A common way to debug a network server is to use 'telnet' or 'nc' to connect to the server and issue some commands in the protocol to verify whether everything is working correctly. That obviously only works for ASCII protocols (as opposed to binary protocols), and it obviously also only works if you're not using any encryption. But that doesn't mean you can't test an encrypted protocol in a similar way, thanks to openssl's s_client:

wouter@country:~$ openssl s_client -host samba.grep.be -port 443
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDXDCCAsWgAwIBAgIJAITRhiXp+37JMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5ncmVwLmJlMR0wGwYJKoZI
hvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTAeFw0wNTA1MjEwOTMwMDFaFw0xNTA1MTkw
OTMwMDFaMH0xCzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQH
EwhNZWNoZWxlbjEUMBIGA1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5n
cmVwLmJlMR0wGwYJKoZIhvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAsGTECq0VXyw09Zcg/OBijP1LALMh9InyU0Ebe2HH
NEQ605mfyjAENG8rKxrjOQyZzD25K5Oh56/F+clMNtKAfs6OuA2NygD1/y4w7Gcq
1kXhsM1MOIOBdtXAFi9s9i5ZATAgmDRIzuKZ6c2YJxJfyVbU+Pthr6L1SFftEdfb
L7MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUtUK7aapBDaCoSFRWTf1wRauCmdowgbAG
A1UdIwSBqDCBpYAUtUK7aapBDaCoSFRWTf1wRauCmdqhgYGkfzB9MQswCQYDVQQG
EwJCRTEQMA4GA1UECBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNV
BAoTC05peFN5cyBCVkJBMRQwEgYDVQQDEwtzdm4uZ3JlcC5iZTEdMBsGCSqGSIb3
DQEJARYOd291dGVyQGdyZXAuYmWCCQCE0YYl6ft+yTAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4GBADGkLc+CWWbfpBpY2+Pmknsz01CK8P5qCX3XBt4OtZLZ
NYKdrqleYq7r7H8PHJbTTiGOv9L56B84QPGwAzGxw/GzblrqR67iIo8e5reGbvXl
s1TFqKyvoXy9LJoGecMwjznAEulw9cYcFz+VuV5xnYPyJMLWk4Bo9WCVKGuAqVdw
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1428 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 65E69139622D06B9D284AEDFBFC1969FE14E826FAD01FB45E51F1020B4CEA42C
    Session-ID-ctx: 
    Master-Key: 606553D558AF15491FEF6FD1A523E16D2E40A8A005A358DF9A756A21FC05DFAF2C9985ABE109DCD29DD5D77BE6BC5C4F
    Key-Arg   : None
    Start Time: 1222001082
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
HEAD / HTTP/1.1
Host: svn.grep.be
User-Agent: openssl s_client
Connection: close
HTTP/1.1 404 Not Found
Date: Sun, 21 Sep 2008 12:44:55 GMT
Server: Apache/2.2.3 (Debian) mod_auth_kerb/5.3 DAV/2 SVN/1.4.2 PHP/5.2.0-8+etch11 mod_ssl/2.2.3 OpenSSL/0.9.8c
Connection: close
Content-Type: text/html; charset=iso-8859-1
closed
wouter@country:~$ 

As you can see, we connect to an HTTPS server, get to see what the server's certificate looks like, issue some commands, and the server responds properly. It also works for (some) protocols who work in a STARTTLS kind of way:

wouter@country:~$ openssl s_client -host samba.grep.be -port 587 -starttls smtp
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDBDCCAm2gAwIBAgIJAK53w+1YhWocMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFjAUBgNVBAMTDXNhbWJhLmdyZXAuYmUwHhcNMDgw
OTIwMTYyMjI3WhcNMDkwOTIwMTYyMjI3WjBgMQswCQYDVQQGEwJCRTEQMA4GA1UE
CBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNVBAoTC05peFN5cyBC
VkJBMRYwFAYDVQQDEw1zYW1iYS5ncmVwLmJlMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQCee+Ibci3atTgoJqUU7cK13oD/E1IV2lKcvdviJBtr4rd1aRWfxcvD
PS00jRXGJ9AAM+EO2iuZv0Z5NFQkcF3Yia0yj6hvjQvlev1OWxaWuvWhRRLV/013
JL8cIrKYrlHqgHow60cgUt7kfSxq9kjkMTWLsGdqlE+Q7eelMN94tQIDAQABo4HF
MIHCMB0GA1UdDgQWBBT9N54b/zoiUNl2GnWYbDf6YeixgTCBkgYDVR0jBIGKMIGH
gBT9N54b/zoiUNl2GnWYbDf6YeixgaFkpGIwYDELMAkGA1UEBhMCQkUxEDAOBgNV
BAgTB0FudHdlcnAxETAPBgNVBAcTCE1lY2hlbGVuMRQwEgYDVQQKEwtOaXhTeXMg
QlZCQTEWMBQGA1UEAxMNc2FtYmEuZ3JlcC5iZYIJAK53w+1YhWocMAwGA1UdEwQF
MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAAnMdbAgLRJ3xWOBlqNjLDzGWAEzOJUHo
5R9ljMFPwt1WdjRy7L96ETdc0AquQsW31AJsDJDf+Ls4zka+++DrVWk4kCOC0FOO
40ar0WUfdOtuusdIFLDfHJgbzp0mBu125VBZ651Db99IX+0BuJLdtb8fz2LOOe8b
eN7obSZTguM=
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1707 bytes and written 351 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 6D28368494A3879054143C7C6B926C9BDCDBA20F1E099BF4BA7E76FCF357FD55
    Session-ID-ctx: 
    Master-Key: B246EA50357EAA6C335B50B67AE8CE41635EBCA6EFF7EFCE082225C4EFF5CFBB2E50C07D8320E0EFCBFABDCDF8A9A851
    Key-Arg   : None
    Start Time: 1222000892
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
250 HELP
quit
221 samba.grep.be closing connection
closed
wouter@country:~$ 

OpenSSL here connects to the server, issues a proper EHLO command, does STARTTLS, and then gives me the same data as it did for the HTTPS connection. Isn't that nice.

I have been thinking about ways to speed multiple remote git on the same hosts. My starting point is mr, which does the job, but is a bit slow. I am thinking about giving up some generality for some speed. In particular it seems like it ought to be possible to optimize for the two following use cases:

• many repos are on the same host
• mostly nothing needs updating.

For my needs, mr is almost fast enough, but I can see it getting annoying as I add repos (I currently have 11, and mr update takes about 5 seconds; I am already running ssh multiplexing). I am also thinking about the needs of the Debian Perl Modules Team, which would have over 900 git repos if the current setup was converted to one git repo per module. My first attempt, using perl module Net::SSH::Expect to keep an ssh channel open can be scientifically classified as "utter fail", since Net::SSH::Expect takes about 1 second to round trip "/bin/true". Initial experiments using IPC::PerlSSH are more promising. The following script grabs the head commit in 11 repos in about 0.5 seconds. Of course, it still doesn't do anything useful, but I thought I would toss this out there in case there already exists a solution to this problem I don't know about.

 
#!/usr/bin/perl
use IPC::PerlSSH;
use Getopt::Std;
use File::Slurp;
my %config; 
eval( "\%config=(".read_file(shift(@ARGV)).")");
die "reading configuration failed: $@" if $@;
my $ips= IPC::PerlSSH->new(Host=>$config host );
$ips->eval("use Git");
$ips->store( "ls_remote", q my $repo=shift;
                       return Git::command_oneline('ls-remote',$repo,'HEAD');
                            );
foreach $repo (@ $config repos ) 
    print $ips->call("ls_remote",$repo);
 

P.S. If you google for "mr joey hess", you will find a Kiss tribute band called Mr. Speed, started by Joe Hess" P.P.S. Hello planet debian!

After releasing a new Free Software project to the world, you may be interested to see it included by the main Linux or Free Software distributions. After all this is the easiest way for end-users to download and install your software.

Here are a couple of technical details that will increase the chances that your project will be picked up by a distribution.
Can I distribute this software?The first question that a distribution maintainer will need to answer is this one: can my distribution legally distribute this piece of software?

There are two ways you can help here:

• Make your chosen license clearly visible (normally in a file called COPYING or LICENSE).


• Include a clear copyright statement in your documentation (inside README for example).

Once your software has past this check, the next question will be of course: does it actually work?
Will it work on my distro?To answer this question, the maintainer will have to install the software and figure out all of the external dependencies that need to be installed at the same time.

Therefore, your tarball should include:

• all of the steps (and exact commands) that are necessary to install your software on a standard Free Software distribution


• a list of the external libraries and tools that your software requires to run

What's changed?Another element that can make life easier for the maintainers of your software in downstream distributions is to include indications of what changes from one release to the next.

One important detail is to use a sane versioning system. In a nutshell, this means:

• Version numbers should always be increasing (e.g. in normal ASCII sorting, 1.0pre1 comes after 1.0).


• Any change to the contents of the tarball should trigger a version bump.


• The difference in version numbers from one version to the next should give an indication of the magnitude (minor v. major) of the change.

