Search Results: "reg"

14 February 2008

Jordi Mallach: La Ruta del Carrilet

As Josep asks for it every now and then, and we really enjoyed this trip, it's time to write about the four days we spent cycling from Ripoll to Girona, through the Ruta del Carrilet, a Catalan via verda similar to the one we completed a year ago. I spent this year's 9 d'Octubre cycling trip with totally different trip mates, not related to my triathlon team. The extensive group was formed by Sabri, Mar, B rbara, Carles, Desi, Adela, N ria, Amador and myself. We started our journey by car from Val ncia to Mollet de Mar, where we parked the cars and take a regional train to Ripoll with our bikes, where the real journey would start.


Arrival at Ripoll When we got to Ripoll, it was quite late and dark, but we managed to find the start of the Ruta del Ferro rail trail which would take us to Sant Joan de les Abadesses. It was quite cold, but especially really humid, so we had to think twice before settling on a place to camp and setup our tents. We had to take special care of covering the bicycles as the air was really wet, and anything we left uncovered would appear soaking next morning. In part, my shoes suffered from this.

Early next morning we had breakfast on the wet grass and then started our way to Sant Joan through a deliciously well equipped and maintained cycling track, which unfortunately only lasts for 12 kilometres through a splendind landscape. After having breakfast in the old railway station in Sant Joan, we abandoned the Ruta del Ferro to take a road to Olot via Sant Pau de Seguries, where we had to climb a small mountain and then descend through the Vall de Bianya until we got to Olot.


Sant Joan de les Abadesses' railway station Asking the locals for the start of the Ruta del Carrilet was fun due to the strong oriental accent in the area and we sometimes wouldn't get a word of what we were told. An old man recommended us finding a big park in the outskirts of the town, where we prepared our entrepans for lunch, and after a little rest, we started cycling up the Carrilet, which would take us to Girona in two stages. This Catalan area is of volcanic origin, and there are several natural parks dedicated to the phenomenon. There are many mountains covered with forests and impossible peak shapes, which due to the time of the year were starting to go from green to brown and yellow, making fantastic colour schemes in the landscape.


Under a green ceiling in Olot Just after the few first kilometres, the railroad track starts to descend most of the way, which makes it easy for people who aren't too trained, and easier to enjoy your way chatting with people while you cycle. As we consumed the daylight, we came across a parish church party with lots of old and young people from the nearby town of Sant Miquel de Pineda. Amador and I were lagging behind a bit at that point, and when we got there, we found the rest of the group were already off their bikes and either having a curious look over the party, or directly following suit and dancing like the others. We had a peek into the small church and also into a small graveyard in the back, where I was surprised to find the enemies of my Catalan grandmother: Fam lia Matabosch , as one of the headstones revealed.


Partying at Sant Miquel de Pineda As it was getting late, we eventually started off again, but luckily B rbara spotted what seemed a good sleeping place for that night. To the right of the trail there was a hermitage (devoted to Santa Cec lia) up on the hill which, for bonus points, had a porch with a recently renewed roof which would help cover ourselves from humidity and rain, as we found soon after starting cooking dinner. While the cooks prepared our soup, some others went down to the Carrilet in order to find out if the next town was close so we could get some driking water for the dinner. Luckily, Sant Feliu was close enough, and we found a bar where we got some water... and two bottles of wine, which made some people back at the hermitage very happy. We were quite tired though, so we eventually went to sleep after reading some stories from a great tale book, with the sound of rain hitting the grass outside the porch. The rain was still with us when we started waking up, so we had breakfast and packed our stuff very slowly, in an attempt to avoid getting wet. But rain didn't stop, so we made a few hacks on our bicycle bagpacks to minimise the amount of rain wetting them. When we were finally ready to set off and had cycled around 3 kilometres under the light rain, it finally stopped raining, making the rest of the journey very pleasant.


Sleeping under the porch of Santa Cec lia's hermitage This part of the route is again quite beautiful, with impressive amounts of green vegetation at both sides of the track. There's a lot of water presence in the land, which makes the type of trees and bushes quite different to the ones we are used to find in the Valencian Country. After going by a few small towns, we arrived in the old railway station of Amer, hometown of the Puigdemonts. Even if it was a bit early, we decided to have lunch there, so a few of us went down to the centre of the town to buy bread and some other details to eat. Being in my friend Josep's town for the first time, I wanted to visit his family's bakery, but unfortunately it is closed on Mondays. We had lunch back at the cute station, and eventually kept going on our way to Girona. Outside Amer, the Carrilet was temporarily cut by the road, and there were two possible alternatives: using the road, with heavy lorry traffic, or diverting through a very steep track with very hard slopes. Most of the group preferred the road, but Mar, Amador and I went up that track, which was hard to climb and really fun to descend. Apparently, Amer locals call those 1.5 kilometres the Tourmalet . It's probably not so bad, though. :)


