Search Results: "ema"

2 April 2008

Wouter Verhelst: nbd 2.9.10

I Just released NBD 2.9.10. It had been upcoming for a while already, with a few interesting patches being applied. In addition, some bugfixes were applied to subversion, and some more interesting things had happened. Really, a release was getting overdue. Sometimes life just intervenes. Anyway, apart from the upstream release, I of course also did a Debian update of these packages, which also contains some changes that had been pending for a while. Combined, the changelog mentions five different bugs of which none are l10n bugs, which is a record (there had been 5-bug uploads before, but those did include l10n bugs). On top of that, I closed some other outstanding bugs which really had been closed a while back, but either I forgot to close the bug, or I forgot that there even was a bug in the first place. I should stop slacking so much. While preparing this upload, it occurred to me that nbd has come a long way since I got involved with it back in 2001. The original nbd-server that Pavel Macheck had written did work well, but it was a bit of a hack; it did not fork() upon startup or anything similar, so starting it was a pain. It could only serve one device at a time. It was not documented. It had no concept of a configuration file. The code, frankly, was also bit of a mess; it was written on a hack night, and not much design had gone into it. I guess it was no surprise, then, that no single distribution had a package for nbd at the time. I only packaged it because I actually had some use for nbd; at the time, I'd just bought quickstep, my first functional m68k machine, and had installed Debian on its 250MB hard disk. However, running a buildd on that machine proved problematic, to say the least; with so little disk space, you could hardly boot Debian, and due to speed and clock skew issues, NFS was not an option. So I went with NBD, which worked great. After a while, quickstep got a bigger hard disk (it has an 18G disk today), so diskspace was less of an issue at that point; but, well, I'd been maintaining it already, and that was fun, so I didn't think of giving up. When Pavel lost interest in nbd back in 2003, he gave maintenance of the kernel bits to Paul Clements, and maintenance of the userspace bits to me. I promptly went ahead with what I thought should have been done already, but felt reluctant to do at the time to suggest that: refactoring the code, adding features, etc. Today, nbd-server does support all of the above things of which I mentioned it was lacking; and, probably as a result of that, apart from Debian, there are now packages of nbd in, at least, SuSE, Fedora, Gentoo, uClibc, and FreeBSD (the latter obviously only containing the server). Well—the fact that LTSP uses it might have something to do with it, too ;-) That's not to say there's nothing left to be done, but I'm quite happy about how far we've come. Really.

Miriam Ruiz: ISO/IEC DIS 29500 (OOXML) is now an International Standard

Today is a sad day. Corruption has won over rationality. ISO sucks. I guess I lost all the trust I had on the standards organizations. OOXML is a standard covered by many patents, ambiguous enough for Microsoft to keep the real specs closed, far worse than the previous ISO standard for the same task (ODF), and approved in a very suspicious way, in a process full of irregularities, which I hope the European Union will investigate.

Francois Marier: Handling multiple identities/accounts in mutt

Since mutt seems to be all the rage these days at work, I might as well document here a few things about my .muttrc that might be useful to others.

(I recommend that you start off with the Debian or Ubuntu package for mutt since a large chunk of necessary customization work has already been done by the Debian maintainers.)

Here is how I handle two user accounts. Let's start off by listing both of these addresses so that mutt can recognize emails using these as being sent by me:
alternates "(fmarier@gmail\.com) (francois@debian\.org)"
Now this is to allow me to change the From address within the editor, in case I forgot to set the right one before pressing 'm':
set use_from
Here are the two settings that I'm going to change when switching to a different identity (from address and status bar display).
# default profile
set from="fmarier@gmail.com"
set status_format="-%r-fmarier@gmail.com: %f [Msgs:%?M?%M/?%m%?n? New:%n?%?o? Old:%o?%?d? Del:%d?%?F? Flag:%F?%?t? Tag:%t?%?p? Post:%p?%?b? Inc:%b?%?l? %l?]---(%s/%S)-%>-(%P)---"
Here are the macros I use to switch from one account to the next (bound to ESC-1 and ESC-2):
macro index \e1 ":set from=fmarier@gmail.com\n:set status_format=\"-%r-fmarier@gmail.com: %f [Msgs:%?M?%M/?%m%?n? New:%n?%?o? Old:%o?%?d? Del:%d?%?F? Flag:%F?%?t? Tag:%t?%?p? Post:%p?%?b? Inc:%b?%?l? %l?]---(%s/%S)-%>-(%P)---\"\n" "Switch to fmarier@gmail.com"
macro index \e2 ":set from=francois@debian.org\n:set status_format=\"-%r-francois@debian.org: %f [Msgs:%?M?%M/?%m%?n? New:%n?%?o? Old:%o?%?d? Del:%d?%?F? Flag:%F?%?t? Tag:%t?%?p? Post:%p?%?b? Inc:%b?%?l? %l?]---(%s/%S)-%>-(%P)---\"\n" "Switch to francois@debian.org"
And this is the code that uses these macros to switch to the right identity automatically:
folder-hook =inbox 'push \e1oi'
folder-hook =debian-inbox 'push \e2oi'
(The 'oi' part at the end is there to restore the default sort order.)

