I have an imaginary automobile. It is the finest hybrid of German and Japanese engineering. It has a peppy little engine and a turning radius so small it would make a baby camel cry, and a six-speed manual transmission, and it is powered by the urine of vegan bears. My imaginary father asked me why I would possibly want to buy an imaginary car with a manual transmission. Obviously, whichever marketing campaign brainwashed him in the first place wasn't strong enough on the memetics, because after borrowing my imaginary car, he shut the hell up. You see, it's considerably more fun to drive than an automatic. There are other benefits as well, of course. The primary one is that the transmission does what I want. An automatic transmission is configured for maximum comfort , so it wastes a lot of power when shifting. With a manual, you can slip from gear to gear with minimal clutch time, or in some cases, if you're feeling sassy, without using the clutch at all. You can control your engine speed so that your shift will be just as smooth as an automatic without the egregiously long clutch disengagement or shift overlap. You also can see the road in front of you, so you're always going to be smarter than an automatic transmission, unless you don't understand how slopes work or what collisions with other cars mean to your well-being. Now some NRA member is going to point out that you can get a shift kit and tweak your automatic to be less awful. While spending money on this type of thing sounds like a great idea, a shift kit is not going to bring an automatic into the same league as my car. I can still start the car when the battery's dead. I can get higher fuel efficiency (vegan bears don't exactly urinate for free). I can shift into fifth gear, and coming from a full stop, drive up a hill without stalling (this is particularly useful when a squirrel has gnawed the teeth off of all your other gears). Furthermore, shift kit or not, an automatic is absolutely no fun. Someday, when transmissions have advanced into the realm of liquid hyperspace buckminsterfullerene cones that commune with the unicorns, and they'll have cameras and radar feeding the car's computer with useful information about its surroundings so it can make intelligent shift decisions faster than a human. Then I'll have to choose between saner and more fun. That era has not yet arrived. This is a lousy metaphor for debhelper.

Very often, folks want to refer to both the free and open source software communities in a way that is inclusive of and respectful of groups who identify with either term. Saying "free and open source software" is a mouthful. That said, there was no been consensus on what we should do instead. The Wikipedia article on alternative terms for free software suggests that FOSS, F/OSS, FLOSS, and "software libre" are contenders. I've heard all. Of course, the choice of 4+ competing alternative terms is probably worse than the problem we were seeking to solve. In academic circles, the big debate seems to be between FOSS and FLOSS. I was always a FOSS partisan. But I've seen increased momentum on the FLOSS side and I'm ready to declare that FLOSS has won. I know it makes you think of dental hygiene and I agree that it is unfortunate. It wasn't my first choice either. But I can see where things are going. FLOSS Manuals and the folks at the FLOSS Research Group at Syracuse who launched the FLOSSHub and the associated FLOSS Papers deserve some of the credit. If we can get over the irony of having spent so much time arguing over what was intended to be compromise terminology in the first place, lets see if we actually start talking to each other.

I've been using virtual machines (KVM, these days) as isolated environments to do things like build packages as root. Unfortunately, some of these activities require decent-sized chunks of random data (pulled from /dev/random). But /dev/random pulls from the kernel's entropy pool, which in turn is replenished from "hardware" events. But a virtual machine has no actual hardware, and if it is only doing isolated package builds, there is very little activity to feed the kernel's entropy pool. So the builds and test suites that rely on this randomness all hang for a long long time. :( My current way to get around this is to replace /dev/random with the /dev/urandom device, which does not block if the entropy pool is depleted:

mknod /dev/newrandom c 1 9
chmod --reference=/dev/random /dev/newrandom
mv -f /dev/newrandom /dev/random

This has the consequence that the "randomness" these commands use doesn't have as much "real" entropy, though some operating systems (like FreeBSD) have a non-blocking /dev/random by default (and it's also questionable what "real" entropy means for a virtual machine in the first place). I'm also using cowbuilder within these VMs to do package builds. But cowbuilder has its own /dev tree, with its own device nodes, so this needs to be fixed too. So after you have successfully done cowbuilder --create, you need to modify the random device within the cowbuilder chroot:

mknod /var/cache/pbuilder/base.cow/dev/newrandom c 1 9
chmod --reference=/var/cache/pbuilder/base.cow/dev/random /var/cache/pbuilder/base.cow/dev/newrandom
mv -f /var/cache/pbuilder/base.cow/dev/newrandom /var/cache/pbuilder/base.cow/dev/random

Hopefully this will be useful for other people using cowbuilder (or other build strategies) on isolated virtual machines. If you've worked around this problem in other ways (or if there's a security concern about this approach), i'd be happy to hear about the details.