Amer's railway station Unfortunately, the Ruta del Carrilet starts getting uglier after Amer, and as you approach the more industrialised towns near the capital Girona. The area around Angl s wasn't that fun, with the track continuously being invaded by cars and other vehicles. Soon after we were in the farmland area surrounding Girona and its Devesa. Jonathan was waiting for us in the city, after his two month stay in Scotland, and we were all happy to meet him. We discarded continuing our way to the coast, which was the initial plan, and instead dropped our stuff in the house of one of Adela's friends, and went out to have dinner to a Wok restaurant, where the poor people running it suffered our childish behaviour involving the rotating central dish on our table and custard sucking contests. Jonathan guided us through the Cathedal and city wall areas of the town centre, which are impressive, and we climbed all of the wall towers to have great looks over the dark and quiet city. Eventually, we went to sleep, as Adela had to leave early, and we had to pack to get our train back to Barcelona. Back in Mollet, we cooked our last camping-gaz lunch in the park right next to the station, before noticing the place stinked of dog poo. After the careful operation of filling the three cars with 9 bicycles, we were finally on our way back to Val ncia, completing another great cycling journey. If you like bicycle tourism and can travel to this area in Catalonia, I highly recommend it, as there's many great places to visit, all of them accessible with bikes.


Having lunch in Mollet

13 February 2008

Kartik Mistry: kartikm


* Its pretty dead now. I should have understand that there is no things like Free hosting. Thanks to all who supported and bear my variable blog URL. This is now STABLE and FINAL. * News: I have done nothing much in Debian except regular maintenance of my packages. Regarding KDE-Gujarati localization, I just got commit access! Thanks to kool KDE-In team and specially to aacid and nicolas for solving my dumb queries. * Once again, I am going to Ahemdabad, and this time 2Ks are with me!! * My tooth is almost fine now except I have to visit Dentist daily. The root canal surgery is done and it wasn’t that much scary as I had some myth about it. I need to take picture of my beautiful teeth and upload it to flickr yet :P

Vincent Fourmond: How to shut wine audio output

As I've mentioned before, I play to Morrowind (III) using Wine. Fine. Thanks to a nice guy on the AppDB Forum, I found out that what was causing Morrowind to segfault was simply that I had not set any audio device in my configuration... So I did with winecfg, and it worked, and I was quite delighted. So far, nothing fantastic. It so happens that I hate to play any game with the game's music/sounds/voices, as I prefer to be quietly listening to music of my taste (I have delicate ears). As in any other game, you can switch them off in Morrowind, which is what I immediately did. However, it happens that some sounds - so far, only the sound corresponding to a shield blocking an attack (a graceful and delicate sound as you imagine) - go through even with all sound volumes are turned down to 0. It is annoying to the point I had to stop using the computer for listening music and falling back to my old CD player. Painful ! Or at least so it was until today, when I finally took my courage and found out how to fool wine into believing it is playing sounds when in fact it is not. First step, create a null ALSA output device, by adding the following to your .asoundrc:
# Null audio output
pcm.null  
  type null               # Null PCM
 
Then, you need to have wine use it (and only this one). For this, a quick look at the Useful Registry Keys showed that I had to add the following to my .wine/user.ref configuration file:
[Software\\Wine\\Alsa Driver] 1202930020
"DevicePCM1"="null"
"AutoScanCards"="N"
"DeviceCount"="1"
Just make sure wine is using ALSA output, and that's all ! Morrowind plays, without sound and does not segfault ! I'll be able to listen to my music again... Note I'm unsure about the value 1202930020. The best is to add the key Software\Wine\Alsa Driver using regedit and then edit the configuration file -- or even do everything with regedit.

12 February 2008

Neil Williams: Embedded Debian still Debian?

The basic Debian debootstrap system is 180Mb or so. Embedded systems need a full GUI installation in 64Mb or less and a basic debootstrap-equivalent system of 10Mb or less.
Such radical reductions in size mean radical changes to the structure of the the system itself. The question is, at what point does a modified Debian system become no longer Debian?
Main changes:

Main similarities:

So the question is, lazyweb, how far do we go before you would regard Emdebian as no longer Debian?
I now have image tarballs for such a system - 18mb compressed with a full GPE GUI included, 48Mb installed. The scripts could, potentially, work with any debootstrap tarball.
Although based on debootstrap, the Emdebian set can be unpacked separately from debootstrap so that as much of the workload can be done on the build machine as possible. This allows the "installer" to simply copy the decompressed filesystem onto the device, run /sbin/ldconfig and dpkg --configure -a and it's ready to go.
I have a few issues to resolve within the packages themselves and within the available kernel for my test machine but the result is a full GUI installation that will fit on a 64Mb SD card (32Mb is a tad too small) with enough room to spare to add a Linux kernel zImage, modules.tgz, Windows executable/autorun runes and a bootloader. i.e. a possible method of installing Emdebian onto a handheld running Windows CE or Windows Mobile. The only issue is getting the right kernel and modules for the device.
These are important benefits, the cost is whether such an installation still qualifies as "Debian".
At what point does Debian cease to be Debian?

