As some of you know, yesterday we started the two weeks of activities for the Fifth On-line Encounter of Free Education, Culture and Software. This year, the main topic for the conference is social networks, but not in the twitter-facebook sense Social networks as ways of understanding and modelling human-to-human interactions. Of course, there is interest from many attendees in using and taking advantage of said social network systems (and others), but the topic is far broader. One of the core tools of EDUSOL, and the only tool that is constantly active through our two weeks of activity, is IRC Which is somewhat of a challenge, as we receive some not-tech-savvy users from all over the world. The first year or two we asked everybody to connect via an IRC client (and we had even decided that it would be a technological filter We thought we would not cater for people without the technical skills to install and use IRC). Life proved us wrong, and we ended up using two web-to-IRC gateways: One of them, via an instance of CGI:IRC, and the other one via a third-party service, Mibbit. Now, the core mind behind EDUSOL is Alejandro Miranda, Pooka; I am not really into education (it is a very interesting topic but far from what I am good at). Pooka has been invovled in on-line communities analysis for several years already, since we worked together at FES Iztacala. For a long time he wanted to graph the interactions at EDUSOL, which was obviously possible given it was all centered on three tools (IRC for live chat, Drupal for generic information and Moodle for the talks and workshops' material This has changed this year, as we are giving much more weight to Drupal and taking it off Moodle), and so last year he was finally able to generate a EDUSOL 2008 conference photo (warning: 2MB image, 4311x3352px), where each person's avatar appears where most of his interactions were. This photo was (unfortunately) achieved using non-free software, but is very much looking at! Now, this year Pooka stumbled upon a great tool, PieSpy (available in Debian package piespy). Piespy generates very interesting interaction graph for IRC channels, as you can see here: Piespy is a bot that sits in the IRC channel logging everything that any given user "says" directly to another one, and graphs it. Not much to say here, only that it generates a very good (and practically real-time) view of what happens on the channel. For this particular channel, and during EDUSOL, you can see here the latest IRC snapshots. Very fun to see - and somewhat addictive how it morphs across time :)

Attachment	Size
EDUSOL 2008 - Conference photo	1.97 MB
Current (Monday+Tuesday) interaction graph for our IRC channel	39.89 KB

Jeff sent the following while I had connectivity issues and I hadn't gotten around to posting it here. So without further ado, and given the success of our initial R / Finance 2009 conference about R in Finance, here is the call for papers for next spring:

Call for Papers: R/Finance 2010: Applied Finance with R
April 16 and 17, 2010
Chicago, IL, USA
The second annual R/Finance conference for applied finance using R will be held this spring in Chicago, IL, USA on April 16 and 17, 2010. The two-day conference will cover topics including portfolio management, time series analysis, advanced risk tools, high-performance computing, market microstructure and econometrics. All will be discussed within the context of using R as a primary tool for financial risk management and trading. One-page abstracts or complete papers (in txt or pdf format) are invited for consideration. Academic and practitioner research proposals related to R are encouraged. We will accept submissions for full talks, abbreviated "lightning talks", and a limited number of pre-conference tutorial sessions. Please indicate with your submission if you would be willing to produce a formal paper (10-15 pages) for a peer-reviewed conference proceedings publication. Presenters are strongly encouraged to provide working R code to accompany the presentation/paper. Data sets should also be made public for the purposes of reproducibility (though we realize this may be limited due to contracts with data vendors). Preference may be given to presenters who have released R packages. Please send submissions to: committee at RinFinance.com The submission deadline is December 31st, 2009. Submissions will be evaluated and submitters notified via email on a rolling basis. Determination of whether a presentation will be a long presentation or a lightning talk will be made once the full list of presenters is known. R/Finance 2009 included keynote presentations by Patrick Burns, Robert Grossman, David Kane, Roger Koenker, David Ruppert, Diethelm Wuertz, and Eric Zivot. Attendees included practitioners, academics, and government officials. We anticipate another exciting line-up for 2010 and will announce details at the conference website http://www.RinFinance.com as they become available. For the program committee:

Gib Bassett, Peter Carl, Dirk Eddelbuettel, John Miller,
Brian Peterson, Dale Rosenthal, Jeffrey Ryan

See you in Chicago in April!

