy after those experiences but a scamish sort of privilege. My mom is now in a nursing home and I no longer have to spend time taking care of her. Instead I visit and see her and get overwhelmingly sad when I do. In one month, it will be her 2 year anniversary in a nursing home and I still have not come to grips with the situation. It strikes me as obscene and unreasonably cruel that this illness can afflict a person for years, even a decade or more. Perhaps more than anything it is the sheer massive length and persistence of this illness that makes it so hard to bear. And I am sure my work for better or for worse has acted as an emotional refuge, where I drown myself in work that I love instead of drowning in the sorrow that I often feel, making what is a difficult job far easier.

Biella Coleman: Timing Life

The Chronicle recently published a piece that drew a lot of attention on the difficulties that female academics with kids face during the first 4-7 seven years of their job when academics are expected to do nothing but produce, produce, and produce and yet because they have produced children, they can t produce all that much writing. I don t share the author s predicament in that I don t have kids. But I have had to be an (often long-distance) caretaker for the last 8 years, 4 of which I spent considerable time in PR taking over my mom s caretaker s duties. Although when it comes to female academics and kids there is a lot that can (really must) be done to facilitate a career and motherhood, when it comes to taking care of my mom, being an academic has been an odd and mixed blessing, although it did require me to play with the system self-consciously or else it would have been an early academic death. When my mom was first falling pretty ill, I was wrapping up my dissertation. Though I was ready (on paper at least) to go on the market, I did not step foot in it. I knew that if I landed a job it would be the end of seeing my mom and since she only had a few years of capacity left, I decided to 1) apply only for one postdoctoral position (that had no teaching and was in NJ making it very easy to fly home frequently) 2) if I did not land it, I would return home to spend time with her, keep on writing but not graduate. If I had started a job right after my dissertation, I would have killed my chances of churning out articles, and worse, not have seen much of my mom. I was lucky enough to land this postdoctoral fellowship, which was a life savior. I was able to get a heck of a lot of work done that I would never ever would have been able to do my first two years of teaching (kids or no kids) and I spent many months in PR as well. I always encourage graduate students to apply for these positions because the payback is enormous (with the exception of fellowships that require a ton of teaching), even if the applications are really time consuming, more so than applying for jobs. Though rarely stated in such terms, the first few years of an academic position is not unlike medical residency. It takes a brutal amount of time, not only because of the sheer time you have to work but also because there is so much new to learn and so many different responsibilities to juggle. It is exhiliarting but draining, even disorienting. But there is one important difference from our medical school counterparts (aside from the blood and guts and gore :-)): their hell continues throughout the year, while our hell diminishes during the summer when classes end and writing is supposed to dominate your attention. Also since I am not required to be here once classes ended, I am able to leave NYC and spend it back home. I would simply not be able to do this with most any other full time job (unless it involved telecommunting) and for that I am grateful I landed the job I did. Academia, despite its rat race quality, has allowed me to visit my mom throughout the year and summer. Given the importance of summers for writing it seem that departments/universities can do a lot for female faculty simply by sponsoring or helping to pay for summer day care for two years, thus offsetting some of the costs and then providing them with the space needed to write/produce.This can accompany the policy that some, though not enough schools have, which is turning off your tenure clock for the year you are pregnant, and in some cases, even giving you leave. Thankfully at NYU you can stop your clock not just for pregnancy (which they now automatically do because when it was optional some female professors were not taking it!) but also for circumstances like mine. I was given a short tenure extension, which was not easy to ask for but it is important to do so. I am extremely grateful they have this policy. Something else partially unique about caring for a parent is the perspective it affords. Although it would be a lie to say I suffer no anxieties about my job, I find it hard to get embroiled in a lot of the petty politics of academia, a perspective that clings to me, especially after having to take care of someone with Alzheimers, and especially my mom who we nicknamed the Russian Terror for her turbulent (but really fun) personality. Sitting in front of your computer to write and think about some obscure academic topic feels not only easy after those experiences but a scamish sort of privilege. My mom is now in a nursing home and I no longer have to spend time taking care of her. Instead I visit and see her and get overwhelmingly sad when I do. In one month, it will be her 2 year anniversary in a nursing home and I still have not come to grips with the situation. It strikes me as obscene and unreasonably cruel that this illness can afflict a person for years, even a decade or more. Perhaps more than anything it is the sheer massive length and persistence of this illness that makes it so hard to bear. And I am sure my work for better or for worse has acted as an emotional refuge, where I drown myself in work that I love instead of drowning in the sorrow that I often feel, making what is a difficult job far easier.

Next.

Previous.