Another thing that you should include is a changelog (normally in a file called Changes or ChangeLog). This document will be used by maintainers to decide when to upgrade to a new version and to figure out which bugs may be fixed by the new version. It should contain:

• release date
• version number
• summary of the changes since the last version

Finally, to make sure that distro maintainers don't miss new releases of your software, make sure you sign your project up on Freshmeat and announce new releases there.
Proposing your Package to DistrosOn Debian, the main way that users and upstream developers can suggest packages for inclusion in the archive is through the Debian Bug Tracking system. Bugs are filled against the special wnpp (Work-needed and Prospective Packages) pseudo-package and are titled something like RFP: superfoo -- bringing more foo to the desktop where RFP stands for "Request For Package".

Alternatively, if you are a Debian/Ubuntu user, you may also want to build and maintain the package yourself. In which case, you will need to find a sponsor.

Other distributions have different procedures. Feel free to leave a comment explaining what these may be.

More detailed information on getting packaged for Debian is available on the Debian wiki.

Hectic days... The last l10n teams are waking up and alarming messages seem to be sent in various places after my various blog posts, messages to lists, private messages, etc. (I think that the only place where I haven't yelled out for D-I translations is the street I live in). As of now, 7 languages are still in danger to be de-activated: Amharic, Estonian, Latvian, Macedonian, Northern Sami, Albanian, Tagalog Among these, Latvian and Macedonian should make it: Arangel Angov for Macedonian and Aigars Mahinovs for Latvian will probably complete the required minimum. For others, I'm afraid that Estonian, Albanian and maybe Tagalog will be deactivated. I have to think about it. I will be very sad for all of them if I have to do it. But I haven't got news from these translators for ages and I haven't been able to find any possible backup translator. For Albanian and Tagalog, that's not a surprise. For Estonian, I call this very disappointing. Northern Sami is a special case: this is the language of the Sami people in Norway, teached there in schools and important for DebianEdu...which originated in Norway and has been the pilar of D-I development a few years ago. As finding Sami translators is very difficult, I will probably keep the language (also, because it has a solid backup with Norwegian). Amharic is also special for me. The l10n effort is very specific: the translator works on ships all around the world, from his words, and can only communicate with me when he reaches a harbour. He has also been very committed to reach completeness (which he did) and the translation was only fuzzied by last minute changes in August. I'll probably fight to keep that language in D-I..:-) Still, there's one day left. So if your language is not 100% on D-I statistics for level 1, then try to do something. And, guess what? After the deadline is reached, I'll still have work to do: get as many levels 2-5 translations completed. All of these belong to regular Debian packages so they're not dependent on D-I release schedules!

The strongly connected set of the GPG keys graph contains a bit more than 40000 keys now (yes, that’s a lot of geeks!). I wondered what was the biggest clique (complete subgraph) in that graph, and also of course the biggest clique I was in. It’s easy to grab the whole web of trust there. Finding the maximum clique in a graph is NP-complete, but there are algorithms that work quite well for small instances (and you don’t need to consider all 40000 keys: to be in a clique of n keys, a key must have at least n-1 signatures, so it’s easy to simplify the graph — if you find a clique with 20 keys, you can remove all keys that have less than 19 signatures). My first googling result pointed to Ashay Dharwadker’s solver implementation (which also proves P=NP ;). Googling further allowed me to find the solver provided with the DIMACS benchmarks. It’s clearly not the state of the art, but it was enough in my case (allowed to find the result almost immediately). The biggest clique contains 47 keys. However, it looks like someone had fun, and injected a lot of bogus keys in the keyring. See the clique. So I ignored those keys, and re-ran the solver. And guess what’s the size of the biggest “real” clique? Yes. 42. Here are the winners:

CF3401A9 Elmar Hoffmann
AF260AB1 Florian Zumbiehl
454C864C Moritz Lapp
E6AB2957 Tilman Koschnick
A0ED982D Christian Brueffer
5A35FD42 Christoph Ulrich Scholler
514B3E7C Florian Ernst
AB0CB8C0 Frank Mohr
797EBFAB Enrico Zini
A521F8B5 Manuel Zeise
57E19B02 Thomas Glanzmann
3096372C Michael Fladerer
E63CD6D6 Daniel Hess
A244C858 Torsten Marek
82FB4EAD Timo Weing rtner
1EEF26F4 Christoph Ulrich Scholler
AAE6022E Karlheinz Geyer
EA2D2C41 Mattia Dongili
FCC5040F Stephan Beyer
6B79D401 Giunchedi Filippo
74B11360 Frank Mohr
94C09C7F Peter Palfrader
2274C4DA Andreas Priesz
3B443922 Mathias Rachor
C54BD798 Helmut Grohne
9DE1EEB1 Marc Brockschmidt
41CF0322 Christoph Reeg
218D18D7 Robert Schiele
0DCB0431 Daniel Hess
B84EF12A Mathias Rachor
FD6A8D9D Andreas Madsack
67007C30 Bernd Paysan
9978AF86 Christoph Probst
BD8B050D Roland Rosenfeld
E3DB4EA7 Christian Barth
E263FCD4 Kurt Gramlich
0E6D09CE Mathias Rachor
2A623F72 Christoph Probst
E05C21AF Sebastian Inacker
5D64F870 Martin Zobel-Helas
248AEB73 Rene Engelhard
9C67CD96 Torsten Veller

It’s likely that this happened thanks to a very successful key signing party somewhere in germany (looking at the email addresses). [Update: It was the LinuxTag 2005 KSP.] It might be a nice challenge to beat that clique during next Debconf ;) And the biggest clique I’m in contains 23 keys. Not too bad.

To this… (and I know there are readers of the blog in Manchester and close by who just may be interested in the a one-day seminar and evening lecture on the 1858 cable and later transatlantic communications link). Full details below. ***
2008 marks the 150th anniversary of the first communications link laid beneath 1600 nautical miles of the Atlantic Ocean. That telegraph cable was the first in a series of cutting-edge technologies enabling fast and accurate communication between Britain and the United States of America, linking the old and new worlds. To mark the occasion, the IET in conjunction with the Museum of Science and Industry, Manchester, are holding a one-day seminar and evening lecture on the 1858 cable and later transatlantic communications links, including wireless and satellite, on Tuesday 28th October 2008. Both events are open to the public and admission is free of charge, but pre-booking is a must. The programme is given below. Both events will be held in the Cardwell Theatre, MOSI and there will be a small exhibition on the history of transatlantic communications to accompany the event. To register for the seminar and/or the lecture, please contact Anne Locker (details given at the end of the email). SEMINAR 1000-1030 Arrival and coffee 1030-1045 Bob Martin-Royle :Chairman s welcome, introduction and overview 1045-1115 Neil Barton: First steps to transatlantic - crossing the Irish Sea 1852-1854 1115-1130 Donard de Cogan: Background to the 1858 telegraph cable 1130-1145 Pauline Webb: John Pender and Manchester s contribution 1145-1215 Donard de Cogan: Insights into the landing of the 1858 cable 1215-1230 Pat Wilson: Lord Kelvin s contribution to submarine telegraphy 1230-1300 Questions and discussion 1300-1400 Lunch 1400-1430 Bob Martin-Royle: Marconi and the first transatlantic wireless links 1430-1515 Phil Kelly: TAT1 (includes film) - the first telephone cable 1515-1545 Tea 1545-1615 Des Prouse: Telstar - the birth of transatlantic satellite communications 1615-1630 Transatlantic communications: the present and future 1630-1700 Questions, discussion and closing remarks EVENING 1800-1830 Light refreshments 1830-1930 Nigel Linge: An interactive public lecture on The Transatlantic Telegraph Cable - the birth of global communications 1930- 2000 Questions and closing remarks Regards, Anne Locker
IET Archivist The Institution of Engineering and Technology
IET

Savoy Place
London
WC2R 0BL
United Kingdom

Being an American guy married to an Italian woman and living in Austria, I don't really have a problem with "globalization". Actually, I'm something of a fan, which is one reason I'm disappointed in the globalization of Amazon's services. If you order a book from Amazon.com in the US, it will be shipped to you from the nearest shipment center. If you go to a large site like Google, Microsoft, or Yahoo, it's quite likely that they provide services in your language. Amazon, however, appears to be completely split up along country lines. Your amazon.com account is completely seperate from your amazon.co.uk account, and amazon.de isn't even available in English! This completely violates the sensible reasoning behind the two features outlined above. If you're somewhere like Italy or Denmark or Eastern Europe, you should be able to log in to amazon.com, in your language, order a book, and have it shipped from the nearest shipping center. Instead, you have to log in to each site (they don't share account info), which is only available in one language. So, for instance, an English speaking guy in Austria wanting to order books from the nearest country with an Amazon site goes to amazon.de and finds that there is no option to get the site in English. If I want to order from amazon.co.uk I have to enter all my login information from amazon.com again, and don't get the same recommendations and other features that come from Amazon knowing about my purchasing history.

I have just installed Domain Key Identified Mail (DKIM) [1] on my mail server. In summary the purpose is to allow public-key signing of all mail that goes out from your domain so that the recipient can verify it’s authenticity (and optionally reject forgeries). It also means that you can verify inbound mail. A weakness of DKIM is that it is based on the DNS system (which has many issues and will continue to have them until DNSSEC becomes widely adopted). But it’s better than nothing and it’s not overly difficult to install. The first thing to do before installing DKIM is to get a Gmail account. Gmail gives free accounts and does DKIM checks. If you use Iceweasel or another well supported browser then you can click on “Show Details” from the message view which then gives fields “mailed-by” and “signed-by” which indicate the DKIM status. If you use a less supported browser such as Konqueror then you have to click on the “Show Original” link to see the headers and inspect the DKIM status there (you want to see dkim=pass in the Authentication-Results header). Also Gmail signs outbound mail so it can be used to test verification of received mail. The next thing to do is to install the DKIM Milter. To make things exciting this is packaged for Debian under the name dkim-filter so that reasonable searches for such functionality (such as a search for milter or dkim-milter - the upstream project name) will fail. After installing the package you must generate a key, I used the command “dkim-genkey -d coker.com.au -s 2008” to generate a key for my domain. It seems that the domain is currently only used as a comment but I prefer to use all reasonable parameters for such things. The -s option is for a selector, which is a way of specifying multiple valid signing keys. It’s apparently fairly common to use a different key every year. But other options include having multiple mail servers for a domain and giving each one a selector. The dkim-genkey command produces two files, one is named 2008.txt and can be copied into a BIND zone file. The other is named 2008.private and is used by the DKIM signing server. Here is a sample of the most relevant parts of the config file /etc/dkim-filter.conf for signing mail for a single domain: Domain coker.com.au
KeyFile /etc/dkim/2008.private
Selector 2008 The file /etc/default/dkim-filter needs to be modified to specify how it will listen for connections from the MTA, I uncommented the line SOCKET=”local:/var/run/dkim-filter/dkim-filter.sock”. One issue is that the Unix domain socket file will by default not be accessible to Postfix, I devised a work-around for this and documented it in Debian bug report #499364 [2] (I’ve hacked a chgrp command into the init script, ideally the GID would be an option in a config file). A basic configuration of dkim-milter will sign mail for one domain. If you want to sign mail for more than one domain you have to comment out the configuration for a single domain in /etc/dkim-filter.conf and instead use the option KeyList file to specify a file with a list of domains (the dkim-filter.conf(5) man page documents this). The one confusing issue is that the selector is taken to be the basename of the file which contains the secret key (they really should have added an extra field). This means that if you have an obvious naming scheme for selectors (such as the current year) then you need a different directory for each domain to contain the key. As an example here is the line from the KeyList file for my domain:
*@coker.com.au:coker.com.au:/etc/dkim/coker.com.au/2008 Now one problem that we have is that list servers will usually append text to the body of a message and thus break the signature. The correct way of solving this is to have the list server sign the mail it sends out and have a header indicating the signature status of the original message. But there are a lot of list servers that won’t be updated for a long time. The work-around is to put the following line in /etc/dkim-filter.conf:
BodyLengths yes This means that the signature will cover a specified number of bytes of body data, and any extra which is appended will be ignored when it comes time to verify the message. This means of course that a hostile third party could append some bogus data without breaking the signature. In the case of plain text this isn’t so bad, but when the recipient defaults to having HTML email it could have some interesting possibilities. I wonder whether it would be prudent to configure my MUA to always send both HTML and plain-text versions of my mail so that an attacker can’t append hostile HTML. It’s a pity that Gmail (which appears to have the most popular implementation of DKIM) doesn’t allow setting that option. So far the only message I have received that failed DKIM checks was sent from a Gmail account to a Debian mailing list. Ideally it would be possible to have the messages sent to mailing lists not be signed or have the length field used. That would require a signing practice based on recipient which is functionality is not available in dkim-milter (but which possibly could be implemented as Postfix configuration although I don’t know how). Implementing this would not necessarily require knowing all the lists that mail might be sent to, it seems that a large portion of the world’s list traffic is sent to addresses that match the string “@lists.” which can be easily recognised. For a service such as Gmail it would be easy to recognise list traffic from the headers of received messages and then treat messages sent to those domains differently. As the signature status is based on the sending address it would be possible for me to use different addresses for sending to mailing lists to avoid the signatures (the number of email addresses in use in my domain is small enough that having a line for each address to sign will not be a great inconvenience). Most MUAs have some sort of functionality to automatically choose a sender address that is in some way based on the recipient address. I’ll probably do this eventually, but for the moment I’ll just use the BodyLengths option, while it does reduce the security a bit it’s still a lot better than having no DKIM checks.

• [1] http://en.wikipedia.org/wiki/Dkim


• [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499364

Share This

Dear lazyweb, I need a tool to mirror a website locally (so I can browse it offline). Requirements:
- not GUI-based (I want to run it in a script)
- support recursive retrieval and include/exclude lists (like wget)
- no output when everything is fine, but still output errors (not possible with wget, which still output “basic information” when running with –no-verbose, and doesn’t output errors when running with –quiet)
- understands timestamps, and retransfers files if timestamps or sizes don’t match
- not too over-engineered, not too badly maintained, etc… Thank you.

For a long time publishing source code under a freedom giving license was considered bad. What if people would take your code and reuse it? What if you don't like how they reuse it? History has shown that this has happened in only rare cases. And even then, having your code reused is an homage towards your creation. People started to understand that and it gladly became very common practise. But it seems like the story starts over from the very beginning again, the field though is a different one. It's now graphic artists and especially musicians who are facing the same fears this time. But I think, it shouldn't be me writing this because I'm neither (well, only very few people consider ASCII art as proper art. Probably even less than consider good code to be art..). Good thing is, I don't have to. One of the wesnoth graphic artists did it, and way better than I would ever be able to get the idea across. So here you go: Jetryl about GPL Policy in wesnoth. It might be long, but it's definitely worth the read, and I hope it will help to make some people understand better and fear less.

I'm currently fighting with MySQL. The following takes too long:

mysql> SELECT COUNT(id) FROM q_archive;
+-----------+
  COUNT(id)  
+-----------+
    2738048  
+-----------+
1 row in set (17.95 sec)

I would like it to take significantly less time, even with memcached being in use it gets hit too often. I've added an index to the table - but I didn't expect that to help, and I wasn't disappointed. Ho hum. Maybe another case where flat-files are best. Sure counting them would take a while, but once I've counted them I can just cat sum . This is probably a case where tweaking memory of MySQL would help. But I'm fairly certain if I start messing with that I'll get into trouble with other parts of my site. ObFilm: The Evil Dead

stew has announced on the Debian NYC social list the bug squashing party to happen in his place at Brooklyn, NY. If you are around the area and willing to attend, write your name down on the wiki page and get ready to be rewarded by home-brewed beer and grilled bounties per squashed RC bug! stew also offers sleeping facilities in case you need it.

Many people that know me, know how fond of my music collection I am. They quickly notice that my CDs are sorted alphabetically with precise rules (surnames first, articles ignored, etc), and that with my digitalised music I'm almost obsessive. All my 50+ gigs of compressed music follow a precise filesystem scheme, with a metadata file on each album in XMCD format and I also have my toolcase of shell scripts to rename files, look up in the freedb database, etc. Those scripts also were meant to tag the MP3 files, but I never cared about it, since all the data was in the filesystem, and also because ID3v1 —which is still the only thing mp3info understands— is the shite, and doesn't allow for long titles, not any other useful data. I never bothered to even add OGG tagging. (Before you mention it, transcoding audio to get rid of MP3 is not an option, that'd require a re-riping everything from scratch). If I chdir into Waits, Tom/(1973) Closing time —for example— and type mplayer *, It Just Works . But this new trend of tag-based music players, made for people that cannot order their music, annoys me to no end. In most of them, there's no way of telling the thing to stop trying to be smart! So if you're writing an audio player, pretty please, with sugar on top, remember that some of you users can know better, and provide an option to disable any non-filename-based sorting. Today I made my world a better place by patching decibel-audio-player, which was a minor offender (the sorting was only done when adding directories to the playlist). The media players on my gorgeous Nokia n810 are a total pain in the ass, and would require a lot more work to "dumb" them down. Al least it's free software. Tags: Planet Debian, Planet Lugfi, M sica, OCD

When I was in Montreal in August, I got to spend some time with Simon Law, one of the first Free Software/Debian developers I met in full flesh and blood back in 2002. In August he was a bit worn but there was a definite sparkle in his eye. He was working at a new company doing some interesting development but he could not reveal just what had been up to. Just recently he clued me into what he was spending his night, days, and dreams working on. I have to admit, I am at once intrigued, puzzled, and surprised by this new reality based game, which won’t fully come out until 2009 but they are accepting beta testers. As you can read here, Akoha it is a social reality game which uses real world, mobile, and web technologies to engage people in game, play, and do-good type activities. As many others have written about, games are not just about play but they are economically lucrative enterprises. But economies are not only built around finances, money, and gold but can be moral economies based on reputation and also doing good. Akoha is thus directing the energies of fun and play in a combined digital and non-digital environment to build up just this playful moral economy. I look forward to seeing its path develop once it is finally released. If you are still confused as to what Akoha is, this video will shed some additional light on this social experiment.

The Firefox EULA debacle is over. While this is nice, especially because they retracted, there are several things at stake here.

• Something is obviously fishy in all this. On one hand, Mark Shuttleworth claims:
  

  Mozilla Corp asked that (the EULA) be added in order for (Ubuntu) to continue to call the browser Firefox.

  On the other hand, Mozilla claims all over the place that the EULA text was a mistake. Couldn’t they think more about what they’re demanding from distributors before asking them stupid things ?
• It’s not the first time Mozilla approaches a distro to ask them to comply to new demands, and create a controversy, a burden or a real PITA. What is going to come next ?
• From my bug reporter point of view, the way Mozilla handled it can be seen like this: when the Debian nutcases complain about the EULA being shown in “Open Source builds”, it’s not a problem, and the EULA is actually necessary. When bad press comes about the same EULA because the big player that Ubuntu is starts rebelling, it becomes an important mistake. I just hope this feeling is wrong.

Update: there is a nice article on the EULA issue on Groklaw.

Last week I wondered how much space a complete git conversion would actually need—and I was quite surprised:

$ du -hs webwml*
325M    webwml
416M    webwml.git
819M    webwml.svn

The first line is the regular CVS checkout. The third line is the SVN checkout that's available from alioth. You can see that the size is not really something one would want, especially since the real gain is extremely little: besides offline diff you rather have disadvantages with not being able to do much offline because anything history wise requires you to be online. In CVS you at least knew that revision 1.12 of a file is three commits above revision 1.9 of the same file; while in SVN you have no chance offline to know how many commits to a file happened between revision 512 and 1024, if any at all. The conversion to git took me quite a long time, practically almost three days of (non-constant) running git-cvsimport on my laptop. The time did not completely surprise me, at least when I noticed in the end that it were well over 83 thousand commits in well over 10 years, reaching back to July 1998. My first own commit was in July 2001, which wasn't too hard to find out with git neither, and required no online operation. git gives you complete offline access to the history. This is actually something that the build process can be based on. There propably will be some speed drawback with not being able to do simple-math for revision difference like in CVS, but that actually will have to be checked. I'm still convinced being able to do all the stuff offline without any strange hacks or needing to be online all the time is something worthwhile. Things left to do and which I propably won't find the time in the too near future because of ... erm, you know? Lenny? That we want to release? But anyway, to not have the list of things get lost, here is a (not complete) list of things in case you are bored and want to play around a bit:

• Adapt the various scripts to not check CVS revisions but use the sha1 sums.
• Adjust translation-check translation="" value for all files to use sha1 sums.
• Check wether a full website build would work after that changes.
• Try out how submodules work and wether they might be reasonable to use for language subdirectories to allow translators partial checkouts.
• ... other things I've forgotten but that could be added to the WebsiteVCSEvalutaion wiki page.

Playing around a bit? Well, you don't have to do the whole git-cvsimport on yourself: I've pushed my webwml.git repository to alioth: "git clone ssh://git.debian.org/git/users/alfie/webwml.git" should get you started. Please notice to play around in a seperate branch and not directly in origin to be able to pull further and update from time to time.

I just receive The Mail (tm) from weasel, and I can't be happier that this (mh, is my life too boring?): I just become a DD!!!!!!! Please join my happiness in this achievement!!

I'd like to thank all the people helped me in my way to Debian, both for a long and fruitful collaboration or for just a mail exchange, both for kind people and rude ones (ah, we all have our own character, so never mind :) ) and in doing this I'm sure I'll forget someone (so please excuse me for this, you're in my mind tough): so thank you Tony, Bernd, Piotr, Thomas, Vincent, Adeodato, Lucas, Luk, Sune, Joerg (yeah, I'm brave :) ), Paul, and many others!

Of course, congrats go also to my other colleagues that "laureate" with me in Mid September DD Class :D

The most commonly installed software for aggregating RSS feeds seems to be Planet and Venus (two forks of the same code base). The operation is that a cron job runs the Python program which syndicates a list of RSS feeds and generates a static web page. Of course the problems start if you have many feeds as polling each of them (even the ones that typically get updated at most once a week) can take a while. My experience with adding moderate numbers of feeds (such as all the feeds used by Planet Debian [1]) is that it can take as much as 30 minutes to poll them all - which will be a problem if you want frequent updates. Frequent polling is not always desired, it means more network load and a greater incidence of transient failures. Any error in updating a feed is (in a default configuration) going to result in an error message being displayed by Planet, which in a default configuration will result in cron sending an email to the sysadmin. Even with an RSS feed being checked every four hours (which is what I do for my personal Planet installations) it can still be annoying to get the email when someone’s feed is offline for a day. Now while there is usually no benefit in polling every 15 minutes (the most frequent poll time that is commonly used) there is one good reason for doing it if you can only poll. The fact that some people want to click reload on the Planet web page every 10 minutes to look for new posts is not a good reason (it’s like looking in the fridge every few minutes and hoping that something tasty will appear). The good reason for polling frequently is to allow timely retraction of posts. It’s not uncommon for bloggers to fail to adequately consider the privacy implications of their posts (let’s face it - professional journalists have a written code of ethics about this, formal training, an editorial board, and they still get it wrong on occasion - it’s not easy). So when a mistake is made about what personal data should be published in a blog post it’s best for everyone if the post can be amended quickly. The design of Planet is that when a post disappears from the RSS feed then it also disappears from the Planet web page, I believe that this was deliberately done for the purpose of removing such posts. The correct solution to the problem of amending or removing posts is to use the “Update Services” part of the blog server configuration to have it send an XML RPC to the syndication service. That can give an update rapidly (in a matter of seconds) without any polling. I believe that a cron job is simply the wrong design for a modern RSS syndication service. This is no criticism of Planet (which has been working well for years for many people) but is due to the more recent requirements of more blogs, more frequent posting, and greater importance attached to blogs. I believe that the first requirement for a public syndication service is that every blogger gets to specify the URL of their own feed to save the sysadmin the effort of doing routine URL changes. It should be an option to have the server act on HTTP 301 codes and record the new URL in the database. Then the sysadmin would only have to manage adding new bloggers (approving them after they have created an account through a web-based interface) and removing bloggers. The problem of polling frequency can be mostly solved by using RPC pings to inform the server of new posts if the RPC mechanism supports removing posts. If removing posts is not supported by the RPC then every blog which has an active post would have to be polled frequently. This would reduce the amount of polling considerably, for example there are 319 blogs that are currently syndicated on Planet Debian, there are 60 posts in the feed, and those posts were written by 41 different people. So if the frequent polling to detect article removal was performed for active articles, given the fact that you poll the bloggers feed URL not the article that would only mean 41 polls instead of 319 - reducing the polling by a factor of more than 7! Now even with support for RPC pings there is still a need to poll feeds. One issue is that feeds may experience temporary technical difficulty in sending the RPC as we don’t want to compel the authors of blog software to try and make the ping as reliable a process as sending email (if that was the requirement then a ping via email might be the best solution). The polling frequency could be implemented on a per-blog basis based on the request of the blogger and the blog availability and posting frequency. Someone who’s blog has been down for a day (which is not uncommon when considering a population of 300 bloggers) could have their blog polled on a daily basis. Apart from that the polling frequency could be based on the time since the last post. It seems to be a general pattern that hobby bloggers (who comprise the vast majority of bloggers syndicated in Planet installations) often go for weeks at a time with no posts and then release a series of posts when they feel inspired. In terms of software which meats these requirements, the nearest option seems to be the the Advogato software mod_virgule [2]. Advogato [3] supports managing accounts with attached RSS feeds and also supports ranking blogs for a personalised view. A minor modification of that code to limit who gets to have their blog archived, and fixing it so that a modified post only has the latest version stored (not both versions as Advogato does) would satisfy some of these requirements. One problem is that Advogato’s method of syndicating blogs is to keep an entire copy of each blog (and all revisions). This goes against the demands of many bloggers who demand that Planet installations not keep copies of their content for a long period and not have any permanent archives. Among other things if there are two copies of a blog post then Google might get the wrong idea as to which is the original. Does anyone know of a system which does better than Advogato in meeting these design criteria?

• [1] http://planet.debian.org/


• [2] http://www.advogato.org/proj/mod_virgule/


• [3] http://www.advogato.org/

Share This

We got a lot of (>= 10) new Debian developers recently. I’m really happy to see that the bottlenecks in the New Maintainer process were (at least partially) solved. My first NM (actually my second, my first one is on hold) also became a DD today. So, how long does it take to become a DD ? Let’s take 2 examples. Both are very active and skilled new contributors, that probably were quite close from being the faster you can be through NM:

Name	Applied	AM assigned	Approved by AM	Account created
Chris Lamb	2008-05-01	2008-06-12	2008-07-22	2008-09-16
Sandro Tosi	2008-03-24	2008-05-06	2008-06-22	2008-09-16

We have the proof: provided you have all the required skills, you can become a DD in less than 6 months! Of course, some things are not perfect yet:

• A lot of very good contributors are waiting for an AM, because not enough DDs volunteer to be AMs.
• Some NMs still take too long to answer questions, using AMs that could probably mentor faster NMs. If your AM is waiting for you, feel guilty now!
• Front Desk and DAM are still managed by a small set of very active (and very busy elsewhere) DDs. Many of the new DDs were FD-approved and DAM-approved by the same person, which is not so great if we want to keep this two-steps check.