ACPI is a confusing place. It's often thought of as a suspend/resume thing, though if you're unlucky you've learned that it's also involved in boot-time configuration because it's screwed up your interrupts again. But ACPI's also heavily involved in the runtime management of the system, and it's necessary for there to be a mechanism for the hardware to alert the OS of events. ACPI handles this case by providing a set of general purpose events (GPEs). The implementation of these is fairly straightforward - an ACPI table points at a defined system resource (typically an area of system io space, though in principle it could be something like mmio instead), and when the hardware fires an ACPI interrupt the kernel looks at this region to see which GPEs are flagged. Then things get more interesting. The majority of GPEs are implemented in the ACPI tables via methods with names like _Lxx or _Exx. The xx is the number of the GPE in hex, while the leading _L or _E indicates whether the GPE is level- or edge-triggered. If an ACPI interrupt is fired and GPE 0x1D is flagged as being the source of the interrupt, the ACPI interpreter will then look for an _L1D or _E1D method. Upon finding one, it'll execute it. What this method does is entirely up to the firmware - on most HP laptops, GPE 0x1D is hooked up to the lid switch[1] and so executing it will send a notification to the OS that the lid switch has changed state. The OS will then evaluate the state of the lid switch (generally by making another ACPI query) and send the event up to userspace. How does the lid end up triggering GPE 0x1D? Things get pretty hardware specific at this point. Intel motherboard chipsets have a set of general purpose io (GPIO) lines that can, for the most part[2], be used by the system vendor for anything they want. For a lid switch, one of these lines is hooked to the switch and the BIOS configures the GPIO as an input. Pressing the switch will cause the GPIO line to become active. The GPIO lines are mapped to GPEs in a 1:1 manner, though with an offset of 16 - ie, GPIO 0xd will map to GPE 0x1d. If GPIO 0xd becomes active, GPE 0x1d will be flagged and an ACPI interrupt sent. The ACPI code will then do something to quash the interrupts, such as inverting the polarity of the GPIO[3], as well as send the notification to the OS. Why are the GPIOs offset by 16 relative to the GPEs? The lower 16 GPEs (again, talking about Intel hardware) have pre-defined purposes[4]. These range from things like "Critically low battery" to "PCIe hotplug event" down to "This device triggered a wakeup". And the latter is what I'm most interested in here. Various pieces of modern hardware can be placed into power saving states when not in use. The problem with this is that the user experience of having to turn on hardware before you can use it is not a good one, so in order to make this the default behaviour we need the hardware to tell us that something happened that requires us to wake the hardware up. There's something of a chicken and egg problem here, but thankfully most of the relevant modern hardware has out of band mechanisms to tell us about things going on. The PCI spec defines something called Power Management Events (PME), which are driven by an additional current that's supplied to the hardware even when it's otherwise turned off. On plug-in PCI Express cards, firing a PME generates an interrupt on the root bridge and a native driver can interpret that, but for legacy PCI devices and integrated chipset devices the notification has to come via ACPI. The example I've been working on is USB. It's a good choice for various reasons - firstly, there's already support for detecting when the USB controller is idle. Secondly, modern USB host controllers have support for generating PMEs on device insertion, removal or (and this is important) remote wakeup. In other words, as long as the USB bus is idle we can power down the entire USB controller. If the OS tries to access a USB device, we'll power it back up. If the user unplugs or plugs a device, we'll power it back up. If a previously idle device suddenly responds to some external input, we'll power it back up. And it's all nicely invisible to the user. How does this work? The controller retains a small amount of power even when nominally pwoered down. This is used to keep the detection circuitry alive. When it receives a wakeup event, it asserts the PME line. The chipset detects this and fires a GPE. The OS runs this GPE and receives a device notification on the ACPI representation of the USB controller, telling us to power it back up. We do so and process whatever woke us - if the bus then goes idle again, we can power down once more. The astonishing thing is that this all works. The only problem we have is that it relies on the machine vendor to have provided the ACPI methods that are associated with the GPEs. If they haven't, we can't enable this functionality - even though the hardware is capable of generating the GPEs, we have no method to execute to let us know which device has to be woken up. The GPE is never answered, we never acknowledge the PME and the hardware keeps on screaming for attention without getting any. And, more to the point, it never gets powered up and your mouse doesn't work. There's a pretty gross hack to deal with this. In general, we know what the GPE to device mappings are - they're pretty static across Intel chipsets, and while AMD ones can be programmed differently by the BIOS we can read that information back and set up a mapping ourselves. This trick also comes in handy when some vendors (like, say, Dell) manage to implement one of the GPE events wrongly. Everything looks like it should work, but the method never sends a notification because it's buggy. In that case we can unregister the existing method and implement our own instead. This code isn't upstream yet, but patches have been posted to the linux-acpi mailing list and with luck it'll be there in the 2.6.33 timeframe. My tests suggest about 0.2W saving per machine, which isn't going to save all that many polar bears but seems worth it anyway. [1] _L1D = lid. Sigh. [2] There's a few that are reserved for specific purposes [3] So where before it had to be high to be active, it now has to be low to be active - this means that it'll now trigger on the switch being opened rather than closed, so you'll get another event when you open the lid again. [4] You can find a list in the documentation for the appropriate ICH chip - the relevant section is "GPE0_STS" under the LPC interface chapter.

I have been reading comments on Sandro's post about the use of email addresses. I am not sure about what he really wanted to express exactly, because I can't see anything wrong when someone from other distro upload a package into the archive and they use their distro's mail addresses so it is clear that I don't agree with the first point of his post. Now, regarding the second point, I don't understand why when being a DD and an Ubuntu Developer at the same time some people prefer uploading to Debian archive using @ubuntu.com but well, anyone is free of doing what they think is correct and this is not something which is in the policy so it's OK. But reading the first point made by Stefano's post made me understand why.