Amaya Rodrigo: F r mich soll's rote Rosen regnen

Thank you for introducing me to Hildegard Knef and Amy Winehouse. You know who you are. Specially for the Extrabreit version of F r mich soll's rote Rosen regnen (It shall rain red roses for me). It takes me to the verge of tears.

11 February 2008

Gregor Herrmann: fun with 2.6.24, part II

after my laptop I tried to get 2.6.24 running on my desktop machine; several attempts (Debian kernels, self-compiled ones with different options) all led to the same results: a machine that feels rather unresponsive & where music has sporadic dropouts.

some searching on the intarweb showed that the new CFS scheduler (cf. Documentation/sched-design-CFS.txt) (at least the enabled-by-default CONFIG_FAIR_USER_SCHED flavour) might have latency problems, in itself or in combination with the ondemand CPU frequency scaling governor or with nice'd processes; after turning off all CONFIG_FAIR_* options in .config, recompiling & rebooting the machine seems to behave normally.

maybe I'm missing some great new features but actually I prefer a working desktop computer :)

update 1: approximately half an hour after the original blog entry I had my first "ion sorbet", i.e. a half-frozen ion3 (the applications are still running, I can switch to a tty but I cannot change/close/whatever ion3's frames). at the moment I have no idea what's going (wr)on(g) here ...

update 2: two more "ion sorbets" today yet; let's see if a new kernel (CONFIG_FAIR_USER_SCHED seems to be fixed in 2.6.24.1) & a new ion3 version help.

update 3: still the same problems (& inbetween some glitches with switching from X to a tty and back; I hope I solved them with some kernel config options); ATM I suspect ion3 to be the culprit; when it hangs it eats almost all the CPU, & strace'ing the pid gives only SIGALRM messages.

update 4: maybe I fixed the problem; by changing from ion3's deprecated statusbar_external.lua to the newer statusd_exec.lua (I just wanted to get rid of the error when starting ion3 ...).

10 February 2008

Biella Coleman: The resurrection of an older war

The problem with the Internet is that it never goes to sleep. And if you study the Internet as I do, that means spending a lot of time starting at the screen tagging, copying, pasting, downloading, watching, and assessing. I have taken a step or two back away as I have moved from life as a postdoc to working full time but ever since Anonymous declared war on Scientology last month, I have been spending more time online again (more than I want to at least), tracking and following some of their developments, including spending time on some of their IRC channels, downloading lots and lots of videos as well as all sorts of great flyers. Well today there was an IRL action loosely coordinated by Anonymous to protest the CoS and I have to say, I am simultaneously surprised and unsurprised at what I think was a pretty vigorous response and turnout. I was not too surprised as the attack against and criticism of Scientology is one of the older wars spurred on in part by the net and net ethics and it always seems to crop of from time to time. But I think the depth of smack talking I witnessed on IRC, (often clearly youthful in nature as this example reveals—>, [mizzanon] I will have my full license in approx. 3-4 weeks, as soon as I do, i will be driving around my entire region with tons of
anti-propaganda) led me to believe that they could not pull of this global day of action. But they did and perhaps with the exception of New Zealand (where there are probably better things to do anyway), they seemed to garner a fair bit of participants. It will be interesting to see how long they will continue to generate this type of support. The next day of action will be around the middle of March.

9 February 2008

Marco d'Itri: workaround for CVE-2008-0010

I wrote a quick and dirty workaround for the recent CVE-2008-0009 and CVE-2008-0010 local privilege escalation kernel vulnerabilities. Loading this kernel module will disable the vmsplice(2) and vm86old(2) system calls, which are used by the published exploits but by very few regular programs. The code is ugly and does not support amd64 bit systems, any help is welcome.

Gregor Herrmann: 2.6.24 (finally)

no big step for humankind but I'm quite happy that linux 2.6.24 is finally running on my laptop (thinkpad R60e). the culprit that caused the freezes during earlier attempts was cpudyn; after deactivating it I had no more problems so far.

what's not working is ath5k which seems to dislike my wifi card; but the recent madwifi packages do what they are supposed to do.