Finally, I've got this convenient shortcut which allows me to switch to my inbox quickly and to go from one inbox to the next:
macro index I "c=inbox\n" "Switch to inbox"
folder-hook =inbox 'macro index I "c=debian-inbox\n" "Switch to debian-inbox"'
folder-hook =debian-inbox 'macro index I "c=inbox\n" "Switch to inbox"'
Next up: indexing your emails using mairix.

1 April 2008

Russell Coker: SE Linux Play Machine and Passwords

My SE Linux Play Machine [1] has been online again since the 18th of March. On Monday the 11th of Feb I took it offline after a user managed to change the password for my own account (their comment was “ohls -lsa! i can change passwordls -lsals -lsa HACKED!“). Part of the problem was the way /bin/passwd determines whether it should change a password. The previous algorithm (and the one that is currently used in Debian/Etch) is that if the UID of the account that is having it’s password changed doesn’t match the UID of the process that ran /bin/passwd then an additional SE Linux check is performed (to see if it has permission to change other user’s passwords). The problem here is that my Play machine has root (UID==0) as the guest account, and that according to the /bin/passwd program there is no difference between the root account (for unprivileged users) and the bofh account (which I use and which also has UID==0). This means of course that users of the root account could change the password of my account. My solution to this was to run chcon on the /bin/passwd program to give it a context that denied it the ability to change a password. The problem was that I accidentally ran the SE Linux program restorecon (which restores file contexts to their default values) which allowed /bin/passwd to change passwords, and therefore allowed a user to change the password of my account. The semanage tool that allows changing the default value of a file context does not permit changing the default for a file specification that matches one from the system policy (so the sys-admin can’t override compiled in values). I have now fixed the problem (the fix is in my Etch SE Linux repository [2] and has been accepted for Debian/Unstable and something based on it will go into the upstream branch of Shadow. See the Debian bug report #472575 [3] for more information. The summary of the new code is that in any case where a password is not required to change the user’s password then SE Linux access checks will be performed. The long version is below: The new algorithm (mostly taken from the Red Hat code base which was written by Dan Walsh) is that you can only change a password if you are running as non-root (which means that the pam_unix.so code will have verified the current password) or if you are running as root and the previous SE Linux security context of the process is permitted access to perform the passwd operation in the passwd class (which means it is permitted to change other user’s passwords). The previous context (the context before one of the exec family of system calls was called) is used for such access checks because we want to determine if the user’s shell (or other program used to launch /bin/passwd) was permitted to change other user’s passwords - executing a privileged program such as /bin/passwd causes a domain transition and the context is different) than the program that was used to execute it. It’s much like a SETUID program calling getuid(2) to get the UID of the process which launched it. To get the desired functionality for my Play Machine I don’t want a user to change their own password as the account is shared. So I appended password requisite pam_deny.so to the file /etc/pam.d/passwd (as well as the chfn and chsh commands) so that hostile users can’t break things. The new code in /bin/passwd will prevent users from taking over the machine if my PAM configuration ever gets broken, having multiple layers of protection is always a good thing. The end result is that the Debian package and the upstream code base are improved, and my Debian Etch repository has the code in question.

MJ Ray: Blog Updates

First of all, you can't do All Fool's Day pranks on global web sites because of time zones: if you do, you'll be pranking either early or late somewhere and so you're the fool. Now, I've been a bit quiet recently because I've been moving dozens of Wordpress blogs over to one Wordpress MU install. Clearly the right way to do it. They're all on different domains and we want their names to have www, which needed the following small change...
 
--- wpmu-settings.php
+++ wpmu-settings.php
@@ -6,8 +6,8 @@ if( $current_site && $current_blog )
 $wpmuBaseTablePrefix = $table_prefix;
 $domain = addslashes( $_SERVER['HTTP_HOST'] );
-if( substr( $domain, 0, 4 ) == 'www.' )
-       $domain = substr( $domain, 4 );
+if( substr( $domain, 0, 4 ) != 'www.' )
+       $domain = 'www.'.$domain;
 if( strpos( $domain, ':' ) )  
        if( substr( $domain, -3 ) == ':80' )  
                $domain = substr( $domain, 0, -3 );
I could have sworn I changed something else in that file, but I don't see what. Oops. I guess I'll run a check against the release tarball before merging the next upgrade from upstream. If anyone wants to hire someone to move blogs to Wordpress MU, you how where to find me. It's pretty enjoyable once you get into the routine, even if this project overran. I'm looking at changing my own blogs too. I'm looking at Chronicle but maybe with more email-like input files.