I got surprised when I read the Jon's post about debian kernel contributors and I looked for the word debian in http://lwn.net/Articles/247582/ and nothing was found. I subscribed for a while, just for curiosity, in the Linux Kernel Mailing List and I was able to read some mails from people I know they are in Debian and just because the patches weren't signed off with debian mail addresses Debian does not appear in such a post at lwn.net. I'd like to add that, for not being misunderstood, I do respect all kernel contributors, because their contributions are really important for the whole community and we are aware of Debian's contributions. My point is that it should be accepted that there exists an impact when using one or another email address and it should be considered (when you are part of both projects, in this case, Debian and Ubuntu).

In Ubuntu Server Edition 9.10: No hardware required, Matt Zimmerman announces that from now on, "every release of Ubuntu Server Edition is simultaneously available on EC2". Amazon's EC2 documentation says: "the ability to create and publish kernels and ramdisks is restricted to Amazon EC2 and selected vendors". Canonical appears to be one of those vendors. Their newest EC2 AMI's contain modules from an Ubuntu build of linux-xen (2.6.27-23). Eric Hammond, who has been for a while making both Ubuntu and Debian images for EC2 says

Historically on EC2, neither Debian nor Ubuntu have had completely Debian and Ubuntu stacks from the kernel up. Instead, we've had to make do with patching the runtime on top of older kernels (2.6.16, 2.6.18, 2.6.21) built for other distros (Fedora Core). Amazingly, we've managed to hold this together and keep it running well for a couple years on EC2.

He goes on to describe current problems with eg, Debian's new udev version and the available EC2 kernels. Furthermore, anticipating today's news:

When the point comes where I am not publishing the base Ubuntu server AMIs, it will not make sense for me to publish new Debian AMIs either.

Those wanting to run Debian on EC2 will be stuck with duct-taping together Debian with the available kernels. Maybe I'm wrong. Maybe Ubuntu is actually working with Debian's kernel team, and will be letting them use Canonical's access to publish AKI's of official Debian kernels. Or maybe Ubuntu is working with Debian's kernel team to include identical linux-xen kernel in Debian, so the Ubuntu AKI's could be used. But appearances are that this is another case where Ubuntu has managed to take a situation that was less than ideal for all concerned, and turn it into an advantage for Ubuntu, while at the same time being a unfixable loss for Debian. My mouse's perspective is that a) we maybe only have so many losses left in us (altho we did get thru that whole dinosaur thing ok!) and b) King Kong is still oddly dependent on his mammilian heritage to be up there with his head in the cloud, tearing at Godzilla and stamping on us.

Sandro Tosi writes to complain about Debian/Ubuntu members using their Ubuntu email address for Debian packages. zack responds, wondering what's wrong with that. I generally agree with Zack. However, back when Jon Corbet was producing summaries of kernel contributors (here's one for 2.6.23: Who wrote 2.6.23), I thought it was a shame that the many Debian contributors who work on the kernel were not represented. I suspect most Debian kernel hackers are paid to work on the kernel, and sign off their patches with an address at their employer's domain.