JFTR: now let's have a look at 2.6.24 on my desktop machine :)

Russell Coker: An Obstacle for Women in the IT Industry

I was reading the Lenovo blog “Inside The Box” post about the TrackPoint Ambassador [1] program. What happened was that a Lenovo sales guy (wearing a shirt with a Lenovo logo) spent a day in airports talking to people who use Thinkpads and telling them about Thinkpad features. He also gave away new button caps for the TrackPoint (the mouse device in the middle of a Thinkpad keyboard). One interesting thing he noted is the reaction of women who seemed to think he was trying to chat them up. Their reaction was so negative that by the end of the day he was only promoting Thinkpads to men. To make this clear, gifts of free hardware and advice on technical issues related to computers were provided only to men because the reaction of women was bad enough that it wasn’t worth the effort! I am certain that this is not an isolated incident. When I am at a conference I am unlikely to start a conversation with a woman who I don’t know because it really offends me when I receive the “I’ve got a boyfriend” type response. I expect that others have had similar experiences and react in a similar way. The Lenovo blog post proves that this is not just a free software community issue but a more widespread IT industry issue. As the majority of experts in the IT industry are male it seems that women will miss opportunities to learn because of this. Recently Waugh Partners [2] performed a survey of the Open Source industry, ZDnet article about the survey notes that “55 percent said they were part of a couple” [3]. Of the 45% who are single it seems reasonable to assume that some are gay and therefore the incidence of a random guy at a Linux event being interested in chatting up women would be less than 45% even if we don’t count the single straight guys who refrain from hitting on women at conferences. I’m not sure how the rest of the IT industry compares in this regard. While this is only a small part of the problem, it seems like something that needs to be improved and which appears not to have had much attention paid to it.

8 February 2008

Jeff Bailey: Osteopaths in the USA

In Montreal, I discovered the joy of visiting Osteopaths. An Osteopath managed to cure Leif's colic and let us sleep, and unlike a chiropractor, a treatment from Martine at Santenergie on the plateau of Montreal (shameless plug) would actually stay in effect for more than 20 minutes (Sometimes for weeks at a time).

Coming to the US, however, means learning a whole new variety of Osteo. Osteopathy was written into law early on, and has grown up as a full alternative to medical doctors - including the ability to prescribe medication. In practice what happens is that Osteopaths wind up in family practice as just another variant of MDs. The amount of "Osteopath" training that they've had compared to an MD turns out not to be that big anyway.

All hope isn't actually lost, though. There are two groups in the US, the American Academy of Osteopathy (Members recognised by the letters FAAO after their names), an the American Osteopathic Assocation (, AOA). Physicians can be fellowshipped into one or the other of these groups and they have different philosophies.

So there are three types of Osteopaths here:

1) Regular doctors (For all that it matters for the patients coming in)

2) Regular doctors who will practice some forms of Osteopathic Manipulative Medicine, but may not perform all techniques, and whom are more likely to be involved in "Integrative medicine" - helping find overall wholistic solutions to problems that might include manipulation, but might include other naturopathic solutions.

3) Osteopaths who specialise in manipulative medicine.

The downside to #3 is that these are people who've taken full medical degrees, and then had to further it with what an Osteopath would take at home. They're expensive, often don't accept any form of medical insurance, and are generally part of private practices.

With some back troubles I've been having recently, I managed to find a doctor in the #2 category who explained to me how this all works (followed by us figuring out that there's more to it than he can fix. But that's another story for later). He very kindly wrote it out for me on a napkin, so I'm copying it here before I blow my nose it in by accident. =)

Frans Pop: Crossing an apt proxy with a mirror

Earlier today I watched the presentation Jonathan Oxer's gave during LCA about Package caching solutions. Although it was certainly an interesting presentation and although I very much agree that my current local mirror is wasting a lot of diskspace and bandwidth, I'm still not going to switch from debmirror to any of the available caching solutions, because (unless I'm really missing something) none of them scratches my itch. My local mirror currently consists of five architectures (i386, amd64, hppa, sparc and s390) and only has unstable and testing. I use it for:
  1. (fast and convenient) updating of my systems
  2. doing Debian Installer builds and installation tests
  3. test builds of installation CDs (using debian-cd)
Now, the last one is somewhat hard (debian-cd uses hardlinks to packages on a local mirror instead of retrieving packages), so let's concentrate on the first two. Caching is great if you have a large number of machines – of the same architecture and that are all likely to need roughly the same packages – sitting behind the proxy: the first one triggers the download of the package and the rest gets it almost instantaneously. It is a lot less great if you have only one, maybe two systems per architecture: most of the time you'll still end up going down that (relatively) slow ADSL connection. An important reason why I have my mirror is so that when I do my daily updates for sid or run an installation test, the packages are already available locally. I really don't want to double or even treble the time needed for installation tests just because some required packages aren't yet available locally and need to be downloaded over that slow line. So, I have my partial mirror. Somewhat tuned (I exclude some ridiculously large debug packages for example, saving about 10GB), but still with a lot of junk^Wpackages on it I'll never ever use, especially for hppa, sparc and s390 as those systems only have fairly basic installations. Getting rid of that would significantly reduce my daily sync and allow me, for example, to also have a mirror of stable and oldstable, keep old versions of packages and probably still save a lot of diskspace. Wishlist What we should have is a hybrid solution: a program that will present itself as a proxy to clients, but is smart enough to pre-fetch new packages that are likely to be needed in a sync run, based on usage date from the the proxy and configuration settings. Some ideas for features/configuration options it could have: Possibly such an implementation could even be used on some of the lower tier Debian mirrors. Unfortunately, unlike some of my esteemed colleagues, I'm not able to just whip up something like this, so I'm condemned to wait and see if there's someone else who'd like to pick up this idea. I am of course more than willing to help develop this idea further and to test it. Now, if I've totally failed in my research and something like this already exists, a pointer in the right direction would be much appreciated.