Erich Schubert: Ubuntu to rename top level directories

The usability experts of Ubuntu have finally started to handle the single most mentioned usability issue with Linux: the top level directory names.Quoting Finn C. Tional from the Ubuntu Usability Group:
It's one of the mysteries of Unix that the directory named "usr" is not for user data, and the directory named "etc" while looking like random stuff thrown together stores all the important config files. [...] This is probably the single most confusing hurdle for new Unix users. [...] We need to finally tackle this, before people are too used to these odd directory names.
Therefore, they propose the following renaming scheme:
/bin      /system/executables
/boot     /system/boot
/dev      /system/devices
/etc      /system/config
/lib      /system/libraries
/home     /users
/media    /storage
/mnt      /storage
/proc     /system/processes
/root     /users/Administrator
/sbin     /system/executables/admin
/tmp      /system/temporary
/usr      /system/applications
They'll include a patch for the GNU C library as well as for AppArmor to redirect the old path names to the new ones. Given the existing filename matching already done by AppArmor the overhead is expected to be neglible at least for AppArmor enabled systems. SELinux enabled systems will remain unchanged, since the user won't be allowed to see anything potentially irritating in the root directory anyway, but will be confined to his user directory.Since there are a dozen applications that will need changes to accomodate the new naming scheme, expect these changes only to be included with Ubuntu 10.4 (also lovingly named Ubuntu X) scheduled for April 2010.Other distributions are expected to follow up with these changes in 2011.P.S. Yeah, the Ubuntu folks really need to think this throuh some more. Russel pointed out that "My System" is even easier to understand; after all this is not about someone elses system or some systematic error or whatever. I figure he's right. How about "My Computer" than this lowercase (pessimistic?) "system" directory they're proposing there!

31 March 2008

Lars Wirzenius: Progress bars everywhere!

As I get older, and more impatient, I find myself wanting every program to give more or less accurate estimates of the remaining time until it has completed whatever it is doing. This applies to command line utilities as well. In fact, since most of my time is spent on the command line, it applies particularly to command line utilities. The thing I, as a user, want to know is how long I will still have to wait. I don't particularly care whether the program has completed 97.12765% of its job, I want to know whether it will still take seconds, minutes, hours, or longer to complete. Not remaining file counts. Not remaining byte counts. Time. I'm interested in the entire task. If each file takes 0.1 seconds to process, that's fine, but I don't want to estimate myself that with fourteen thousand remaining files it's going to to take around 25 minutes more. It doesn't have to be completely accurate; a reasonably good estimate is fine. It can fluctuate: when downloading over the Internet, transfer speeds sometimes vary. That's fine. Just give me the current estimate using the average recent speed. For various reasons, I often deal with large files, in the multi-gigabyte range. Copying them with cp seems to be pretty effective, but it's annoying to have to set up something like "watch du -sh source.file target.file" to be able to track progress. I could use "rsync --progress", but that only works well for a single file. Otherwise it reports remaining time for each file separately. I realize that rsync has a particularly difficult job for estimating the remaining time, since it is dependent on the contents of the files at either end. But it could try. Because of these, I tend to like Nautilus for copying files. It has a pretty good indicator for remaining time. Unfortunately, that isn't always practical to use, either, since I don't always copy file so that the local host is at least one end of the transfer, and I often really want rsync. One of the nice lesser-known utilities is pv (in Debian and Ubuntu in the package of the same name). It allows one to construct pipelines that estimate current remaining time. For example, I use this to fill a filesystem's empty space with zeroes:
pv -petrb -s "$ guess k" /dev/zero > temp
(where guess is the free space in kilobytes). Sometimes the pipelines need to be somewhat contrived to fit pv in. This can also make them slower than straightforward ones would be. But it's often nicer to get some progress reporting than to optimize for speed, at least for stuff that you have to actually wait for in real time.

Marc 'Zugschlus' Haber: Does Debian need the local host name in /etc/hosts for IPv6?

Exim has the habit of trying to find out about its host names and IP addresses when it starts up. This has, in the past, been an issue for the Debian packages, since a Debian system might be on a dial-on-demand modem line with expensive costs and thus should not do unnecessary DNS lookup when the MTA is started. This article tries to describe the issue and which countermeasures debian took, and asks for tips how to solve this in the case of IPv6, where our past measures unfortunately do not directly apply. I’d like to solicit opinions from people who are more experienced than me with Unix, the local resolver library including /etc/hosts and /etc/nsswitch.conf, DNS, and - especially - the customs that apply on a system running IPv6. To avoid the extra DNS lookups, the Exim packages have a Debconf option to configure exim for “minimal DNS usage”, which hardcodes the hostname into Exim’s configuration at package configuration time. This was necessary since - without this option - exim looks up its own host name in the DNS even when a completely local operation is invoked. In some cases, exim still looks up its IP address when a listening daemon starts up. This is why the Debian installer configures 127.0.1.1 (not 127.0.0.1) for the local hostname on installation, yielding /etc/hosts files like
127.0.0.1       localhost
127.0.1.1       myfoo.localdomain   myfoo
# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
However, in the last few weeks I have heard a few cases where exim does IPv6 AAAA lookups when a listening daemon starts up. An strace shows a gethostbyname2 call for AF_INET6, and if we want to continue the line we went in the past, we’d need an IPv6 address for myfoo.localdomain in /etc/hosts as well. I am now wondering how this could be implemented. In IPv4, we have 127.0.0.0/8 available for the local host and could arbitrarily choose 127.0.1.1 to configure the local host name on. In IPv6, there is only ::1, which is a single address. Would it be possible to choose an arbitrary “link local” address on lo, the loopback interface? Or is there any better way? This being said, I consider the entire 127.0.1.1 business a horrible hack which is one of the most ugly things I have ever seen. Do we have a chance to implement this in a more cleaner way, or is it still the way to go for the distribution, where we don’t know zilch about the environment where an installed system is going to be used? This issue leads to people adding their local host name to ::1 in /etc/hosts, which might re-introduce other issues that we experienced in a phase when we did the same for 127.0.0.1, eventually ending up with 127.0.1.1, or to disabling IPv6 altogether, which is a bad thing in a time where IPv6 should be enabled, not disabled. So I’d like to find a clean solution which could then be implemented in whatever part of Debian might be responsible. I tried asking this question in other places, including Usenet, before pestering my Blog to ask the Lazyweb, but obviously the people I asked before do not care for the special environment that a Linux distribution has to take care of. The only answers I got were like “that would be the local administrator’s task to fix” and “this should be taken care of in the local DNS server/setup (maybe even on the local box being installed)”. A quite frustrating experience.

Amaya Rodrigo: Release Goal goal-recommends: Final help needed

Slow sunday afternoon? Choose a release goal and work on it!

Yesterday I focused on the goal-recommends issue: No unmet recommends relations inside main. I worked from 18:00 pm to 2:00am, aprox, and 32 bugs were closed.

16 Non Maintainer Uploads, closing 21 bugs:
* delo  (Closes: #378221, #414389, #416161, #452953)
* gpib  (Closes: #430998)
* php-net-smtp (Closes: #369273)
* rpc2 (Closes: #377829) (NMU Overriden by maintainer)
* rvm (Closes: #377410) (NMU Overriden by maintainer)
* smooth-themes (Closes: #379195)
* xmltex (Closes: #429564)
* acpitool (Closes: #436637)
* asciidoc (Closes: #452470)
* chasen (Closes: #363196, #452474)
* cl-screen-sbcl (Closes: #436641, #460444)
* cpufreqd (Closes: #436647)
* denemo (Closes: #439929)
* lacheck (Closes: #448911)
* sablevm (Closes: #346071)
* ddcontrol-db (Closes: #436649)

Filed for removal, will close 3 bugs:
* digikamimageplugins-doc (Closes: #448904)
* free-java-sdk (Closes: #429306, #401492)
* php4-apd Filed for removal by KiBi (Closes: #418319)

Orphaning uploads, closing 2 bugs:
* xcin2.3 (Closes: #276885)
* gnochm (Closes: #429304)

Packages only present in oldstable, closing 4 bugs:
* eagle-usb-utils (Closes: #448905)
* zd1211 (Closes: #378725)
* python-pysnmp4 (Closes: #377075)
* lessdisks-terminal (Closes: #361939)

Bugs marked fixed but never properly closed, closing 2 bugs:
* araneida (Closes: #436638)
* gtk2-engines-murrine (Closes: #430999)

That leaves a total of 2 bugs remaining to finish the release goal:
* #436650: syslinux: Please build (at least a subset of) syslinux for all arches
* #448890: bioperl: recommends packages not in main (pending, serious)

These don't seem trivial to fix, anyone dares to step in?

(Updated: Monday, March 31 2008 17:50)

Meike Reichle: Yay, I'm through

Since yesterday I am through with my NM procedure. Looking back I get to the same conclusion as probably most NMs have: not overly hard, but time-consuming and glad to have it over with. Anyway, so far so good, just waiting for DAM approval and my account now. There are still a couple of people in front of me but I hope for another processing before the elections close. (I guess it would at least be good for the turnout.) For now, many thanks to my Application Manager Andreas Barth who has been very responsive and always answered my mails quickly and thoroughly, and also to Martin Zobel-Helas for advocating me.

30 March 2008

Neil Williams: deb-gview, dpkg and emdebian-tools

OK, been quiet for a few days, at least on the blog, but in accordance with typical behaviour (for me at least) a quiet blog means a lot of things going on elsewhere. The smallest was a fix for deb-gview - combining a fix for opening files in the current working directory with a fix for the imminent dpkg 1.14.17 which modified the .changes file format a bit. That was relatively easy and I've uploaded 0.2.1 to unstable. gvfs hasn't made testing yet so there's no point in waiting for deb-gview to migrate before 0.2.1.
The largest change? Depends how you define large:
  1. Large number of changes to package files - emdebian-tools 1.0.0
  2. Large effect on Emdebian workload - dpkg 1.14.17

dpkg
dpkg bugs closed - emdebian-tools 1.0.0 pending - dpkg-shlibdeps is now able to look into directories containing libraries used by cross-built binaries provided that the right environment variable are set. Closes: #453267. dpkg-buildpackage will set PKG_CONFIG_LIBDIR (but not override an existing value) in case of cross-compilation so that pkgconfig finds .pc files in the directory specific to the target architecture. Closes: #439979.
These two changes will have a major effect on the overall workload required within Emdebian and give us a sane cross-building environment in Lenny which is ABSOLUTELY $^ @&*! FANTASTIC. :-) Currently, 1.14.17 is in experimental but I've installed it on my system for testing purposes so that I can complete emdebian-tools 1.0.0:
emdebian-tools 1.0.0
Now here, I'm making some progress. A bug has been bothering me for some time with how emdebian-tools needs a Debian primary mirror to calculate various dependency information and other apt cache stuff whilst taking into account the host architecture. Simon and I now think that we can do the dependency stuff with a continually updated dpkg-cross repository and I can use libcache-apt-perl for the rest. So whereas dpkg-cross might still exist into Lenny, it is looking like apt-cross might not - at least not as an application. However, I'm not taking that step with emdebian-tools just yet. In the meantime, I'm simply using debconf to replace the automated selection of a Debian Primary Mirror and passing that mirror to apt-cross - something I should probably have setup a while ago.
As well as that bug fix, I've added a check to emchain so that users are warned if they don't actually need to run it, added the mirror support to the various scripts and removed the workarounds now fixed by dpkg.
'dpkg-buildpackage -a' is usable for nearly all packages once you have dpkg-dev >= 1.14.7. emdebuild >= 1.0.0 is only necessary IF:
  1. You want to modify/update Emdebian patches (not just apply them) - i.e. if you have commit access to Emdebian SVN.

  2. You need the one remaining wrapper: 'X-Build-Cross-Libtool: yes' which is my next main target. This is a package-specific problem and each incidence needs a package-specific solution via an appropriate patch. As such, the wrapper is likely to stay in place in emdebuild for some considerable time - at least until someone can rebuild the entire archive with a test that can identify which packages are still affected.

  3. You want the build checks currently implemented by emdebuild but which I plan to spin out during the life of emdebian-tools 1.x. I want to standardise those build checks and abstract them into possibly a lintian-compatible check set.

Also, there should now be no need for any wrapper scripts that anyone may have devised to mangle LD_LIBRARY_PATH or PKG_CONFIG_LIBDIR - indeed,
explicit support for these within dpkg means that it is to be considered harmful from now on to touch these variables, except possibly in some specific corner cases.

Biella Coleman: A Christian Gene

Gay scientists discover the Christian gene.

29 March 2008

Enrico Zini: OpenStreetMap party at Kaohsiung, Taiwan

OpenStreetMap party at Kaohsiung, Taiwan Apparently, yesterday we had the first OpenStreetMap event in Taiwan! We met in a caf /restaurant equipped with power plug, wireless network and overhead projector and we had a bit of an introduction, chat and lunch. Then we split in groups and exploited the fact that the newly built underground (KMRT) system is still free of charge, to spread around and map around the stations. Finally, we reconvened at someone's house to see how to put the data together, draw roads, tag and upload. Highlights of the day: Technical bits: Issues to address:

Biella Coleman: On Moving to New Places

Last week I went to Puerto Rico to take my so-called spring break to visit my mom. I expected a semi-relaxing visit as her caretaker, Milagro, would be around and I also expected one last visit with my mother before embarking on the difficult process of moving her into a nursing home, which I planed to do over the summer. But a day and a half after I arrived, we brought her to the hospital because she basically had stopped eating and even drinking water and now that she has been released from the hospital, she has been placed in a nursing home. We brought my mom to the hospital because she was malnourished and dehydrated. To admit her was an exercise in managing a fireball of pure fury. Even if she was weak, she mustered every last piece of her energy so as to transform herself from a little old lady to a little old lady of pure Russian terror, unleashing her wrath left and right, not to mention up and down. But well, thanks to her (I think, somewhat calculated) wrath, at least they took her in immediately (despite a truly truly packed packed emergency room). Once inside, it took 4 nurses and her caretaker to put the initial IV in her arm and then they threw in a little haldol to calm her down. We waited nearly a day to find out that her doctor, Dra Nazario ordered a feeding tube without consulting with me or my sister (of course at some point they would need consent). At first I did not want a feeding tube put in her. But after talking with various nurses and other family members in the hospital with parents with Alzheimers, I decided to go for it. It is clear that my mom just does not eat enough and when she does, she eats poorly and I did not want to go through another traumatic visit in the emergency room at some future date to do the same. After her operation and after a few days of getting food, she was conscious but barely so. She did not want to talk, did not seem to be able to talk, and this of course, was heartbreaking because we thought that the operation, 4 days without food, and the really difficult hospital entry did her over. But once she developed slight pneumonia and an UTI, funny enough, she actually came back to life pretty much as she was before the hospital (which is still pretty limited but at least she did not seem any worse and it will be interesting to see what happens after she gets proper nutrition for a few weeks). So in the last 9 days I spent a lot of time in the hospital, more than I have ever spent in one. Let’s face it they are creepy places and exude a low-level, sometimes higher grade level of architectural and atmospheric grossness. The smell is so distinct: part disinfectant, part something that I can only describe as that of pre-death (or pre-rot), a smell that especially lingers for it co-mingles with the palpable sense of anxiety and worry (and tiredness) that family members carry with them. I took my mom to Hospital Pavia, which is supposedly one of the better hospitals in the San Juan metropolitan areas, and like 3 minutes from my house. And generally things were orderly and run well but there were a few times, when I was floored and beyond livid by they way they treated my mother and it is clear that a hospital is only as good as the doctors and the ability of the nurses to carry out their orders correctly. (more…)

Erich Schubert: Google Summer Of Code 2008

As blogged before, Debian is in the Google Summer of Code 2008.So far, we have rather few applications - much less than last year. This doesn't seem specific to Debian, other organizations have also been reporting fewer applications, and Google is considering a deadline extension. Maybe the low number is related to Easter holidays. Also at least at my university the summer term will start only on April 1st, just past the deadline. So many students probably are still away in holiday.Anyway: if you are interested in participating in the Google Summer of Code, chances are still pretty good. We don't have too many applications yet; not even all of the projects on the Wiki Ideas page have received a submission yet, only a few have received more than one; and even with those a well-written submission standas a good chance. Also some new ideas have been added in the meantime.In particular missing from our submissions list are: (see the Wiki page for details on these projects).Especially the lack of a submission for the MergeMaster port is surprising. Many people would love to see a good configuration file merging tool in Debian. I can only guess that people are thinking "awh, everybody is going to submit an application for this one, I don't have a chance here". You currenlty DO have a chance, because there is no single proposal in for this one yet!If you have any questions, IRC channel #debian-soc in OFTC is pretty useful.

Martín Ferrari: Six (more) reasons to hate Java

There are many reasons to hate Java, it's like shooting fish in a barrel. But in the last weeks I found some more, half of them aren't even fault of the standard API (the usual culprit), and I want to share my frustration with the rest of the world. It has no unsigned types Say you want to manage binary protocols, files, etc. You'd like to store and retrieve bytes and words in machine format, of course, but you'll have a hard time finding the right value because you can't have a goddamn unsigned byte! So if you want —for example— to read the length of a string which can be bigger than 127 as a single byte, you'll end doing some aberration like this:
byte strl = foo_retrieve_byte();
int real_strl = strl < 0 ? 256 + strl : strl;
You can't inherit constructors Maybe there's something in the OOP dogma that mandates this, but if I want to define a new exception that does nothing, but allows me to differentiate a custom class of errors, I don't want to explicitly write dummy constructors instead of writing an empty class —which is simpler and cleaner— and have the four standard exception constructors for free. So, you'll have to do this:
public class FooException extends BarException  
	public FooException()   super();  
	public FooException(String s)   super(s);  
	public FooException(Throwable t)   super(t);  
	public FooException(String s, Throwable t)   super(s, t);  
 
Instead of this:
public class FooException extends BarException    
You can't declare destructors Say you've coded a nifty jdbc wrapper that automates most of the boring stuff, like automatically freeing the connection to the connection pool when there was an exception thrown, logs errors and maybe queries, handles auto-commit settings, etc. In the simple case, you'd create an instance, do some work, and then close the connection; if there was an SQL exception, you little class will take care of it and re-throw. BUT, if in the middle of your work in the calling code, you have an unrelated exception, you need to catch it or you'll leak connections, because the wrapper class doesn't have a way of handling this, even if the object gets garbage collected! In the end, I had to write tons of times the same stupid code:
try  
	j = JdbcWrapper.new(foo);
	j.doSelect(bar);
	unrelatedObject.unrelatedMethod();
	j.doUpdate(baz);
  finally  
	j.close();
 
You don't have a sane way of controlling the terminal Most of the time, when dealing with web applications, you won't need this. But when you're doing some serious stuff, you might need to write a CLI application (oh, noes!); and then do some stupid thing like asking the console to stop echoing characters so you can ask for a password. You'd think that the smart guys that designed Java would have devised an portable library to handle this trivial task, but no! Guess what I found when looking at a way of doing this? Some idiot at SUN recommending (and many dummies following) a background thread that spits backspaces faster than the user can write! Of course, SUN will tell you that using Strings is insecure for storing passwords, because they cannot be wiped out like byte arrays. But they fail to mention something as basic as not showing the fucking password in the first place, or something as important as wiping the object after using it: you can't lock memory from Java, so you risk that it could end in some slack in the swap file. No, you can't leave stdin/stdout/stderr fscking alone! When dealing with the previous problem, you say fuck portability and just call stty -echo to do the job. Well, you'll find a little surprise! Even if you don't ask for the process' reader/writer streams, the Runtime class will pipe(2) and dup(2) your child process' standard streams. With this excellent approach you cannot have a child process output stuff to the user, nor even errors; you cannot allow the child process access the tty (stty obviously can't do shit with a piped stdin). And there's no fucking way to tell it to stop crippling your standard streams! The only solution I could find was a very ugly shell hack:
Process p = Runtime.getRuntime().exec(
	new String[] "sh", "-c", "stty echo > /dev/tty < /dev/tty 2>&1" 
);
No, you can't handle signals After doing the previous hack, you find that if you interrupt your process while waiting for user input, your console will remain in noecho state. So the obvious thing is to catch SIGINT and friends and call stty again to restore the console. HA! You will find that there's no standard way of doing that, and if you really need it, you have to resort to undocumented com.sun.* classes which aren't even guaranteed to be present in every JVM. My solution was to set up a shutdown hook, which solved this problem, but would not solve other very common problems that are solved usually with signal handlers. I'm going to DebConf8, edition 2008 of the annual Debian 
       	developers meeting Tags: Planet Lugfi, Planet Debian

28 March 2008

Russell Coker: Debian SE Linux Status

At the moment I’ve got more time to work on these things than I have had for a while. I’ve got Etch support going quite well (see my post about my Etch repository [1]), the next step is to back-port some packages for AMD64 to get it working as well as i386. I’ve got an i386 Xen server for SE Linux development (which is also used for my Play Machine’s [2] DomU - so it’s definitely not for anything secret). I can give accounts and/or DomU’s to people who have a good use for them (the machine has 512M of RAM so could have 4-5 DomU’s). Currently it seems that the 2.6.24 kernel in Debian doesn’t work for Xen (at least on with an i686 CPU). I have filed bug report #472584 about it not working as a DomU [3]. This combined with the fact that according to bug report #466492 it doesn’t work as a Dom0 (which I have verified in my own tests) [4] makes the package linux-image-2.6.24-1-xen-686 unusable. Due to the inability to use 2.6.24 Xen I can’t do SE Linux development for Lenny in a DomU (Lenny tools build policy version 21 and the Etch kernel I’m using only supports policy version 20). So I have repurposed one of my servers for Lenny (unstable) development. I can give user accounts on that machine to anyone who has a good reason (and there are some people who I would give root access to if they need it). The current policy packages in Unstable are built without MCS support. This is a problem as converting between a policy which has MCS or MLS and one which doesn’t is rather painful (purge policy, reinstall policy, and reboot are all required steps). I have filed bug report #473048 with a patch for this - my patch may not actually be much good (I don’t understand some aspects of Manoj’s code) but it does achieve the desired result [5]. I won’t be making Apt repositories for such things as I expect that the changes will get into Debian fast enough. The next thing I am starting to work on is MLS support for Debian (currently it only supports the Strict and Targeted policies). See the Multilevel Security Wikipedia page for some background information on the technology [6]. I don’t expect that many people will use MLS on Debian in production environments, and it wouldn’t surprise me if no-one used it on a production server (although of course it would be impossible to prove this). But I still believe that it’s worth having for educational purposes. I am sure that there are packages in Debian of a similar size that will get less use so it’s not a waste of disk space on mirror servers! The only real down-side to adding MLS support is that it will increase the build time for the Debian SE Linux policy packages, currently they take 13 minutes to build on a 1.1GHz Celeron system (the Xen server I mentioned previously) and I expect that the machine in question will have build times greater than 20 minutes with MLS included. I will probably need to set up an Unstable DomU on a dual-core 64bit machine for the sole purpose of building policy packages. I will also have to investigate use of the “-j” option to make when building the policy to take advantage of the dual cores. I often do small tweaks to policy and it’s annoying to have to wait for any length of time for a result. The version of Coreutils that is currently in Unstable will have ls display a “+” character for every file when running SE Linux (I have filed bug report #472590) about this [7]. It is being actively discussed and at this stage it seems most likely that the functionality from Etch in this regard will be restored (which is using “+” to represent ACLs only not SE Linux contexts). It seems likely to me that I will find a few other issues of a similar nature now that I have started seriously working on Unstable. For the benefit of Debian and upstream developers who get involved in such discussions, please do not be put off if you join a discussion that is CC’d to the NSA SE Linux mailing list and have your message rejected by the list server. The code of conduct is much the same on most mailing lists, and the SE Linux list is not much different to others. The difference is that before your get your email address white-listed for posting you have to agree to the terms of service for the list. The people who run the list server appear to work more than 40 hours a week so there should not be a great delay. If anyone wants to get a message about Debian SE Linux development sent to the list without delay on a weekend then they can send it to me for forwarding. I am aware of some discussions about SE Linux and the Debian installer. I have not responded to them yet because I wanted to get some serious coding done first as an approach of “I haven’t done much coding recently but trust me I’ll fix the problems for you” might not be accepted well. I will start investigating these issues as soon as I have my Debian/Unstable server working well in enforcing mode. Update: I’ve just filed bug report #473067 with a patch to enable MLS policy builds [8].

27 March 2008

Andrew Pollock: [tech] Mutt configuration find of the year

I switched from Pine to Mutt as my primary email client around the time I decided to become a Debian developer, because Pine's PGP support was abysmal (it also beat building Pine packages by hand all the time). The other bonus feature was it threaded emails, which made it easier to follow mailing lists. It's been a very gradual learning process since I switched, and I certainly don't consider myself to be a Mutt power user. I initially really hated it, I think largely because of the concept of "old, unseen" messages, versus "new" messages, and the behaviour of the Tab key. Once I unset the mark_old variable, it got a lot more tolerable. I think at some point I either plagiarised someone's .muttrc from the Internet, or sat down with the manual (or possibly a bit of both) and came up with a config that I could live with, and it's been workable ever since. One problem I (more recently) started having was that when I had 200-odd unread emails in my inbox, which has been pretty common occurrence in the last couple of years, and someone replied to an email in an old thread, because I wasn't necessary scrolling through all 200-odd emails (as new, unthreaded emails usually sorted chronologically at the bottom of my inbox), I'd miss the fact that the email had arrived, often for extended periods of time. I was lamenting this problem to Sarah over dinner last night, and saying how I preferred Gmail's behaviour, where the position of a thread in the inbox was determined by the date of the most recent email in the thread. I figured Mutt must have a sort option to be able to deal with this, and so I went rummaging in the manual last night, and discovered the sort_aux configuration variable. I've set that to last-date-received, and now I'm very pleased. I should never miss an email again. Of course, I should really try practising Inbox Zero, then it wouldn't be an issue.

Jordi Mallach: Interview in El Pa s

Today's edition of El Pa s, the most read Spanish newspaper, celebrates the 10th anniversary of it's weekly technology section Ciberpa s with a special edition which takes a look back at the last 10 years of computing, and also looks forward to what the future will bring us. Merc Molist interviewed Carlos Atar s, my mate at Softcatal Jordi Mas and myself, on what happened during the last 10 years of Free Software and where we are heading. The paper edition features a *gasp* half page picture of me laying on the grass, but is otherwise identical to the online version. I need to add, this feels a bit strange. :) It's the first time I see myself refered to as just Mallach , but I realise I'm getting old...

Stefano Zacchiroli: galax 1.1

Galax 1.1: released ... and in Debian/unstable! After a long release cycle, a couple of days ago Galax 1.1 (the first release of the 1.x series) was finally released. Galax is a free (as in freedom) implementation of XQuery, the XML Query language. Galax is Schema-aware, statically typed, and really fast. The release enjoyed a good synergy among the Debian packagers (erm ... /me) and upstream authors which were happy to exchange patches and let me test drive the release before making it public, to check whether everything was fine for Debian or not. Thank you Jerome and Mary! Thanks to these efforts Galax 1.1 is now available in Debian/unstable. Enjoy your XQueries!

Next.

Previous.