I was referred to Creating a World Without Poverty during a discussion on advogato some months ago, but it took rather a long time to obtain the book for various reasons and then I forgot about this review until a recent discussion on new Cooperatives-UK Chief Ed Mayo s site. Better late than never, here s my review of it. Let me know what you think of this book. About the Book Author Muhammad Yunus is founder of the Grameen Bank, Bangladesh, one of the microcredit pioneers, but that story has been told in another book Banker to the Poor. The prologue of this book starts with the creation of Grameen Danone a joint venture between the bank and the France-based Groupe Danone then part one describes problems in capitalism and introduces the idea of Social Businesses as a complement to what the book calls Profit-Maximising Businesses (PMBs), or what most people know as usual shareholder companies. Part two then covers the Grameen Group from its start in banking, through an impressive list of short company case studies some Social, some PMBs, some joint-ventures up to the first year or so of Grameen Danone. The final part then talks about creating a marketplace which is open to Social Businesses, harnessing Information Technology to spread these ideas (more on this in a later article on this site) and using those innovations to banish poverty from the world. The epilogue is the Nobel Prize Lecture Poverty Is a Threat to Peace which seemed to read almost as a simplified summary of the book s main ideas. Annoyance I got quite annoyed with this book because I feel there is a lurking absurdity in its main big idea:- On the one hand, the argument seems to be that profit-maximising businesses are problematic because of their single-minded focus on profit-maximisation. This is an argument that I largely agree with, as you may remember from my short review of Joel Bakan: The Corporation. On the other hand, it proposes to remedy this by creating Social Businesses with equally single-minded focus on social problems this seems like a recipe for disaster! If profit-maximisers threaten to wreck the environment, human rights or whatever else isn t in their goals, why won t Social Businesses using similar single-purpose company formation rules just as easily threaten to wreck whatever mentioned isn t in their goals? If this book is correct and entrepreneurs are multi-faceted human beings who will act to promote social aims (which they must if they are to invest in Social Businesses), then the only robust way forward is to promote businesses that do not try to simplify that multi-faceted nature, whether for profit-maximisation or for a subset of social aims. The best form of businesses that I know for trying to represent all interests of their owners are cooperatives. Dismissed after less than a page Cooperatives are examined in part one of the book and dismissed after less than a page (p35) because they are not inherently oriented towards helping the poor or producing any other specific social benefit (which is a misleading claim because concern for community is a basic principle of cooperatives which all should uphold), they can be owned equally by the wealthy as well as the needy (why is this a problem?) and they can sometimes be demutualised into PMBs. Ultimately, if that s the will of the people, that can t be completely prevented, but recent developments have found ways to make that much less attractive (so-called anti-carpetbagging rules). Doing what people want is not usually a problem in other spheres it s democracy. What s really infuriating is that the author proceeds to describe Social Business which are aimed at specific social benefits (rather than all), can only be owned by the needy but can access the resources they need by donations from the wealthy or by forming joint ventures with them (even very unequal ones) and can be desocialised into profit-maximisers (p178). The same problems which were used to reject cooperatives exist just as badly, if not worse! Conclusion: a bit disappointing So, ultimately, I found this book a bit disappointing. There are lots of good ideas, but when presented with a ready-made round wheel for the basic problem of tempering profit maximisation, this book reinvents an oval one. I suppose I shouldn t be surprised. The misleading criticism of cooperatives is sadly typical of much of the current social enterprise movement, which I mentioned as a drawback in the recent case study of our co-op by Cooperatives-UK. I don t know if social enterprise enthusiasts are informed by the thinking of people like Muhammad Yunus, or if the high-profile authors simply reflect the movement. Have you read this book? Did you spot this contradiction? Do you feel it has other problems that I m ignoring? Or is it a work of genius and I shouldn t be disappointed with it?

First I thought a recent xorg update was just not recognising the trackpad and mouse buttons on the Acer Aspire1. Then I thought something was wrong with the Emdebian Grip installation of Squeeze, then I tried upgrading the kernel to 2.6.30 and just now I tried a Graphical Rescue Mode boot of the Lenny Debian Installer.

The trackpad is non-responsive, the mouse buttons are non-responsive. The trackpad still shows up in various system messages but simply doesn't move the pointer or activate any menus. Keyboard shortcuts still work but no mouse. (I gave away my USB mouse but I guess that's the next test.)

Could this be something other than the hardware failure that it appears?

Finally, it happened! I became a Debian Developer! I wish to thank everybody involved in this process: from those who helped me in my initial packaging efforts, to who actually created the account. Many thanks to the pkg-perl team for accepting newbies and helping them: props to Damyan Ivanov, Gregor Herrmann, Gunnar Wolf! Thanks to Debian-Med and Debian CLI: they always believed in me, and I had a great time in these teams. A special thanks goes to Andreas Tille, who advocated my NM candidature. Thanks to my two AMs, Bart Martens and Bernd Zeimetz. Even if my NM was long, difficult and not so flawless, it all went good, at the end . A special thanks to Enrico Zini: he was the first DD signing my GPG key, thus allowing me to have more "rights" (being a DM), and experience some more responsibility than I previously had. Thanks to his "Become a DD. NOW!" right after checking my ID in Palermo -- Enrico, it finally happened! Thanks to Christoph Berg, Ron Lee, and Stephen Gran, which handled the final steps of the overall process. And now, dapal is here to break the world. Be warned!

I know I wrote about Android already today, but there is another thing that concerns me right now. I am owner of an Android-based phone (an HTC Dream) and recently switched my mobile network provider. The problem is that my new provider is a virtual provider and as such there is no real network of that provider. Now Android has a feature to turn off broadband connections when in roaming mode, which itself is a great idea and can save you from paying quite a lot of money when the phone connects to 3G abroad, but this feature also turns off broadband connections when roaming locally. All this is being discussed in bug report #3499. After noticing this problem I became curious on how Android detects that it is roaming and I found the GsmServiceStateTracker.isRoamingBetweenOperators method to be responsible for that magic, but soon noticed that the method is not only inefficient, but also doesn t work as intended. This is hardly related to the bug mentioned above, but let s have a look at the code in question:

/**
* Set roaming state when gsmRoaming is true and, if operator mcc is the
* same as sim mcc, ons is different from spn
* @param gsmRoaming TS 27.007 7.2 CREG registered roaming
* @param s ServiceState hold current ons
* @return true for roaming state set
*/
    private
    boolean isRoamingBetweenOperators(boolean gsmRoaming, ServiceState s)  
        String spn = SystemProperties.get(PROPERTY_ICC_OPERATOR_ALPHA, "empty");
        String onsl = s.getOperatorAlphaLong();
        String onss = s.getOperatorAlphaShort();
        boolean equalsOnsl = onsl != null && spn.equals(onsl);
        boolean equalsOnss = onss != null && spn.equals(onss);
        String simNumeric = SystemProperties.get(PROPERTY_ICC_OPERATOR_NUMERIC, "");
        String operatorNumeric = s.getOperatorNumeric();
        boolean equalsMcc = true;
        try  
            equalsMcc = simNumeric.substring(0, 3).
                    equals(operatorNumeric.substring(0, 3));
          catch (Exception e) 
         
        return gsmRoaming && !(equalsMcc && (equalsOnsl   equalsOnss));
     

Okay, let me summarize what this piece of code does wrong, at least from my understanding:

• It takes both the network operator alphanumeric identifier and alphanumeric long identifier and compares both to the alphanumeric identifier coming from the SIM card, whilst
• it could simply use the network and SIM card numeric identifiers and compare those, which should be a lot cheaper than comparing those strings
• Then it takes the first three characters/digits of the numeric identifiers (which indicate the country) and compares those

Now in my case my SIM card doesn t seem to provide the phone with a alphanumeric identifier, so the first two comparisons always fail for obvious reasons and, looking at the inline-if in the last line of that method my phone will always indicate that I am in roaming mode, even when I am not. The problem is not only the logic which seems to be wrong, but I rather see the inefficient comparisons used there to be a major problem in embedded systems like mobile phones. This is the first piece of Android code I have had a look at, but if all other code is as ugly and inefficient as these few lines Android really needs some major fixes. Related to this I have reported bug #4590 and forked the git repository in question over at github, to fix this method, should be a matter of 5 minutes.

I ve recently been diagnosed with Asperger Syndrome (AS) [1]. Among other things this means that I am genetically predisposed to have an interest in solving technical problems and give lectures about how I solved them, but that I tend not to be a people-person . AS is generally regarded as an Autism Spectrum Disorder (ASD), but there is a lot of debate among the experts about the exact relationship. Some people (such as the psychologist who assessed me) believe that AS is a synonym for High Functioning Autism (HFA), however one theory I ve heard is that HFA people are more sensory oriented and Aspies differ by being information oriented in that case I would not be regarded as HFA. I m not bothered by this issue, I m sure that in a few years time the experts will have some consistent definitions for such things that most people can agree on. There is no Boolean assessment for AS, the assessment is based on a sliding scale of number of criteria. People who are almost Aspies but don t quite pass the test (or more commonly don t get assessed because they don t think they would pass) are sometimes referred to as Asperger Cousins (AC), this is a slang term that is not formally recognised but is often used in online discussions. I m sure that a significant portion of the readers of my blog would regard themselves as being at least ACs if they investigated the issue. The test at Glenn Rowe s web site [2] can give you an idea of how you rate by some criteria but note that this is not at all conclusive and it s based on the theories of Professor Simon Baron-Cohen [3], not all of which have general agreement. Leif Ekblad is running a project to analyse long-term changes to the Aspie score of adults [4]. The main quiz for that project seems quite popular for self-diagnosis, but again it s not conclusive. I think that diagnosing oneself for an ASD is not nearly as crazy as most things which might fall in the category of being one s own psychologist, but I still strongly recommend getting a formal assessment if you believe that you are an Aspie. In Australia it costs about $600 and there s a waiting list of about 3 months. Chaotic Idealism has an insightful post about the pros and cons of self-diagnosis [5], if you suspect that you may be an Aspie then I recommend that you read it before doing the tests.

• [1] http://en.wikipedia.org/wiki/Aspie
• [2] http://www.glennrowe.net/BaronCohen/MaleFemale.asp
• [3] http://en.wikipedia.org/wiki/Simon_Baron-Cohen
• [4] http://www.rdos.net/eng/Aspie-quiz.php
• [5] http://chaoticidealism.livejournal.com/70133.html

I have been reading a great many posts about Android lately, some consisting of criticism, some of praise and some simply addressing issues in the Android community . Let s have a look at those. Matt Porter s Android Mythbusters presentation and Harald Welte s reaction
I haven t seen the presentation live, but I had a look at the slides. Impressing work done by Matt putting all this information together. However, we all knew that Android only (ab-)uses Linux, without making use of the GNU userland for a long time, didn t we? In his presentation Matt has shown things such as Android s udev replacement that uses hardcoded values for device node creation and (on his blog) Harald has then come up with a statement I have found to be very strong:

The presentation shows how Google has simply thrown 5-10 years of Linux userspace evolution into the trashcan and re-implemented it partially for no reason. Things like hard-coded device lists/permissions in object code rather than config files, the lack of support for hot-plugging devices (udev), the lack of kernel headers. A libc that throws away System V IPC that every unix/Linux software developer takes for granted. The lack of complete POSIX threads. I could continue this list, but hey, you should read those slides. now!