Gunnar Wolf: cat STDERR rot13

Cannot help but laugh and share.
I've been triaging and trying to reproduce some oldish bugs on pkg-perl's packages. Some bugs are no longer there, some have to be forwarded upstream, and so on. Usual tasks, yes.
Until I stumbled with #406227. I just have to laugh and share! Hope nobody feels ashamed - The bug is the result of different people coding maybe under pressure and with quite different mindsets :)
For some reason I fail to understand, the submitter's test case (rot13 implemented over a HTTP proxy) is invoked in the report as ./rot13 2>/dev/null. Of course, when trying to debug a bug report, the first thing to do is not to ignore STDERR. So, off goes the 2>/dev/null. What happens next? 0 gwolf@mosca[2]/tmp$ perl ./rot13 &
[1] 4394
0 gwolf@mosca[3]/tmp$ GET -p http://localhost:8080/ http://www.debian.org/
Can't locate object method "filter" via package "UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)" (perhaps you forgot to load "UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)"?) at /usr/share/perl5/HTTP/Proxy/FilterStack.pm line 126.
500 EOF when chunk header expected
WTF... Well, at least the program name gives me a clue... Lets try to "decrypt" the error message... gwolf@mosca[4]/tmp$ echo 'UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160)' rot13
HTTP::Proxy::BodyFilter::simple=HASH(0x604160)
hrm... How comes the filter is filtering its own code and only then refusing to find itself!? Ok, time to open up the manpage - Remember, I'm only group-maintaining this pacakge, I am not yet at all familiar with it! Ok, so the core of the filter is when the submitter states: my $proxy = new HTTP::Proxy();
$proxy->push_filter(response => new HTTP::Proxy::BodyFilter::simple(sub tr/a-zA-z/n-za-mN-ZA-M/; ));
While the manpage states it should be invoked as: my $filter = HTTP::Proxy::BodyFilter::simple->new( sub $ $_[1] =~ s/foo/bar/g; );
$proxy->push_filter( response => $filter );
Of course, once looking at it, the answer is simple: The submitter left out which element to act on in the anonymous function body - The $ $_[1] =~ part. Adding it makes gur svygre jbex nf rkcrpgrq... Err, sorry - makes the filter work as expected. Now, bonus points: For the non-Perlers out ther: How come we get the namespace translated as well? Oh, that's very simple: In Perl, as in Python (and concievably other languages I'm unaware of), the object is passed to any of its methods as the first argument. Functions in Perl receive their arguments via @_ (read: the default array). And, of course, the tr (regex-based transliteration) takes by default the first thing it sees - the object itself. And what happens when you apply a (string-oriented) regex to an object? Of course, it gets stringified - which, by default, in Perl means converting it to the closest possible description: "a hash reference blessed as an object of the class such-and-such at this memory location". That string gets worked on, and we get UGGC::Cebkl::ObqlSvygre::fvzcyr=UNFU(0k604160). This proxy does not die on very-very-short web pages, where the whole content fits on one iteration of the code (although it does not work correctly - the text remains unaltered, of course, as it was not worked on), but if the request spans several chunks, the second time the filter is called, it will be... just gibberish. Oh, and what about the extra $ (...) around $_[1]? Oh, simple: The string is passed as a scalar reference, so it can be modified in place. Yes, it's the Perl way of pass-by-reference instead of pass-by-value (the default behaviour): Of course the parameter is only passed as a value. Only that the value is incidentally a reference - but who cares? ;-) Anyway... Many oddities. I would implement the module in a completely different way, and it looks quite backwardish in my book. But then again, TIMTOWTDI.