There are few things I really hate. One of them is regressions. Regressions are bad because they usually take away things we are used to rely on, and leave us with the idea that perhaps the technical improvements didn t really improve our lifes as a user, despite putting less burden on the developers. Software is made for users, after all. As part of my work on WebKitGTK+, I always keep an eye on regressions, both from previous WebKitGTK+ releases, and those imposed on embedding applications on their migration away from Gecko, and try to focus some of my efforts into lowering their numbers, whenever I can. In recent times I have worked on removing a few very user-visible regressions in Epiphany, which I see as the most demanding WebKitGTK+ user in GNOME, such as save page not working, missing
favicon support, failing to
perform server-pushed downloads (such as GMail attachments), and not being able to view source. An example of a regression from a previous version of WebKit also exists: in 1.1.17 we started advertising more than we should as supported by the HTML5 media player, causing download to be almost completely broken. All of these are working if you are using WebKit and Epiphany from trunk/master, so should be on the next development versions of WebKitGTK+ and Epiphany. Other people have also fixed many other regressions; a few examples: Xan has reimplemented the Epiphany customization of the context menu, Frederic Peters provided a work-around for mailto: links while we don t have SoupURILoader yet, and Joanmarie Diggs keeps rocking on the accessibility front! If you find regressions, keep them coming! If you have a patch, even better! =) Next week WebKitGTK+ team gets together to work furiously on improving WebKitGTK+ in a hackfest sponsored by Collabora, and Igalia, and hosted/organized by Igalia. While there I should also get my hands on one of these. Can t wait! =)

GPE packaging (at least for my own packages in GPE) has been added to svn.debian.org (alternative browser front end - my preference) and available via svn://svn.debian.org/pkg-gpe/.

Some packages have been converted to dpkg source format 3.0, although only for purposes of using the upstream .orig.tar.bz2 directly without repacking and for the purposes of testing svn-buildpackage 0.7.1 support.

I guess I ve never been one to do things a certain way just because that s how they re normally done. I took my first college class pretty young, back in 1995, just after my freshman year in high school. By the time of my junior year in high school, I was well on my way through the computer science curriculum at Wichita State, and would probably have graduated from WSU at about age 20 had I not moved to Dallas, and then Indianapolis, for jobs. I did so because I (correctly) thought that in my line of work, experience was more important than a degree. However, playing into that was the incorrect notion that an education was useful primarily as a means to a career a notion that colleges and universities unfortunately have been promoting themselves. After moving back to Kansas, I started work to finish my degree I had effectively one year left had I been a full-time student. But it was difficult doing so, living almost an hour from Wichita, having a full-time job, and then when Jacob was on the way, I stopped classes entirely. Having online classes available to help me finish out the degree has been great. A year ago, I re-thought the value of education to me, concluding that there is a lot of value in education for its own sake. Looking at education as little more than a means to a career is the wrong way to approach it. Since I have had that re-evaluation, I ve adjusted my path even at this late point, and have enjoyed my classes more than I ever had before because of it. Graduating! So anyhow, here I am, graduating in a few days, 14 years after I started. I ve had some good news this semester, too: I ll pass the requirements to be a graduate of the WSU honors program, and also to graduate magna cum laude. So it may have taken me 14 years to do finish college, but at least I ve done it well . It feels weird to be about to be done with college, after so many years of being almost done, except for And a question I ve been thinking about a lot is: What next? Obviously I ll start by taking a break from college stuff. I want to be able to spend more time with Terah, Oliver, and Jacob, and there are things around the house that need attention. But after that? I figure I have a few options: No more college, but some reading. I do enjoy reading, and especially reading older works that are nicely out of copyright and thus free. I ve read few of the classics, but I enjoy reading them, and want to be better informed about them too. That could be fun. But sometimes it s hard to know how to place things in context. For instance, I don t think I could have gotten as much out of reading some famous philosophers as I did by doing so in a class that put them all in context and discussed criticisms of different positions. I also wouldn t necessarily have the ability to discuss and debate ideas with my classmates. Take the occasional undergraduate class in a topic that interests me. I m especially interested in history and literature, and haven t had much exposure at the college level in either. Various online courses are available from universities in Kansas on those topics. I could take a course or two each year and become a better-informed, more well-rounded person, and study an interesting topic at the same time. Maybe this would eventually lead to a degree, and maybe not. It would be fine either way. Graduate studies. It s a lot of work, and I m not sure it would be all that interesting to me. I ve looked some at curricula. I don t think that I m interested in computer science as a graduate program; I enjoy coding more than theorizing and analysis. But I also don t think that a graduate MIS or some such degree is for me; most of them appear to either focus on Windows or cover things that I ve already known how to do for years, and thus I wonder just what the point of them is (in addition to questioning how rigorous the curriculum is). I could also, down the road, pursue a graduate degree in something like English, philosophy, or history, but it seems a natural path to that would be to take more undergraduate classes in those topics first. So for now, I ll sit tight. I ll see how I feel by summer, how pressed for time I feel at home, and if I still feel the desire to take more classes. If so, I suspect I ll try to take some undergraduate classes in whatever sounds interesting to me at the time. In a way, that is quite freeing take a class on whatever topic I like, without a defined degree in mind. I ve never been free to do that before, and I like the idea of it.

My nook arrived today, along with an email asking for my shipping address in order to be sent a CD with the source on. So that's progress. The nook itself is an interesting device - it comes in impressively well produced packaging, which looks easily as attractive as any Apple product I've laid hands on lately. Except that it then includes a double-sided sheet of instructions in the outer packaging to tell you how to get the damn thing out.

And so far, that seems like a pretty good summary of the device. There's a huge quantity of form here, but the function is lacking. The initial registration was made infuriating by the lag between hitting a key on the keyboard[1] and anything happening. I'm not talking about the understandable lag due to the latency of updates on e-ink screens - I'm talking about the seemingly non-deterministic time between tapping the screen and it indicating that I've pressed a key. The coverflow feature for books is better than selecting from a menu of items (e-ink lends itself badly to interactive displays), but slow and jerky. Worse, it's limited to B&N content. Anything you obtain elsewhere and then copy onto the device (which presents as USB mass storage) ends up in a separate menu without any coverflow. And, even more infuriatingly, you can't catagorise the files you copy on there. It's just one big list, sorted alphabetically by author (surname) and then title.

Once you're in a book, things aren't bad. It reformats the text every time you enter a book (no caching), but that takes much less time than my Sony did. The default font is very readable, even at small sizes. But there's clearly something horribly wrong - various epub files I have take up to 4 seconds to perform a page turn, which is way longer than the second or so my Sony took. There's no way to skip to a given page number, which seems like an insane oversight. And, though it's a minor point, the next/previous page buttons are the opposite way around to the Kindle or Sonys, and it's taking a while to get used to that.

It's a promising device. The hardware's clearly capable and the software is mostly there, with the features I'm really missing being ones that shouldn't be hard to implement[2]. But those features are pretty glaring, and right now they make this less functional than the Sony, let alone the Kindle. I'm also kind of surprised that it doesn't ship with any kind of cover at all. There's ample opportunity for physical trauma to turn one of these into a paperweight.

Side note: My nook managed to include the QA checklist slip, presumably by accident. The nook's internal manufacturing designation appears to be "X2", and mine was built on 2009/11/25. Which would seem optimistic for an intended shipping date in the US of 2009/11/30, which does support the idea that the shipping delay was due to some kind of delay in the hardware production.

[1] Presented on the LCD panel
[2] Of course, this being closed-source, I can't do so myself. Sigh.

Over Thanksgiving this year, we took a train trip to visit Terah s family in Indiana. Here s the story of the trip. The Train to Indiana Our last train trip (to Chicago) was in May, before Oliver was born. Jacob always has enjoyed the train, but this time wow. We told Jacob about the trip the day before we were to leave. Several times in the day, he d get a sly smile, and ask, What are we going to do? Terah or I would spell out the day s activities, and when we d get close to the part where I d wake him up at night and we d go to the train station, he d have a big smile. The big hour (2AM) arrived and Jacob woke up while Terah was putting his shoes on. I was there a moment later. Normally Jacob is terribly grumpy after waking up, even more so if somebody else woke him up. That day, I saw a very groggy-looking boy. I asked him, Jacob, are you ready to go to the train station? He answered, YEAH! while rubbing his eyes. Dad, let s go! We had Amtrak s family bedroom for the first time this trip, and it worked out great. Jacob actually slept, despite his extreme excitement. He d been talking about eating in the diner car for quite some time, and was really excited when breakfast time rolled around. We sat down, and he pressed his nose up against the window right away. He counted the freight trains the he saw, pointed out train tracks and crossing guard lights , noticed barns and trucks, and gave us frequent updates on how fast we were going. His voice was high-pitched from excitement, and sometimes we d have a running commentary we could barely interrupt, and other times he d sit there silently just soaking it all in. But he didn t eat. He didn t want to turn his head away from the window for a second to take a bite. I kept reminding him to take a bite, and finally, fearing he d be really hungry as soon as we went back to our room, fed him a few bites for the first time in ages. I don t believe he realized that happened. He just opened his mouth by reflex and once I had to tell him to close his mouth around the fork that was in it. It was much the same story for lunch, and for dinner on the train though less so for dinner since it was dark outside. At dinner, a man sitting across the aisle from us said, If you weren t getting your meal free [since we're in the sleeper], I d buy it for you. Your boys are amazingly well-behaved! I thanked him politely Jacob and Oliver both were doing well but didn t really think it was that unusual. Oliver and Jacob were both big hits on the train. They got smiles from so many people on board and in the stations. Several of the dining car staff seemed to linger at our table longer than elsewhere, looking at them (and especially Oliver). Oliver slept well on the train: And here are a couple of typical Jacob photos: In Indiana I ve got to start this out with one of the family gatherings at Terah s aunt s house. They have a large kids area in their basement, and a swingset with a slide outside. Jacob loved all of this, and spent hours playing with me. Sometimes if I d go upstairs with the adults, I d hear Jacob s voice from the basement a few minutes later: DAAAAAD!!!! Shall you come back downstairs? DAAAD! And, of course, it s hard to resist a 3-year-old that wants to play with me, so I inevitably would. We played air hockey Jacob shrieked with delight whenever anybody scored a goal in any way. At one point, he stood up, looked around, and said, Hmmm. Where are all the trains? Apparently he expected every home to be stocked with toy trains, and this one wasn t. A few seconds later, he was all excited. He ran over to a toy semi, and said, I will use the semi train! Outside the short slide had a ladder going up to it. I held Jacob s hands while he climbed up the first few times, but I knew he could do it himself. I started helping him less and less, and eventually refused to help him at all. He was rather frustrated with that for a moment, but a couple times later, climbed up and said, Dad, I got up here all by myself! A few times later, it looked like he was having trouble, so I tried to help, and got shooed away with, No, dad! I can do it. The best moment of the weekend came during the drive back to Terah s mom s house where we were staying. Terah was driving, and I heard Jacob say, Shall you come closer? Not sure how to do that from the front seat of the car, I reached my hand back there and he held it. He held one or the other of my hands for 20 minutes until he fell asleep in the car. It s funny what feeling needed by a 3-year-old makes a person feel, but that was surely a happy day. Jacob got to see all of his Indiana grandparents on this trip, and loved playing with them. He especially liked using a perfect red train (his words!) he drug home from the nursery at church on Sunday, and a child-sized tent in the basement. I m not sure how many times I heard Gampa Mike! Shall we go to the basement? that weekend. One point he wanted me to come down to see it and play with him, so I did. Then he decided we all needed to be down there, and told me I ll go pick up mom. I ll be right back. Stay downstairs, dad. Fearing that Terah wouldn t know what to do when Jacob attempted to pick her up , I tried to discreetly follow at a distance. That was no match for a 3-year-old. He looked back at me from the top of the stairs, pointed an accusing finger at me, lowered his voice, and said, Dad. Stay. Terah and I spent a day in South Bend and stayed at the Oliver Inn while Jacob and Oliver got some time to themselves with their grandparents. We had dinner at the beautiful Tippecanoe Place, just next door. The Trip Home We had a few hours in downtown Chicago on our way home. We went and ate at a small Indian restaurant. Jacob kept alternating between three things: This food is very spicy! I like spicy food. I need another drink! A little while later, Terah decided we should have some dessert. So she and Oliver stayed in the waiting area while Jacob and I went asporing (exploring) to find something. We walked a block or two to the nearest Dunkin Donuts, then to a Starbucks, and then back. Jacob carried the sack of donuts, guarding them so carefully that I was afraid he might smash them. (They were cream-filled so that wouldn t have been good.) He had a lot of fun exploring Chicago Union Station, and also enjoyed walking in Chicago (though not quite as much; it was all a little too loud for him.) In the train station, he loved the escalators. Up and down we went, whenever we wouldn t get in people s way. I had to eventually drag him away from them as I was getting a little self-conscious at all the people standing around watching us repeatedly go up and down the escalators. Jacob has found a 3-year-old way to express his feelings: he ll pretend to be a kitty, and say the kitty is sad or something like it. All day he had been saying the kitty is hungry. He hadn t had a big breakfast, but he had plenty of opportunity to eat at lunch, and a snack. We were a bit confused, but I think we finally figured it out on the train back to Kansas. We didn t have time to eat breakfast in the diner on the train from South Bend to Chicago, so Jacob missed out on the dining car then, and I think he was disappointed or confused about that. Once we had dinner in the dining car, he was happier. Since we ve been back home, he s been talking about our next train trip. He says which suitcases we ll take, that we ll eat in the diner, that it will be a night train we take, and generally is still very excited about it. It was a fun trip.

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

So a few years ago I got stuck with no health insurance as I had a fellowship that had for its history accepted professors (with health insurance) not fresh off the boat PhDs as was the case with me. Since I was at a Large State school it was nearly impossible for me to get insurance and finally I ended up paying 400 a month and getting a whole lot of headache. In many ways my ordeal was a fluke following a change of policy and this fellowship now provides insurance to its postdocs. Increasingly, however, it seems like a number of postdoctoral fellowships shirk from their duties and don t provide a drop of health insurance. Given the academic job market, many academics don t have any choice but to accept these positions and if they don t come with insurance, well then these folks are shelling out thousands upon thousands of dollars for basic, really lousy, coverage. Given that universities for the most part have decent, even in some cases kick ass insurance, with a large pool of people, shutting postdocs out of their pool is.. gross and just plain wrong. One of my fellow friends, currently on the market and currently screwed by her last postdoc wrote up a short document (aka Academic Labor Hall of Shame) and I thought I would post it here as it gets to the heart of the issues and starts shaming some of these shameful universities. If you know of other postdoctoral positions that don t offer insurance, please please leave a comment. We will include it in the hall of shame. Academic Labor Hall of Shame Universities like to promote themselves as bastions of enlightenment, but their treatment of temporary and hidden employees is often anything but enlightened. Or progressive. Or fair. 1. Postdoctoral fellows and researchers: There is a growing trend towards classing postdocs as not employees . I learned this recently when I was laid off from postdoctoral position at the University of Pennsylvania. I planned to extend my health insurance through COBRA, which is currently federally subsidized for workers who lost their jobs during the financial crisis. I was shocked when Penn initially claimed that I was not eligible for the subsidy (made available through the American Recovery and Reinvestment Act of 2009, the so-called stimulus act ). Their reason was that postdocs were not classed by Penn as employees. I appealed this with the Office of General Counsel and after a few weeks was told that I was indeed eligible, as Penn had found an inconsistency in [their] policy for certain categories of post docs between tax treatment and the availability of COBRA/ARRA . This means that while I am in fact eligible for this subsidy, postdocs paid through many other classes of grants are still not. If you want to see an example of this process of sorting some postdocs into not employee status, here is another one:
Postdocs on training grants or on individual fellowships (roughly 25% of VUMC postdocs) receive a stipend and are specifically excluded from the employee classification. They do not pay FICA and do not receive employee benefits. Their health insurance is provided and purchased separately. [by whom?] Even if Vanderbilt does in this case make provisions for these postdocs to receive health insurance, there is abundant evidence that some postdocs are outright excluded, as in this example at Stanford:
Stanford makes no provision for fellows to purchase health insurance, and the Institute will not provide medical insurance or other benefits. External fellows must bring their own medical coverage with them or purchase an individual plan during their stay in California. This is also quite apparent when you look into the outfits that profit from selling health insurance to postdocs (because their universities don t provide them any):
http://www.garnett-powers.com/npa/ Also, take a look at the policy they and you ll note that it stinks: it excludes such luxuries as preventive care, birth control, and chemotherapy. I m not making this up:
http://www.garnett-powers.com/npa/summary.pdf

Cross-posted to asheesh.org from the OpenHatch blog. (OpenHatch is my current project.)

"How do I get involved in free and open source software?"

"How do I encourage people to join my project?"

Gregory Wilson, a CS professor at UToronto, cites some recent successes at answering these questions with respect to students: "Google Summer of Code and UCOSP have both shown that it's easier for students to get into open source projects if there s a pile of tiny tickets for them to start with." We believe that these "bite-size" bug lists can benefit all sorts of new contributors, student or not. What you might not know is that more than a hundred projects have these small tasks tagged and waiting for you in their bug trackers.

To make it easier to find these, the OpenHatch volunteer opportunity finder allows you to browse, in one place, nearly 1000 bite-size bugs.

Do you know another project with bite-size opportunities we should index? You can get your project involved. Check out the list of bug trackers we index. If you contribute to a project, go to your bug tracker right now and label a few as bite-size. Then add your bug tracker to our index.

I want to especially thank GNOME for the ongoing GNOME Love effort that is our inspiration and the source of hundreds of these bite-size opportunities.

Happy hacking!

If this sort of thing is interesting to you, take a look at OpenHatch and subscribe to our blog or @openhatchery on Identi.ca or Twitter.

Guess what happens when you use software that can fuck up your keyboard mappings (VMware Remote Console), in combination with software that uses these mappings to be able to switch back to a text console (X.org) and a screen saver that locks your screen (gnome-screensaver, but that would worl equally well with xlock or anything else similar) ? A recipe for FAIL. It so happens that VMware Remote Console, and apparently other VMware products such as Player or Workstation not only are unable to do anything useful with special keys (try installing Debian without the arrows keys, for example), but they are also able to remap keys (such as ctrl, shift and caps lock) to nothing. It also happens that X.org uses its keyboard mappings when dealing with the ctrl+alt+Fn key combinations that allow to get back to a text console. Yes, that means you can t switch to a text console after VMware fucked up your keyboard mappings. On top of all that, add a X session locking program, that won t allow you back until you type your password, and a password that, well, you just can t type without shift of caps-lock, because it is somehow strong. The X session locking program won t allow you to fix your keyboard mappings, you can t switch to a text console either, and you can t unlock for obvious reasons. The only solution that didn t involve a reboot or losing everything under the X session was to ssh in, change the password to one that can be typed without shift and unlock. It is said on the interwebs that adding xkeymap.nokeycodeMap = true in the ~/.vmware/config file solves the issue. At least, it works for the arrows. I ll see if it also prevents the special keys to be remapped.

Just some quick superficial observations on the Debian/Ubuntu package distributed by Google:

• Most files are installed in /opt/google/.
• It attempts to patch /usr/share/gnome-control-center/gnome-default-applications.xml on postinst (maybe legacy compatibility? Someone with more gnome-fu than me care to explain?).
• The postinst also automatically adds a souce for updates to /etc/apt/sources.list.d and an archive key (this is IMHO the worst part)
• It includes a daily cronjob that at least at first glance tries to do the same things the postinst did (new apt source, archive key, etc) and some further archive configuration. The cron script is called at the end of postinst.
• A casual look at objdump suggests it s statically linked to libv8
• On a slightly more positive note, it at least seems to successfully undo most of the changes once removed, with the exception of the added archive key and the above mentioned patch to gnome s default apps list (that is: if there s any situation it actually gets applied).

I understand it might be too much hassle doing it the right way (from the corporate POV), but then why not simply cooperate a bit more with the community? Hopefully they ll accept some criticism and suggestions.
Or even better: they could simply reuse all the work being done to officially package Chromium.

Transforming data is hard. When I joined my current company, there were stupendous amounts of Perl/PHP/Bash/<insert random programming language here> scripts that would run on a cron job and do magic things to our data. They d create reports, they d tell the purchasers when we were running out of stock, they d synchronise data between our Frontend and backend databases, they d collect, they d collate, they d do everything and anything. Except, with all these scripts, in all these random languages, written by a multitude of previous developers (at different skill levels), they weren t particularly maintainable (and sometimes, they weren t particularly readable or understandable either imagine a 6000 line perl script that pretty much ran different permutations of the same data over and over again) Enter Pentaho, and specifically it s Kettle project. (since renamed Pentaho Data Integration ), a tool that lets you manipulate your data in pretty much any way you can imagine, in the simplest and easiest way imaginable.

That s right, it s a GUI for data manipulation.

I know a lot of you are probably sceptical right now. The first time I ever saw this was when a previous boss of mine put it forward as a potential solution for one of our problems (getting our orders from the front end database down to the office/warehouse). I saw it, and I thought GUI? Nah, that s not how real programmers do things! , so after the development team put forward another proposal to solve this, and it got accepted, I thought I d never see the thing again.

That was until my current boss started playing with it, trying to work out what it was doing so that he could get these evil GUI based scripts into something manageable, like nice, pretty code. Thing s, when my boss plays with things that he doesn t know about, he tends to read up, research, and, 9 times out of 10, change his mind.

We wiped the previous server (it was rather noisy! We re glad it s no longer switched on!) and set up a new server to house our BI platform . Starting off with a few scripts, my boss learnt to love this tool, and then, as I m his 2nd in command (aka general lackey) started making me learn how to use it.

Again, I was sceptical, I didn t want to learn, and I put up resistance, but my boss was going away for nearly a month, and by this time, a few of our key business processes relied on Kettle, so, grudgingly, I sat down, and started to learn.

You may be wondering now, why I started off this story talking about all those magical and wonderful scripts that no one seemed to know the inner workings of. These scripts, as I ve already mentioned were unwieldy, and at times, god-damned awful. The plan was to move them to the BI system (as my boss had been doing already).

I like to think of Kettle as a bridge between the process-flow diagram, and the code. I started converting these scripts, and I was astonished by the fact that most of the conversions I was doing was converting a long perl script into 3 or 4 Integration steps

I m totally besotted with this program now. Any time I have to do data manipulation, I turn to it. I can t describe how (once you ve got used to it s quirks) easy it is to use, how simple it is, and how much it just makes sense. Best of all, most of those evil scripts are gone now, and replaced with pretty diagrams that do the work for you.

If you have to play with large data sets on a regular basis, I urge you to try it out. You can buy me a beer for reccommending it next time you see me at $conference.

Dear life,

It has been a pretty crazy couple of months, had to stay away from most of the things that I would normally breeze through, including but not limited to a few aspects of my real life day job, Debian work, movies, the routine yearly Oct-Nov time vacation that I take etc. Obviously, hobbies took a big hit. Also had to let go of an opportunity to travel to one of my favorite places, IIT Guwahati; something that I don't usually pass up. Sigh! But such is life.

Been bouncing back slowly:

I finally moved a few domains that I run (including my personal domain) and their email to a linode and I am quite liking it so far (I would've been great if I had some more disk space at my disposal but 16GB isn't all that bad).

On the Debian front, finished attending to package sponsorship requests, I've been updating packages (there is one elinks RC bug that I'll fix next) and work is finally under progress for the clang ITP in the Debian GIT repository.

There are a ton of pictures in RAW format that I haven't yet had the time to convert to JPEG (I use UFRaw but the output that I got from Bibble Pro is fairly impressive -- perhaps I should consider getting myself a license) but that could wait.

Found a decent place to rent (I should be moving in about a month or so). I would've liked a place that isn't an apartment or at least in a smaller community, preferably something in-town but good places are difficult to come by.

I am back,

Giridhar

Lately I have been thinking about methods to provide a stripped down, secured environment for running untrusted code on GNU/Linux. With this post I would like to present you with the first results of my research.

ujail - brief introduction

I have chosen ujail as the name for the technique I am proposing. ujail stands for micro jail in userspace and, in itself, describes the concept briefly. The main idea is to have a userspace process monitor system calls of one of its childs and emulate some calls, if needed. This is done using ptrace and namely both PTRACE_SYSEMU and PTRACE_SYSCALL.
The ujail process should not be able to monitor syscalls, like strace does, but also intercept and emulate them.

This sounds a lot like user mode linux (uml), but the method is different. Whilst uml comes with a complete kernel, emulates all system calls and this way provides a virtualized system, ujail is intended to only emulate some systemcalls, without emulating the kernel.

Revisiting PTRACE_SYSCALL & PTRACE_SYSEMU

To better explain how the ujail technique works I would like to have a quick look at PTRACE_SYSCALL and PTRACE_SYSEMU again.

PTRACE_SYSCALL allows a userspace process to be notified whenever a traced process enters or leaves a system call. This means that two notifications are normally sent: one before system call entry and one afterwards. Even though one is able to change the parameters of system calls this method does not allow system calls to be fully emulated (think virtual filesystem here).

PTRACE_SYSEMU on the other hand provides one notification on syscall entry and expects the receiver of the notification to emulate the syscall. This method alone sounds great, but this also means that memory allocation needs to be emulated too, which is quite complex in userspace.

A hybrid of PTRACE_SYSCALL & PTRACE_SYSEMU

Now on to the concept behind ujail. The method I am describing works by calling PTRACE_SYSEMU for a specific process and this way taking over emulation of all system calls. However, some system calls are complex to emulate in userspace, and so a hybrid of both PTRACE_SYSEMU and PTRACE_SYSCALL is needed. In short this works by checking whether the syscall needs to be emulated when the PTRACE_SYSEMU event is received.
Now one way is emulating the syscall, filling the processes' registers and resuming execution of the process. This is simple and straight-forward.

The second way is forwarding the system call to the kernel. The problem here is that calling the syscall in the monitoring process will make the new resources available to that very process, and not the process to be jailed. This is where the hybrid method kicks in.

The proof of concept code creates a backup of the next instruction to be executed along with a copy of the instruction pointer at this point and patches it with the opcodes for "int $0x80", causing the syscall to be made again. After that it resumes execution with PTRACE_SYSCALL and waits again. The first event to be received now is the program leaving the emulated system call, which can be ignored. Resuming yet again will give use two PTRACE_SYSCALL events, one for syscall entry and one for syscall exit.

The first event is not really interesting, but at the second event the opcode backup is restored and the eip set from the saved value. Now the kernel has handled the syscall and the result is ready for the child process. A final call of PTRACE_SYSEMU resumes execution of the child and waits for the next syscall.

Proof of concept

The proof of concept code can be downloaded from its bazaar branch at launchpad.net. It is intended to be used on i386 systems only and works with simple programs, but is known not to work with anything using fork, vfork and most likely will not work for binaries using threading.

Finally, I would like to thank Pradeep Padala for his "Playing with ptrace" articles [0][1], which were fun to read and worked as a great introduction of ptrace for me.

Now there is only one thing left to say: if you are interested in this method, see loopholes or problems or want to contribute, please go ahead and contact me:

debian at sp dot or dot at

Though I haven t used (and won t use) Ubuntu, it has a few things I appreciate (as far as I know them): Ubuntu One: I wish we could have something similar for Debian users (ideally, it should be extended so that we could sync our calendars, contacts, liferea data etc.). usb-creator: seems the easiest way to create a bootable usb stick containing a complete and customisable environment. I am aware of the existence Debian Live, but I must say I haven t given it a try yet. Desktop orientation: Ubuntu users are in a large majority desktop users. Ubuntu is imho desktop-oriented, and I particularly like the artwork coherence (from boot loader to default desktop).

Some uploads this week:

• There s a 2.49.2~dfsg-1 package for Blender sitting in unstable. Despite its version string, it s actually 2.49b (release logs). Looks like there s a good reason for ~dfsg vs. +dfsg.
• There s a pending package for Blender 2.5 alpha 0, but some things still need ironing out. As stated in #558083, it ll probably go to experimental first, given its dependency on Python 3.1.
• Speaking of which, some dozens of X.Org drivers (xserver-xorg-input-* and xserver-xorg-video-*) were meant to be uploaded to experimental last night, but due to sbuild s #559659 and lintian s #542747, they ended up in unstable instead. If you see packages with a Depends: on X.Org stuff from experimental, that s normal, wait until xorg-server 1.7 moves to unstable, go and fix some bugs instead of reaching for reportbug.

RCBW - week #13 Here are this week squashes, by yours truly:

• 30/11/2009 bug #499516 - drbd8-utils - avoid stop HA cluster during upgrades (sponsor upload by Iustin Pop)
• 01/12/2009 bug #530673 - xsmbrowser - avoid passing -N/-U together (patch by Michael Bode)
• 02/12/2009 bug #510567 - libgpgme11 - enable support for gpgconf (patch by Sven Eckelmann)
• 03/12/2009 bug #553162 - icomlib - add missing $ shlibs:Depends (bonus points: fix kfreebsd build)
• 04/12/2009 bug #553223 - ldapdns - add missing $ shlibs:Depends (malus points: fought with Yada)
• 05/12/2009 bug #553250 - posixlock - add missing $ shlibs/misc:Depends
• 06/12/2009 bug #552769 - leptonlib - remove /usr/bin/ subdir

And here are the usual highlights:

• Luk's list has worked worse than last week, since last weekend BSPs have stolen "my" bugs!
• in fact, a lot of people is stealing my bugs (i.e., bugs that I had put on my watch list): hello azeem, gregoa, frankie, ...
  That's very good, I now have the feeling that NMU enthusiasm is growing
• having to deal with Yada for ldapdns has been, errr, an experience
• Debian News mentioned RCBW, I'm flattered!
  (BTW, anyone knows why Debian News is not on -planet? I'm subscribed to it cause it is very useful, but it seems pointless not to have it on Planet, given how many other less-Debian-related-posts we have there ...)