Now both of these statements target technical details, but the root of the problem seems to be elsewhere. Where is my Android 2.0? Okay, that heading might not be making any sense in the context of this post at a first glance, but let me elaborate on that. Google and the Open Handset Alliance refer to Android as being an Open Source operating system, but the project is different from real Free Software projects: development takes place in a closed group and the results are shared with the community later on, when they are deemed to be ready. This means that innovation also takes place behind closed curtains and that the community is not involved in the actual development process at all. Lately we have seen the result of that, as Motorola is bragging about working close with Google on Android 2.0 ( Eclair ), but the AOSP source trees, open for everyone to have a look at, show no signs of version 2.0. In fact no changes that might even remotely suggest the release of a new major version have been made public in the past few weeks. So where is the openess there?
Actually, the Motorola Droid has already shipped with Eclair on 6th, but still, there is no indication that Eclair will be made available to the broader public. In short Android seems to be developed behind closed curtains, with hardly (read no) community input whatsoever and is sometimes released as Free Software, not what I would describe as an open development process. The Android Market problem As we have seen in the past Google is enforcing their copyright on proprietary applications that ship with pretty much every Android device, such as the Android Market. This has become really clear when Steve Kondik received a cease and desist letter when packing the Google-proprietary applications into his ROMs. Okay, it s Google s right to enforce their copyright and there is nothing wrong with actually doing so, the thing I really have a problem with is something else: the Market is proprietary. Now what this means should become rather clear. You can have an Android device without Google s proprietary bits, but with default settings you just do not have any way of installing additional software. In my opinion the Market should be freed by Google themselves, or the community has to react and come up with a free replacement to overcome the vendor lock-in. Oh, you might know a replacement called SlideMe (or Mobentoo) already. Well, that bugger is proprietary too, so not a solution at all. Nokia and Maemo to the rescue In most discussions about the openness of Android someone throws in Nokia and Maemo, as a solution to the dilemma. Reading all those positive comments I simply had to give it a try, but all my hopes were destroyed within a few minutes. Let s start with the good news and let alone the reason why my hopes were destroyed for another minute or two. Maemo is based on Debian GNU/Linux and various Free Software components, such as GTK+, gstreamer, esd and friends. Most of the system is Free Software which is a good thing(tm) and reading all of this really got me into Maemo. Okay, some applications seem to be proprietary, but I am sure that could be fixed rather easily, so I could once for all use a truly open phone. and then came the SDK installer shell script:

#!/bin/sh
# Copyright (C) 2006-2009 Nokia Corporation
#
# This is proprietary software owned by Nokia Corporation.
#
# Contact: Maemo Integration <integration@maemo.org>
# Version: $Revision: 1110 $

Now there is one question you should ask yourself: Why would someone trying to promote his platform as being open make the *installer* script for its SDK proprietary? Come on, it s an installer script, how much of your secret juice could be in there? What s the problem with people modifying it and working on this installer script in an open development environment? I had high hopes for Nokia actually doing a bit better than Google, but it seems they ve failed to do so. It may be me overreacting, but a proprietary SDK installer shell script scares me enough not to install the SDK and have a look at it for now nor to think about buying a Maemo-based device in the near future. Please Nokia, either get the facts straight or provide us with a free SDK to your free & open platform. So, in short, Google is bad at working with the community and creating a truly open development process, and Nokia simply fails in terms of not scaring off prospective developers for their open platform with the proprietary SDK installer. Do you have any solutions in terms of an open phone environment, apart from what OpenMoko has come up with?

I wanted to let my readers know that I migrated from my previous hosting to a new one. There was nothing wrong with the previous one, but I wanted to go out shopping for something cheaper and still as reliable. Lots of friends gave me good recommendations for Linode and the price was tempting so I thought : Why not ? . The most noticeable advantage, apart from the price reduction, was the speed improvement, as I got myself a more powerful VPS and then now I have more room for new experiments. Later I also noticed some little but very welcome improvements. These are just minor details, but together they account for a great experience. So, I m here to let you guys now that if you want a good, reliable, speedy, and still cheap hosting provider for your VPS, just give Linode a try. I m sure you won t be disappointed.

Matthias Ettrich, the founder of KDE earned the Bundesverdienstkreuz (Federal Cross of Merit) last Friday for his engagement in open source. How cool is that? Congratulations Matthias and thank you (and all the others) for the K Desktop Environment!