7 February 2008

Russell Coker: Political Blog Posts

Currently in the US the main political parties are deciding who will contest the next presidential election. Naturally this gets some commentary from all sides. Planet Debian has syndicated two blog posts commenting on these issues, it’s interesting to compare them: First John Goerzen writes a post about an issue he (and almost everyone in the Debian community) considers important - copyright law [1]. He quotes the Randall Munroe who is the author of www.xkcd.com (described by the author as “A webcomic of romance, sarcasm, math, and language“) which is wildly popular in the free software community (I believe that there is a fan-club which has meetings). Randall’s commentary is quite interesting and I recommend reading it [2]. The most noteworthy fact is that Barak Obama has sought advice from Lawrence Lessig - who has done more for the free software community than any other lawyer. John’s post doesn’t contain much original content, but citing a lengthy post from a highly regarded source and quoting a particularly relevant paragraph make it very noteworthy. Next Jaldhar Vyas writes about “the war against Islamic terrorism” [3] and makes the claim “we are finally gaining the upper hand in Iraq“. To consider that claim it’s best to read some expert commentary. William S. Lind [4] is a widely respected conservative who is an expert on military strategy, his comments about stabilising Iraq are always interesting [5]. It’s sufficient to note that William has been predicting failure for the US occupation of Iraq right from the start and that events over the last five years have proven him correct. William S. Lind’s thoughts on Democracy are interesting too [8], I don’t agree with him in this regard (I generally disagree with him on most things other than military matters) but it’s an interesting thought. Jaldhar also claims that “Democrats on the other hand have a closer association with the media who are behind many of the sillier IP laws“, this seems to be a reference the the “liberal media” conspiracy theories. There seems no clear party association with bad IP legislation (both the Democrats and Republicans do silly things in this regard), and debunking the liberal media claims can be done simply by watching some TV (choose a couple of random news shows on different channels). Fox is not the only right-wing news outlet. Jaldhar also has a conspiracy theory about the Supreme Court and the “need to ensure that the court does not veer leftward again as it will inevitably do during a Democratic administration“, not that the Democratic party is particularly “left” by whatever definition you might apply to the word. I prefer the www.politicalcompass.org analysis which shows that all the serious contenders in the Democratic primary are Authoritarian Right [6]. So the result of the next US presidential election will determine how authoritarian and right-wing the government will be, the fact that it will be authoritarian and right-wing is beyond doubt. That said it would be good if the authoritarian right-wing government that we (*) get at least has some decent policies in regard to IP law (which is the hope for Barak Obama). John Nichols has an interesting analysis of Ann Coulter’s support of Hillary Clinton over John McCain [7]. It would be interesting to see Jaldhar’s comments on this issue. (*) I use the term “we” when talking about US politics to acknowledge the fact that the Australian government will take orders from Washington. Some pundits predict that the Greens will be the second major party in Australian politics in a couple of elections time, so maybe in 8 years time we will have an Australian government that represents Australians instead of Americans. But for the entire duration in office of the next US president (be it 4 years or 8) they will be able to get the Australian government to do almost anything that they desire.

Martin F. Krafft: The Penny & Martin adventure: phase 1

The first phase of the Penny and Martin adventure has come to an end: after a few days of Wellington, we are now sitting on the ferry to Picton, beginning our week-long road trip of the South Island. Penny and Martin in full diving gear We spent the first three days getting our PADI Open Water diving certification. After the obligatory pool session, in which we practiced certain basic skills, such as taking off and replacing the mask underwater and breathing from the partner s (buddy s) backup regulator, we were ready for the open water. Four dives at Kau Bay later, during which we played with sea horses^W ponies, captured and ate scallops (well, the others captured them ), and were chased by vicious jellyfish, we can now go diving whenever and wherever we want, down to 18 metres and intend to do so a few times during the coming week. Later on Tuesday, I accepted the invitation by the folks at the New Zealand Sea Adventures dive shop, Mike and Seamus, and joined them for another dive in the evening, with conditions even worse than the previous four descents. Together with my buddy Jess, a volcano researcher from London, I experienced close to zero visibility at about 12 metres of depth rain and strong winds made the water really murky. I can easily understand how one might get disoriented and uneasy in the pitch black, but with Jess keeping an excellent bearing, it was all hunky dory for me, tagging on to her side and swimming along. Later that night, accompanied by two popping ears, Penny and I joined two of her close friends, Lisa and Chris, for an evening of games, and was introduced to the card game 500 , which is rather similar to the Bavarian game Schafkopf . It thus didn t take me long to get a grasp and win! Wednesday was Waitangi day, the anniversary of the equinomial treaty, and Wellington celebrated it with the One Love festival. Our plans for the day eating breakfast in the tree, frolic at the festival, and chill on the beach started to fall apart when we found aforementioned tree to be trimmed beyond recognition (at least in terms of function). A whining, hung-over Chris in the backseat and a traffic jam then made us skip the festival in favour of breakfast at the Recovery Room (great name!), and general absence of summery temperatures caused us to settle in Penny s back yard for beers and the last rays of sun instead. A Thai dinner later, we slept. (This post is dedicated to Daren, lover of and then reports.)

Martin F. Krafft: Leaving LCA

I am 10 000 metres above sea level, on my way from Melbourne to Wellington. I am looking back at a very enjoyable week of conferencing, with LCA 2008 ending yesterday, followed by today s Open Day. The purpose of this final day is to invite the general public to learn about open-source. Individual projects present their work at booths and field questions by bypassers. Jacinta Richardson and the other organisers and helpers of the Open Day have done an amazing job. The place was buzzing and the selection of projects broad and interesting, even to me. Two talks and a series of lightning talks, as well as catered food for everyone rounded it off. I will try to have this event in mind as we organise a similar event in Buenos Aires after the forthcoming DebConf8 in Argentina. I had a splendid time at the conference and probably can t thank Donna Benjamin and her army of mignons enough for organising it. Compared to the other open-source conferences I previously attended, this one was the most professional. Good job, everyone!!! Here are the highlights: Apart from the busy programme, I particularly enjoyed the hallway track , which is usually the reason why I attend these events. I really ought to practice remembering names and faces a bit better. I am not paying enough tribute to this week with this report, but I shall conclude it regardless. Unless something very unexpected comes up, I will attend next year s LCA in Tasmania. NP: Porcupine Tree: Futile

Alastair McKinstry: Oops. pyblosxom strikes again.

So, those on Planet Debian may have noticed, I've moved my blog into git, which went fine. And 'git-cloned' it on the laptop for editing, which worked. And then 'git-checkout' on the server. Which didn't. Bang. All the modified times were updated. The solution, it appears, it "metadate". Which I'm implementing ASAP. UPDATE: The code for the plugin is not at the URL pointed to in sourceforge, but google says its here. Tags , ,

Alastair McKinstry: Fun Filenames

Ok, some interesting output from a build script of a nameless code I'm working on:
...
scanning lib[10].a ...
scanning lib[11].a ...
scanning lib[12].a ...
scanning lib[13].a ...
scanning lib[14].a ...
scanning lib[15].a ...
pgf90 -Wl,--start-group ./master.o -L. -l[1] -l[2] -l[3] -l[4] -l[5] -l[6] -l[7] -l[8] -l[9] -l[10] -l[11] -l[12] -l[13] -l[14] -l[15] -Wl,--end-group -llapack -lblas
./lib[2].a(cprep1.o)(.text+0x181d): In function  cprep1':
...
Next time, think of someone trying to find these interesting files. People using regexps, ok ? What do these 'libraries' contain, anyway ? Tags , ,

Russell Coker: Linux Resource Controls

Using the “ulimit” controls over process resource use it is possible to limit RAM for processes and to limit the number of processes per UID. The problem is that this often is only good for accidental problems not dealing with malicious acts. For a multi-user machine each user needs to be allowed to have two processes to be able to do anything (IE the shell and a command that they execute). A more practical limit is five processes for a single shell session (one or two background jobs, a foreground job where one process pipes data to another, and the shell). But even five processes is rather small (a single Unix pipe can have more than that). A shell server probably needs a limit of 20 processes per user if each user will have the possibility of running multiple logins. For running the occasional memory intensive process such as GCC the per-process memory limit needs to be at least 20M, if the user was to compile big C++ programs then 100M may be needed (I’ve seen a G++ process use more than 90M of memory when compiling a KDE source file). This means that a single user who can launch 20 processes which can each use 20M of memory could use 400M of memory, if they have each process write to a pages in a random order then 400M of RAM would be essentially occupied by that user. If a shell server had 512M of RAM (which until quite recently was considered a lot of memory - the first multi-user Linux machine I ran on the net had 4M of RAM) then 400M of that could be consumed by a single hostile user. Leaving 100M for the real users might make the machine unusable. Note that the “hostile user” category also encompasses someone who gets fooled by the “here’s a cool program you should run” trick (which is common in universities). I put my first SE Linux Play Machine [1] on the net in the middle of 2002 and immediately faced problems with DOS attacks. I think that the machine had 128M of RAM and because the concept was new (and SE Linux itself was new and mysterious) many people wanted to login. Having 20 shell users logged in at one time was not uncommon, so a limit of 50 processes for users was minimal. Given that GCC was a necessary part of the service (users wanted to compile their own programs to test various aspects of SE Linux) the memory limit per process had to be high. The point of the Play Machine was to demonstrate that “root” was restricted by SE Linux such that even if all Unix access control methods failed then SE Linux would still control access (with the caveat that a kernel bug still makes you lose). So as all users logged into the same account (root) the process limit had to be adequate to handle all their needs, 50 processes was effectively the bare minimum. 50 processes with 5M of memory each is more than enough to cause a machine with 128M of RAM to swap to death. One thing to note is that root owned system processes count towards the ulimit for user processes as SE Linux does not have any resource usage controls. The aim of the SE Linux project is access control not protection against covert channels [2]. This makes it a little harder to restrict things as the number of processes run by daemons such as Postfix varies a little over time so the limits have to be a little higher to compensate, while Postfix is run with no limits the processes that it creates apply to the global limit when determining whether user processes can call fork(). So it was essentially impossible to implement any resource limits on my Play Machine that would prevent a DOS. I changed the MOTD (message of the day - displayed at login time) to inform people that a DOS attack is the wrong thing to do. I implemented some resource limits but didn’t seriously expect them to help much (the machine was DOSed daily). Recently I had a user of my Play Machine accidentally DOS it and ask whether I should install any resource limits. After considering the issue I realised that I can actually do so in a useful manner nowadays. My latest Play Machine is a Xen DomU which I have now assigned 300M of RAM, I have configured the limit for root processes to be 45, as the system and my login comprise about 30 processes that leaves 15 for unprivileged (user_r) logins. Of recent times my Play Machine hasn’t been getting a lot of interest, having two people logged in at the same time is unusual so 15 processes should be plenty. Each process is limited to 20M of memory so overflowing the 300M of RAM should take a moderate amount of effort. Recently I intentionally have not used swap space on that machine to save on noise when there’s a DOS attack (on the assumption that the DOS attack would succeed regardless of the amount of swap). Now that I have put resource limits in place I have installed 400M of swap space. A hostile user can easily prevent other unprivileged users from logging in by keeping enough long-running processes active - but they could achieve the same goal by having a program kill users shells as soon as they login (which a few people did in the early days). But it should not be trivial for them to prevent me from logging in via a simple memory or process DOS attack. Update: It was email discussion with Cam McKenzie that prompted this blog psot.

5 February 2008

Jaldhar Vyas: Let Me Show You My Hegemons

New Jersey is one of the states holding presidential primaries on this Super Tuesday and since you asked, I voted for John McCain. The chief reason for my vote is of course the war against Islamic terrorism. Now that we are finally gaining the upper hand in Iraq, we can't afford to elect someone who will fail to see victory through. Mind you this isn't necessarily a reason not to vote Democrat. The anti-war wing of that party has been thoroughly marginalized. Hillary atleast has a commendable reputation for viciousness. Even Obama has made some encouraging remarks (ok that was probably a red herring but I have the audacity to hope you see.) But while the Democrats do not take the anti-war crowd seriously, they do depend on them for a great deal of their funding. A Democratic president might feel the need to throw them some bones inadvertantly screwing up things in the process. On the Republican side, Huckabee might leave tactical planning to Jesus. Romney would toe the line but there is no sign that he has any original thoughts on the matter. While I continue to support the President, it must be admitted that this whole war is stretching out as long as it is because mistakes were made. We need options beyond "staying the course" and "cutting and running" and McCain a military hero and early supporter of the surge could be the one to find them. The other big issue is supreme court appointments. One, possibly two justices may need to be replaced in the next four years. We need to ensure that the court does not veer leftward again as it will inevitably do during a Democratic administration. Here there is a big split in the Conservative establishment. Ideologues consider McCain to be insufficiently pure and worry he will end up appointing another Souter or O'Connor (both appointed by Republicans it should be noted.) Pragmatists point out that McCain is viewed more favorably than Romney or Huckabee amongst the independent and moderate voters who will be crucial to victory and that even the slight chance of a bad choice is better than the certainty of a bad choice if Clinton or Obama get to make it. Social issues are important to many Republican voters and in this area too there is some grumbling about McCain being too liberal. Some have even suggested that if McCain beats Huckabee or Romney, a Democratic victory and four years out of power would be preferable in order to bring the GOP back to the straight and narrow. Although this contingent is loud I frankly don't think they have the influence people think (As evidenced by the actual performance of Huckabee or previous champion Fred Thompson.) When push comes to shove, they will rally behind the party candidate especially if McCain makes a bona fide social conservative (Huckabee himself?) his vice-president. On economic issues, the president's job is to not interfere and let business run itself. I don't see any of the Republican candidates being much different in this regard. Or the Democrats for that matter. [Careful readers will have noticed I have avoided mentioning Ron Paul. Paulestinians, consider this carte blanche to send me your long, rambling, incoherent screeds about how Dr. Paul has the answers to everything. Because God knows I haven't read enough of them lately.] Update: Kevin asks what I think about the candidates in terms of "geek" issues such as net neutrality, DMCA etc. IMO there is not a whole lot of difference between the major candidates on these issues. Republicans one would think would be more beholden to corporations in general. Democrats on the other hand have a closer association with the media who are behind many of the sillier IP laws. Overall, I don't think it ought to be much of a factor in choosing the president even for Free Software types. Rather we should focus on the legislative branch (in Congress as well as the states) which holds the real power here and in the court of public opinion.

Next.

Previous.