RCBW - week #9 Here is this week squashes, by yours truly:

• 02/11/2009 bug #534040 - mtink - tune po4a threshold to not lack required manpages (fix FTBFS)
• 03/11/2009 bug #554185 - mtink - add missing build-dep on po-debconf
• 04/11/2009 bug #533804 - afnix - drop gcc41/arm support (no longer a release arch)
• 05/11/2009 bug #541572 - elisa-plugins-good - expand dep on python-gnome2-desktop (now gone)
• 06/11/2009 bug #537028 - hpodder - fix build w/ GHC 6.10 (cherry pick upstream fix)
• 07/11/2009 bug #537018 - lhs2tex - fix build w/ GHC 6.10 (use OldException)
• 08/11/2009 bug #536922 - darcs-buildpackage - fix build w/ GHC 6.10 (use OldException)

This week NMUs have been mostly dominated by Haskell's "ambiguous type variable e" squashing.

Earlier this year, my brother and I developed a documentation management server for a small software developing company. They were sick of creating their documentation by sending around Word documents, having to manually merge them, losing changes and not getting a clean, consistent layout.So we created zpub for them: It is based on DocBook and Subversion, and adds a fairly nice web interface to it. Now their work flow is

1. The editor checks out the DocBook source document via Subversion. With a client like TortoiseSVN, this is possible even for the less tech-savvy editor.
2. He works on the document using the editor of his choice. We recommended an editor with a proper DocBook mode such as the XMLMind XML Editor or Serna Free, which was recently published as Free Software, to our customer.
3. When satisfied, he commits his changes via Subversion, adding a comment describing his modifications.
4. On the server, zpub renders the document in the various output formats (.html, .pdf, .chm), and makes the result available via the web interface. The commit messages are put there, and all previous revisions of the document can still be accessed.
5. Optionally, an e-mail about the change is sent out to a per-document configurable list of recipients.
6. Optionally, the documents are rendered with a DRAFT -Watermark on the pages, to avoid leaking wrong revisions to the outside. Only users with extended rights are allowed to release a document, thus causing a version without that watermark to be rendered.

For more details on the feature and usage of zpub, check out the documentation that you can find on the demo instance.We are actually quite satisfied by zpub, and it would be a petty if that was just it. Of course, there are quite a view programs out that that can provide these features plus many more, much more than a company the size of our customer would want to have (or even to worry about). So there is a niche between sending Word documents by mail and buying a very expensive, complicated product where zpub fits in.Being a fan of Free Software myself, and since zpub is based on Free Software, we decided that we want to release zpub itself under a Free License. We chose the EUPL, which is a GPL compatible license created by the European Commission, since our customer comes from a municipal environment. The code is hosted on gitorious now, so if you have a need for zpub, just give it a try.Also, if you run a Free Software project, manage your documentation in DocBook (or want to start to do so) and think that zpub might be a neat idea to allow more documentation writers to contribute, talk to me. I might well offer free hosting in that case. If you are a commercial user, I m still offering hosting (and support or feature development), just not for free any more. Note that the zpub user interface and documentation is currently only available in German.

It is only a few days since my last post about the referendum which is due to happen on the same day as the Presidential elections, but I am forced to make another post because there are lots of incorrect views on the subject.

So let's try take the issues one by one and see what is the problem with every one of them, using reason and the information we have available from more mature democracies than Romania's.

What's the referendum about

The referendum, in this case, is about two issues:

• reducing the number of representatives (deputies and senators)
• transforming the Parliament from a two-chamber Parliament into a one chamber Parliament
  

Information on the subject

For an election such as the referendum (basically asking the population on a subject of national importance) every citizen has the right to be correctly informed about the options of the referendum, what each implies, what are the pros and cons for every option, what problems does the referendum tries to resolve.

There is no information on the subject, no videos, no spots, no fliers, nothing, just biased posters (I'll explain later).

Debate on the subject

In order to have a correct information, a clear public debate which should happen, without the pressure of a presidential campaign at the same time as the debate.


Well, we have no debate, so I guess there is no problem of overlapping (sad, but true), but on the other hand, there is no information on the subject.

Analysis of the options

Now let's analyse the two proposed measures in opposition to the current situation.

1. reducing the number of representatives
• pros
• reducing costs
• minorities have a bigger influence (they can defend their rights - see comments for explanations)
  
• cons
• easier to corrupt (obtaining a corrupt 5% in a 300 seats parliament is easier than in a 500 seats parliament)
  
• minorities have a bigger influence (they are disproportionally powerful, in regard to the population they represent - see comments)
• absence of a representative with a big vote power could allow passing an abusive law (to pass a regular law there is a need of a majority relative to the number of present representatives, not the total number), but, in a numerous parliament, the absence of a person isn't that risky (other colleagues would be present to stop the abusive initiative)
2. one chamber instead of two
   
• pros
  
• faster processing of decisions
• less bureaucratic
  
• cons
  
• in the current system there can be a passive vote (law passes silently if not discussed) which has just one occasion to be caught, while in the current system silent passing is allowed only in one of the chambers, but needs to be discussed in the other
• there is a chance that one chamber might amend/catch abusive initiatives with "two chambers", but with "one chamber" there is one chance only
• more prone to power abuse
  

So, there are pros and cons for all solutions, but now we can make an informed decision and know the risks for each option.

This shouldn't have been taken in haste without any public debate.


I don't want to influence anyone's vote, so I'll abstain from telling my options.

The president has the right to associate his image with one of the options.

OK, let's analyse that.

The law doesn't explicitly forbids this, but there are some recommendations from Venice on fair elections (sorry, I couldn't find the link) which say that in a vote such as the presidential elections there shouldn't be an unfair advantage for one of the candidates. Why is that relevant? Because the current president actually uses the referendum as his campaign and he's speculating people's innate hatred for political figures.

His election material is only comprised of virulent attacks at the representatives or calls to the population to vote in favour of both questions.


Why is that unfair? Because the current president is using his current position (president) as launch ramp for his campaign as a candidate.

OTOH, if the seal of the presidency was used instead his face, the problem wouldn't have been that bad.


Organisational issues

There were various rumours about how the voting will take place. Here is a list of things I heard:

1. there will be a single list for both presidential elections and referendum and there will be a single column for signature to confirm your presence at vote
2. there will be one paper, but two columns for signatures
3. no matter what the list looks like, you'll be given both sets of ballots, but you can annul the one you don't want to vote on

All the variants above are incorrect from a democratic pov, but to different degrees:

1. a single signature covering for either of the vaiants "presidential vote only", "refrendum only", "both" asks for trouble because unused ballots in "only" variants might be added later to the valid votes as if they were expressed by voters; since there is no distinct count for each of the ballots to confront that with signatures, before the counting period one could use unused ballots and vote for you on the issue you didn't want to express an opinion on
   
2. informing on what to do in some cases such as "only" vote is essential to prevent fraud; e.g.: strike through the cell corresponding to the the election you don't want to express a vote on, instead of signing
   
3. giving the ballot unconditionally to everybody, leaving you to decide to annul it or not is abusive, because vote is not compulsory in Romania; more than that, this artificial presence burst (even with void votes) could end up validating the referendum since a 50%+1 presence is needed to pass Constitution modification, as we have here

So, recap:

1. favours fraud by allowing inside people to obtain untraceable/unaccounted ballots
2. preventing fraud isn't of any concern, it seems (and could be achieved)
   
3. forced voting might lead to validation of the referendum because the voting presence is sufficient, even if there are many annuled ballots
   

Vote validation and artificial voter presence

Since validation of a referendum on the changes on the constitution depends on sufficient voter presence (there is some mandatory threshold, but I can't find references now), it is in the interest of people wanting to promote the changes to mobilize people to vote.

By different measures the vote presence at the referendum is artificially increased raising the risk of validation, when people, in fact, wouldn't want to validate it and would, to express neutrality, will be be forced to annul the ballot.

Also, a high presence in the referendum might increase the number of voters for presidency, and the people mobilized this way may have a high chance to be biased in favour of the current president because he associates himself with the violent message against the representatives.

What does it take to implement, if referendum passes

If the referendum passes, the changes aren't immediate. The proposed changes are discussed in the Parliament and a final proposal for the constitution changes is made; after approval of the proposals by the Parliament, the ball goes back to population for final approval.

This means it will take a while to see a changed parliament.

Conclusions

Romania is not a true democracy yet and there are areas where individuals should know what their rights are and not let authorities fool them into buying any argument uncritically.

Romanians must learn their rights so they can't be manipulated whenever somebody wants to trick them into some scheme by knowingly omitting issues and creating insane situations.


Romanians, wake up, learn you have rights, form your own oppinion, as distinct individuals, then we might see a change.

A periodic security review at our co-op suggested switching PasswordAuthentication no on even more hosts. One of those caused a bit of a heated discussion about the benefits of increased security and the drawbacks of making emergency access harder, reminding me of the old joke about a secure computer being one encased in a block of concrete, not connected to anything and buried in a secret location. More usefully, I found a Discussion summary on improving SSH which seemed to cover the basics pretty well. It also suggests that nearly two thirds of all SSH private keys were stored on disk with no password protection which is scary and can server admins even detect that sort of risky behaviour? One thing I ve not really noticed before is how common brute-force ssh attacks are. There are some denyhosts statistics which make interesting pictures and Strong passwords no panacea as SSH brute-force attacks rise summarises some data from last year. So what can we do? libpam-cracklib seems like a first step, along with denyhosts. While searching around, I noticed sslh ssl/ssh multiplexer which looks like a useful trick that I might try somewhere. It entered debian testing earlier this week and looks simple to backport to the stable version. What tips would you give? Do you think it s worth having at least one reasonably secure host with PasswordAuthentication enabled, just in case of disasters disabling private keys? Are you a fan of port-knocking and other more sophisticated things? Do you know more numbers about ssh security?

Techcrunch wrote recently an enlightening article about Scam ads in social games.

Irony is the techcrunch article itself showing scam banners as well: