One ongoing problem with TCP networking is the combination of RPC services and port based services on the same host. If you have an RPC service that uses a port less than 1024 then typically it will start at 1023 and try lower ports until it finds one that works. A problem that I have had in the past is that an RPC service used port 631 and I then couldn’t start CUPS (which uses that port). A similar problem can arise in a more insidious manner if you have strange networking devices such as a BMC [1] which uses the same IP address as the host and just snarfs connections for itself (as documented by pantz.org [2]), this means that according to the OS the port in question is not in use, but connections to that port will go to the hardware BMC and the OS won’t see them. Another solution is to give a SE Linux security context to the port which prevents the RPC service from binding to it. RPC applications seem to be happy to make as many bind attempts as necessary to get an available port (thousands of attempts if necessary) so reserving a few ports is not going to cause any problems. As far as I recall my problems with CUPS and RPC services was a motivating factor in some of my early work on writing SE Linux policy to restrict port access. Of course the best thing to do is to assign IP addresses for IPMI that are different from the OS IP addresses. This is easy to do and merely requires an extra IP address for each port. As a typical server will have two Ethernet ports on the baseboard (one for the front-end network and one for the private network) that means an extra two IP addresses (you want to use both interfaces for redundancy in case the problem which cripples a server is related to one of the Ethernet ports). But for people who don’t have spare IP addresses, SE Linux port labeling could really help.

• [1] http://en.wikipedia.org/wiki/Baseboard_management_controller


• [2] http://www.pantz.org/hardware/ipmi/ipmiconflictwithrpc.html

Share This

Today, among all the other things I accomplished, I converted the rest of the system templates for the eyrie.org systems to Git and tweaked my personal configuration management system to make better use of Git's features to push data around. I was feeling on a productive roll, so I also wrote up the system I use. This system has a long history. The first commit in the underlying repository for my personal workstation is dated September of 1998, and the underlying system was already in use at Stanford before I started working here more than 15 years ago. It survived several major OS changes and several significant reorganizations and only recently has been replaced for day-to-day server management by Puppet. We still use bundle to do some of the initial system configuration inside FAI before the system is put together enough to run Puppet. Puppet is overkill for a few personal systems, so the system I'm using is based on our previous revision of our server template system, with some modifications to not depend on AFS and to make remote deployment of changes easier and simpler. It's not as fancy as some of the new ideas for managing all of /etc in a VCS, but it's been reliable and capable enough for me that the core of the system remains unchanged after ten years.

Following my last blog post, Moritz Muehlenhoff sent me another statistical list in a desperate attempt to prove that there is no german cabal. As usual, when counting antyhing per inhabitant in IT, Finland wins:

   241890 Finland
   361500 Switzerland
   398766 Norway
   401033 Sweden
   426800 New Zealand
   489205 Austria
   492322 Germany
   612857 Australia
   713415 Netherlands
   795965 France
   814194 Belgium
   834800 Canada
   871071 United Kingdom
   912631 Denmark
  1102457 Spain
  1196289 Ireland
  1255125 Hungary
  1369233 United States
  1456400 Israel
  1484500 Croatia
  1737487 Czech Republic
  1738889 Uruguay
  1806645 Italy
  1910059 Bulgaria
  2270700 Latvia
  3369600 Lithuania
  3539191 Portugal
  3640956 Japan
  3811600 Poland
  4133884 Costa Rica
  5379455 Slovakia
  5608354 Greece
  6779558 Argentina
 10410773 Brazil
 11975000 South Africa
 14695666 Colombia
 12261197 Korea, Republic of
 16598074 Chile
 20042551 Madagascar
 20286976 Russian Federation
 22246862 Romania
 28199822 Venezuela
 28220764 Peru
 35293128 Turkey
 53341250 Mexico
 75360000 Egypt
226489200 India
330462972 China

Indeed, the best proof that there is no german cabal is that, IIRC, "they" never succeeded in having one of "theirs" elected a DPL. This is probably the best proof that there isn't ONE german cabal, but probably more... Beware of "them", "they" are everywhere.

Apologies to anyone bored of this topic but it is something I have been thinking about recently. You have people commenting on why Banks are special and need government funded bailouts. Others arguing that the Free market is not dead. We have even have a few solutions from some people within the Free Software community. I think the first thing is to identify who should lose, and who should win.

• Investors should lose.
• Customers should win.

Much of the annoyance about the rescue from ordinary people is that it seems that investors are not losing (enough). They took some risks, those gambles failed, and now everyone else is paying the price. If IBM were to go bankrupt, would the government step in? Unlikely. Investors would lose (money), staff -- another word for investors -- would lose (jobs), but customers would win (their computers would keep working). Some customers would win more than others (especially those who had the equipment on lease); if no one is collecting, why pay?. So let's apply the same set of outcomes to banks.

• Borrowers would win, since they are living in a mortgaged house.
• Investors lose, since no one will buy their shares (no matter how cheap they are)
• Tax payers win, since they are not rescuing a particular industry sector

But hang on, you rightly ask, - a bank has the title deed (a mortgage is a promise to pay amount X over Y year in return for the deed) - why would customers (depositors), realising a bank is no longer viable, since remove their funds I think that those two issues can be addressed fairly simply. The government would guarantee all depositors money. Customers never lose. They never have to worry about their funds. For banks, who enter into administration, the standard laws about possession should apply. If a borrower is utilising (living in) the asset to which the bank has title for over Z years (where Z equals 5 or 7), then the possesor now owns it outright. That is plenty of time for a bank to either be bought, have the underlying asset value recalibrated, or to completely go bust. All without a detrimental effect.

Some time back, I wrote up our current best practices in the Stanford central UNIX support group for managing Debian servers, and some time before that, I wrote up some notes on useful Debian package build tools. Both of those pages had become hopelessly out of date. Over the past week, I've been revising them, and they should now reflect reality somewhat better. Notable in the changes to the build tools document is a switch from debarchiver to reprepro. I haven't finished doing that migration for my personal repository, but I'm most of the way through and hope to be able to pull the trigger fairly soon. I like debarchiver and have used it for years, but reprepro supports a pool structure and package migration between distributions, both of which are killer features. We're going to be switching to reprepro for Stanford's internal archives as well, although probably not until sometime in November or December. I also moved the documentation I had for packaging individual scripts into a separate document and updated it to reflect the fact I use Git now instead of Subversion. Most of the details here are fairly straightforward and obvious, but I find it useful to read through something like this and see how someone else approaches a problem. Maybe someone else will find bits of it useful.

A small discussion on IRC triggerred this (from Debian LDAP): Number of DDs per country:

United States : 348
Germany : 197
United Kingdom : 97
France : 96
Canada : 56
Australia : 56
Spain : 49
Japan : 41
Italy : 40
Netherlands : 38
Sweden : 34
Finland : 27
Austria : 22
Switzerland : 21
Brazil : 19
New Zealand : 14
Poland : 13
Norway : 13
Belgium : 13
Hungary : 12
South Africa : 8
Denmark : 8
China : 8
Russian Federation : 7
Ireland : 7
Argentina : 7
Korea, Republic of : 6
Israel : 6
Czech Republic : 6
India : 5
Portugal : 4
Bulgaria : 4
Croatia : 3
Greece : 3
Colombia : 3
Uruguay : 2
Turkey : 2
Romania : 2
Mexico : 2
Egypt : 2
Venezuela : 1
Thailand : 1
Slovakia : 1
Peru : 1
Madagascar : 1
Latvia : 1
Lithuania : 1
Costa Rica : 1
Chile : 1

Number of active DDs per country:

United States : 223
Germany : 167
France : 81
United Kingdom : 70
Spain : 41
Canada : 40
Japan : 35
Australia : 35
Italy : 33
Sweden : 23
Netherlands : 23
Finland : 22
Switzerland : 21
Brazil : 18
Austria : 17
Belgium : 13
Norway : 12
Poland : 10
New Zealand : 10
Hungary : 8
Russian Federation : 7
Denmark : 6
Czech Republic : 6
Argentina : 6
India : 5
Israel : 5
Ireland : 5
South Africa : 4
Korea, Republic of : 4
China : 4
Bulgaria : 4
Portugal : 3
Croatia : 3
Colombia : 3
Uruguay : 2
Turkey : 2
Mexico : 2
Greece : 2
Venezuela : 1
Slovakia : 1
Romania : 1
Peru : 1
Madagascar : 1
Latvia : 1
Lithuania : 1
Egypt : 1
Costa Rica : 1
Chile : 1

It seems someone has figured out where in Canada it is worth strategically voting. So take a look to see if you live in an important riding.

I wonder if it is worth setting up a counter website that says if you live in a riding where the Tories, Grits or Bloc are almost certain to win, then you can vote to give the NDP or Greens money. Remember your vote is worth C$6.

The Omelette Post by Atul Chitnis provoked a lot of discussion and Christian Perrier's response explains the objections clearly. I disagree with them both in different ways. Hence this post. Atul Chitnis is not known for his politeness (unfortunately, like many in the FLOSS community). In such cases, it is best to try to understand the (positive) intent behind the words written rather than concentrate on the words themselves --- the current kabab mein haddi seems to be "low-hanging fruit". I agree with Christian that finding, analysing and fixing bugs ranks up there along with writing programs; especially since many of today's programmers continue to be ''bug-generators'' in the sense of (and in spite of) Dijkstra's article. My reading of the Omelette Post is that hacking should take precendence over talking at FOSS.in 2008 --- a sentiment that I find quite palatable and even tasty! So let's see if we can have a Debian Workout at FOSS.in 2008.

The first thing you need to do to get started using the Amazon Elastic Compute Cloud (EC2) [1] is to install the tools to manage the service. The service is run in a client-server manner. You install the client software on your PC to manage the EC2 services that you use. There are the AMI tools to manage the machine images [2] and the API tools to launch and manage instances [3]. The AMI tools come as both a ZIP file and an RPM package and contain Ruby code, while the API tools are written in Java and only come as a ZIP file. There are no clear license documents that I have seen for any of the software in question, I recall seeing one mention on one of the many confusing web pages of the code being “proprietary” but nothing else. While it seems most likely (but far from certain) that Amazon owns the copyright to the code in question, there is no information on how the software may be used - apart from an implied license that if you are a paying EC2 customer then you can use the tools (as there is no other way to use EC2). If anyone can find a proper license agreement for this software then please let me know. To get software working in the most desirable manner it needs to be packaged for the distribution on which it is going to be used, as I prefer to use Debian that means packaging it for Debian. Also when packaging the software you can fix some of the silly things that get included in software that is designed for non-packaged release (such as demanding that environment variables be set to specify where the software is installed). So I have built packages for Debian/Lenny for the benefit of myself and some friends and colleagues who use Debian and EC2. As I can’t be sure of what Amazon would permit me to do with their code I have to assume that they don’t want me to publish Debian packages for the benefit of all Debian and Ubuntu users who are (or might become) EC2 customers. So instead I have published the .diff.gz files from my Debian/Lenny packages [4] to allow other people to build identical packages after downloading the source from Amazon. At the moment the packages are a little rough, and as I haven’t actually got an EC2 service running with them yet they may have some really bad bugs. But getting the software to basically work took more time than expected. So even if there happen to be some bugs that make it unusable in it’s current state (the code for determining where it looks for PEM files at best needs a feature enhancement and at worst may be broken at the moment) then it would still save people some time to use my packages and fix whatever needs fixing.

• [1] http://aws.amazon.com/ec2/


• [2] http://developer.amazonwebservices.com/connect/entry.jspa?externalID=368


• [3] http://developer.amazonwebservices.com/connect/entry.jspa?externalID=351


• [4] http://www.coker.com.au/ec2/

Share This

(long post, you've been warned) With his his 'Omelette Post' about FOSS.IN/2008 Call for Participation, Atul Chitnis, the FOSS.IN team 'leader' indeed sent an strong sign. For those who aren't aware of it, FOSS.IN is the longstanding major FLOSS event in India and, still (just like our beloved Debconf) only run by volunteers. Last year, along with Sam Hocevar, I had the chance to attend the event and share the groove of that big, huge, conference, with over 2,000 participants. Some other Debian fellows also made it in the past (Jaldhar, Bdale...). During the Debian Project Day as well as regular conference days, we had the great opportunity to meet with the people who currently participate in Debian (and Ubuntu) in South Asia, as well as first meeting some major contributors from other projects. For me, and, I think, of all people I met up there, this was a great *and productive* event. Maybe not productive at the moment it happened, but productive in terms of mutual awareness, knowledge and friendship. All people who attended such conferences (should I say "Debconf" or "FOSDEM"?) know what I'm talking about. The conference was still quite focused on "real" FLOSS contribution more than evangelizing or politics. And I think it succeeded in it quite well. This year, I already planned to not attend...mostly because such event, with the associated long travel time, is something I can't really fit in my real life right now. Also, because it conflicts with a planned Extremadura work session, indeed. Still, I would indeed not have attended it. Atul's post makes it clear: the even will only be about coding. The point is to put focus on people who code and we do 'real' code. Bug fixing is not coding. Translation effort is not coding. Work on support for complex languages is not coding. Actually, what FOSS.IN/2008 organizers are trying to do is a kind of big Debcamp. I'm afraid it won't work this way. From what I have seen in years of participation to Debian, things just don't come up this way. People don't sit down and code because they're invited to. And, still, are only "people who code" the only people that matter in a project? Debian is sometimes seen as one of the biggest FLOSS projects all around (probably shared with the Linux kernel). How many people in Debian just "sit down and code"? What about those people who maintain our web site, our archive, setup our infrastructure, our new maintainer queue, our communication channels? What about those dozens of people who nicely maintain packages and keep the link with upstream developers, or fix bugs.... Those people do not seem welcomed at FOSS.IN/2008. "Not only bug fixing" is said in this announcement. This, I don't get it. At all. Why would "bug fixing" be second class work? Why would it be more noble to "code" new stuff? Maybe Atul did not mean to say this. He wants to have Indian contributors in FLOSS to be more visible....but I don't share this. Indian contributors in Debian *are* visible. Giridhar Appaji Nag is visible, "my" translator crew is visible, Kartik Mistry is visible (he once was too visible, even, by maintaining a little bit too many packages...). Bug fixing is the most noble task I see in FLOSS development. This is what we need the most. I recently blogged about how I feel APT to be 'poorly' maintained (once again, that was not targeted to current APT maintainers). What I would respect deeply is to see a bunch of Indian contributors stand up and take this task over. Atul, that would certainly not be "outsourcing code/package maintenance" and, no, these are not things one can get involved with instantly. Really, I don't buy this vision and that saddens me. That saddens me mostly because I know the folks there. I know the FOSS.IN organizers and I have deep respect for them. I just think they're missing the target and are too ambitious: one cannot change an event so drastically by just saying it has to change..:-) And, really, I'm even more sad to see localization work be called a low-hanging fruit from a country where there are 22 official languages. Or take words such as "talk is cheap, show me the code" as $ DEITY 's Holy Word just because it was once said by Linus Torvalds (who said many stupid things). Code is just one part of FLOSS development. Certainly one of the important parts but still one part. What would have happened to FLOSS if only "coders" had been working on it all over those years? It would be something used by about 10,000 people all around the world, that's all. We should not make an opposition between those who code and those who don't. By the way, do *I* code? When I'm sitting at 07:00AM on a Saturday morning, hacking on Samba packages and try to have Samba 3.2.4 built with the set of patches we have on Debian....do I code? I'm not *producing* code....the code was produced by those wonderful Samba Team folks. Does Karolin Seeger code when she's releasing samba with such a precise and constant schedule as she's doing since early 2008? Or Ana Guerrero when she (not alone!) compiles dozens of KDE packages and organizes and bumps the maintenance of KDE in Debian for the best of our users. Or Miriam Ruiz when she picks up each and every possible free game and tries to get it in Debian, talks with upstream developers, help them to fiw their code to suit the severe requirements of the Debian policy? Or Clytie Siddall when she translates about every major FLOSS in Vietnamese (nor URL here, sorry)? All these folks are part of the FLOSS game. You want Indians to be part of FLOSS game? Then allow the potential Karolin, Ana, Miriam or Clytie to be part of Indian FLOSS game and don't try to make FOSS.in the place where you seek the future Indian Linus Torvalds and only him her. Talk is cheap, show me the contribution.

I use Google's Analytics system for several web sites I run, but find it a bit cumbersome for just getting a quick overview of what's happening. For years, I've used my friend Salvatore's visitors program to analyze web logs. It claims to be a "fast web log analyzer" and it is blazing fast - so fast that for all the sites I run, it only takes a few seconds to process a year or two's worth of log files. For instance:

3724130 lines processed in 68 seconds
55 invalid lines, 0 blacklisted referers

And that's not a particularly fast server that it's running on, and of course it's running with a high "nice" value. Visitors is probably not suited to huge sites, as that's its only mode of operation - it doesn't save data - but it's a great option for everything but the biggest of log files. Using it every day, there are a few things that I wanted to improve or tweak, so with Salvatore's permission, I went ahead and put the code under version control over at Google Code: http://code.google.com/p/visitors/

There's a lot of debate these days about the impact of the increasing number of paid developers in FOSS communities that started as volunteer efforts and still have significant numbers of volunteers. Evangelia Berdou's PhD thesis "Managing the Bazaar: Commercialization and peripheral participation in mature, community-led Free/Open source software projects" contains a contains a wealth of information and insights about this topic. Berdou conducted interviews with members of the GNOME and KDE projects. She found that paid developers are often identified with the core developer group which is responsible for key infrastructure and often make a large number of commits. Furthermore, she suggested that the groups may have different priorities: "whereas [paid] developers focus on technical excellence, peripheral contributors are more interested in access and practical use". Based on these interviews, she formulated the following hypotheses which she subsequently analyzed in more detail:

1. Paid developers are more likely to contribute to critical parts of the code base.
2. Paid developers are more likely to maintain critical parts of the code base.
3. Volunteer contributors are more likely to participate in aspects of the project that are geared towards the end-user.
4. Programmers and peripheral contributors are not likely to participate equally in major community events.

Berdou found all hypotheses to be true for GNOME but only hypothesis two and four were confirmed for KDE. In the case of GNOME, Berdou found that hired developers contribute to the most critical parts of the project, that they maintained most modules in core areas and that they maintained a larger number modules than volunteers. Two important differences were found in KDE: paid developers attend more conferences and they maintain more modules. Berdou's research contains a number of important insights:

• Corporate contributions are important because paid developers contribute a lot of changes, and they maintain core modules and code.
• While it's clear that the involvement of paid contributors is influenced by the strategy of their company, Berdou wonders whether another reason why they often contribute to core code is because they "develop their technical skills and their understanding of the code base to a greater extent than volunteers who usually contribute in their free time". It's therefore important that projects provide good documentation and other help so volunteers can get up to speed quickly.
• Since many volunteers cannot afford to attend community events, projects should provide travel funds. This is something I see more and more: for example, Debian funds some developers to attend Debian conference and the Linux Foundation has a grant program to allow developers to attend events.
• Paid developers often maintain modules they are not paid to directly contribute to. A reason for this is that they continue to maintain modules in their spare time when their company tells them to work on other parts of the code.

Personally, I'm also wondering why there are some significant differences between GNOME and KDE. For example, about 67% of contributors where paid to work on GNOME whereas only 38% were paid to work on KDE. Why do some projects attract more commercial involvement whereas other projects continue to be mostly volunteer based? (Originally published on FOSSBazaar)

There is a lot of discussion and speculation about The Singularity. The term seems to be defined by Ray Kurzweil’s book “The Singularity Is Near” [1] which focuses on a near-future technological singularity defined by significant increases in medical science (life extension and methods to increase mental capacity) and an accelerating rate of scientific advance. In popular culture the idea that there will only be one singularity seems to be well accepted, so the discussion is based on when it will happen. One of the definitions for a singularity is that it is a set of events that change society in significant ways such that predictions are impossible - based on the concept of the Gravitational Singularity (black hole) [2]. Science fiction abounds with stories about what happens after someone enters a black hole, so the concept of a singularity not being a single event (sic) is not unknown, but it seems to me that based on our knowledge of science no-one considers there to be a black hole with multiple singularities - not even when confusing the event horizon with the singularity. If we consider a singularity to merely consist of a significant technological change (or set of changes) that change society in ways that could not have been predicted (not merely changes that were not predicted) then it seems that there have been several already, here are the ones that seem to be likely candidates: 0) The development of speech was a significant change for our species (and a significant change OF our species). Maybe we should consider that to be singularity 0 as hominids that can’t speak probably can’t be considered human. 1) The adoption of significant tool use and training children in making and using tools (as opposed to just letting them learn by observation) made a significant change to human society. I don’t think that with the knowledge available to bands of humans without tools it would have been possible to imagine that making stone axes and spears would enable them to dominate the environment and immediately become the top of the food chain. In fact as pre-tool hominids were generally not near the top of the food chain they probably would have had difficulty imagining being rulers of the world. I’m sure that it led to an immediate arms race too. 2) The development of agriculture was a significant change to society that seems to have greatly exceeded the expectations that anyone could have had at the time. I’m sure that people started farming as merely a way of ensuring that the next time they migrated to an area there was food available (just sowing seeds along traditional migration routes for a hunter-gatherer existence). They could not have expected that the result would be a significant increase in the ability to support children and a significant increase in the number of people who could be sustained by a given land area, massive population growth, new political structures to deal with greater population density, and then wiping out hunter-gatherer societies in surrounding regions. It seems likely to me that the mental processes needed to predict the actions of a domestic animal (in terms of making it a friend, worker, or docile source of food) differ from those needed to predict the actions of other humans (who’s mental processes are similar) and from those needed to predict the actions of prey that is being hunted (you only need to understand enough to kill it). 3) The invention of writing allowed the creation of larger empires through better administration. All manner of scientific and political development was permitted by writing. 4) The work of Louis Pasteur sparked a significant development in biology which led to much greater medical technology [3]. This permitted much greater population densities (both in cities and in armies) without the the limitation of significant disease problems. It seems that among other things the world-wars depended on developments in preventing disease which were linked to Louis’ work. Large populations densely congregated in urban areas permit larger universities and a better exchange of knowledge which permitted further significant developments in technology. It seems unlikely that a population suffering the health problems that were common in 1850 could have simultaneously supported large-scale industrial warfare and major research projects such as the Manhattan Project. 5) The latest significant change in society has been the development of the Internet and mobile phones. Mobile phones were fairly obvious in concept, but have made structural changes to society. For example I doubt that hand-writing is going to be needed to any great extent in the future [4], the traditional letter has disappeared, and “Dates” are now based on “I’ll call your mobile when I’m in the area” instead of meeting at a precise time - but this is the trivial stuff. Scientific development and education have dramatically increased due to using the Internet and business now moves a lot faster due to mobile phones. It seems that nowadays any young person who doesn’t want to be single and unemployed needs to have either a mobile phone or Internet access - and preferably both. When mobile phones were first released I never expected that almost everyone would feel compelled to have one, and when I first started using the Internet in 1992 I never expected it to have the rich collaborative environment of Wikipedia, blogging, social networking, etc (I didn’t imagine anything much more advanced than file exchange and email). Of these changes the latest (Internet and mobile phones) seems at first glance to be the least significant - but let’s not forget that it’s still an ongoing process. The other changes became standard parts of society long ago. So it seems that we could count as many as six singularities, but it seems that even the most conservative count would have three singularities (tool use, agriculture, and writing). It seems to me that the major factors for a singularity are an increased population density (through couples being able to support more children, through medical technology extending the life expectancy, through greater food supplies permitting more people to live in an area, or through social structures which manage the disputes that arise when there is a great population density) and increased mental abilities (which includes better education and communication). Research into education methods is continuing, so even without genetically modified humans, surgically connecting computers to human brains, or AI we can expect intelligent beings with a significant incremental advance over current humans in the near future. Communications technology is continually being improved, with some significant advances in the user-interfaces. Even if we don’t get surgically attached communications devices giving something similar to “telepathy” (which is not far from current technology), there are possibilities for significant increments in communication ability through 3D video-conferencing, better time management of communication (inappropriate instant communication destroys productivity), and increased communication skills (they really should replace some of the time-filler subjects at high-school with something useful like how to write effective diagrams). It seems to me that going from the current situation of something significantly less than one billion people with current (poor) education and limited communications access (which most people don’t know how to use properly) to six billion people with devices that are more user-friendly and powerful than today’s computers and mobile phones combined with better education as to how to use them has the potential to increase the overall rate of scientific development by more than an order of magnitude. This in itself might comprise a singularity depending on the criteria you use to assess it. Of course that would take at least a generation to implement, a significant advance in medical technology or AI could bring about a singularity much sooner. But I feel safe in predicting that people who expect the world to remain as it is forever will be proven wrong yet again, and I also feel safe in predicting that most of them will still be alive to see it. I believe that we will have a technological singularity (which will be nothing like the “rapture” which was invented by some of the most imaginative interpretations of the bible). I don’t believe that it will be the final singularity unless we happen to make our species extinct (in which case there will most likely be another species to take over the Earth and have it’s own singularities).

• [1] http://en.wikipedia.org/wiki/The_Singularity_is_Near


• [2] http://en.wikipedia.org/wiki/Gravitational_singularity


• [3] http://en.wikipedia.org/wiki/Pasteur


• [4] http://etbe.coker.com.au/2007/08/11/is-hand-writing-necessary/

Share This

Last Sunday was the 35th Berlin Marathon. I had flown over to Berlin on Thursday after work, and had Friday and Saturday to 'chill'. The weather was already pretty nice before the race, and truly gorgeous on Sunday: sunny yet not too warm, blue skies, no wind. As has been widely reported, Haile Gebrselassie set a new world record breaking his own mark set the year before and becoming the first man to finish under two hours and four minutes. Truly impressive. My race was pretty good too. I shaved over four and a half minutes off my own personal record (which was set in early 2006 at Sunburst) and finished in 3:13:09. That's a pace of 7:22 min/mile (or 4:35 min/km) which I am rather happy with. I held a fairly steady pace of under 7:30 almost all the way but but had to fight off the onset of cramps with some short walks about less than two miles to go. Coming back in Berlin after all those years is always a charm. The city has obviously changed a lot in some very visible areas. Yet it still recalls the Berlin of those years. The course was really nice, covering numerous neighbourhoods and starting and ending in Tiergarten. Lastly, it was also good to see old friends who have now been there since the mid- to late 1980s. And I managed to pack a quick visit to my parents in as they are just a good 80 minute ICE train ride away. All in all a very nice trip even though the travel from Chicago (without a direct flight!) is a bit of a hike.

One of the most interesting new technologies that has come out recently is Cloud Computing, the most popular instance seems to be the Amazon EC2 (Elastic Cloud Computing). I think it would be good if there were some open alternatives to EC2. Amazon charges $0.10 per compute hour for a virtual machine that has one Compute Unit (equivalent to a 1.0 to 1.2GHz 2007 Opteron core) and 1.7G of RAM. Competing with this will be difficult as it’s difficult to be cheaper than 10 cents an hour ($876.60 per annum) to a sufficient extent to compensate for the great bandwidth that Amazon has on offer. The first alternative that seems obvious is a cooperative model. In the past I’ve run servers for the use of friends in the free software community. It would be easy for me to do such things in future, and Xen makes this a lot easier than it used to be. If anyone wants a DomU for testing something related to Debian SE Linux then I can set one up in a small amount of time. If there was free software to manage such things then it wuld be practical to have some sort of share system for community members. The next possibility is a commercial model. If I could get Xen to provide a single Amazon Compute Unit to one DomU (not less or more) then I wouldn’t notice it on some of my Xen servers. 1.7G of RAM is a moderate amount, but as 3G seems to be typical for new desktop systems (Intel is still making chipsets that support a maximum of 4G of address space [2], when you subtract the address space for video and PCI you might as well only get 3G) it would not be inconceivable to use 1.7G DomUs on idle desktop machines. But it’s probably more practical to have a model with less RAM. For my own use I run a number of DomUs with 256M of RAM for testing and development and the largest server DomU I run is 400M (that is for ClamAV, SpamAssassin, and Wordpress). While providing 1.7G of RAM and 1CU for less than 10 cents an hour may be difficult, but providing an option of 256M of RAM and 0.2CU (burstable to 0.5CU) for 2 cents an hour would give the same aggregate revenue for the hardware while also offering a cheaper service for people who want that. 2 cents an hour is more than the cost of some of the Xen server plans that ISPs offer [3] but if you only need a server for part of the time then it would have the potential to save some money. For storage Amazon has some serious bandwidth inside it’s own network for transferring the image to the machine for booting. To do things on the cheap the way to go would be to create a binary diff of a common image. If everyone who ran virtual servers had images of the common configurations of the popular distributions then creating an image to boot would only require sending a diff (maybe something based on XDelta [4]). Transferring 1GB of filesystem image over most network links is going to be unreasonably time consuming, transferring a binary diff of an up to date CentOS or Debian install vs a usable system image based on CentOS or Debian which has all the updates applied is going to be much faster. Of course something like this would not be suitable for anything that requires security. But there are many uses for servers that don’t require much security.

• [1] http://aws.amazon.com/ec2/


• [2] http://en.wikipedia.org/wiki/List_of_Intel_chipsets


• [3] http://etbe.coker.com.au/2008/05/28/xen-hosting/


• [4] http://xdelta.org/

Share This

I'm lazy this morning, so I'll write a quick changelog about what's coming next in awesome 3.1, as of now.

• awesome-client is now a true REPL: so it now returns things like errors;
• mouse events now support button release;
• awful has been splited in several modules;
• the window stacking has been reworked and handled special windows (dock, desktop) much better;
• window type is now exported and correctly handled;
• any window can go fullscreen;
• widget can get an event when the mouse enters in it;
• placement (smart, under_mouse, etc) has been move into awful;
• statusbars and titlebars has been merged in a common type: wibox;
• wibox can be floating (i.e. you can now write your own conky-like with wiboxes);
• _NET_WM_STRUT_PARTIAL is now supported so panel and dock automagically puts padding around the screen;
• sticky windows are handled like sticky windows and are not tagged anymore;
• windows that get reparented are now unmanaged (that fixes view of PDF etc in your browser);
• a new image type has been introduced so you can manipulate image directly in awesome and use them;
• a new imagebox widget has been (re)introduced to use image objects;
• a real minimize/iconify state is now available;
• awesome gets a --check to check Lua syntax file; restart is now also checked for syntax file by default.

And of course some bug fixes.

Ever since my former desktop machine gsa died and I started using only laptops at home, I noticed a need for a home server for storing all my MP3s, holiday pictures, games, and backups of my other machines. And I also want a filtering web proxy at home again. Current situation Currently my Norhtec MicroClient Jr. “c2” with it’s 120 GB 2.5" harddisk does some of these jobs (mostly storage and backup), but it neither has the disk space nor the performance to do all the things I want. For storage I once bought a TheCus N4100, the big brother of the popular and officially Debian supported N2100. Unfortunately there are a few things different than in the N2100 (NIC without MAC) which makes it much more difficult to get Debian on it and the original firmware doesn’t support NFS at all. *grmpf* I had hints from others who managed to get Debian on this NAS, but I didn’t find the time and leisure to really dig into cross-compiling kernels. (Although with the new 1.3.06 firmware, so called modules became possible also for the N4100 and a SSH module has been posted with which a Debian chroot could be installed and the required kernel build on the machine itself.) I though wasn’t very angry when the N4100+ came out shortly after I bought the N4100, because the N4100+ was no more an ARM based device but had a Celeron processor inside instead. And a NAS which is built on average PC hardware wasn’t as appealing as some device based on some more exotic architecture mainly used in embedded devices. :-) The Mini-ITX Appeal This view changed rapidly, when Raffzahn showed me a few Mini-ITX boards and cases. I surfed around on Mini-ITX.com store and stumbled upon the NAS-like ES34069 case from Chenbro featuring four S-ATA hotswap 3.5" slots, a slim-line CD-ROM drive slot, a SD card reader, and enough space for an additional 2.5" hard disk and a low profile Mini-ITX board. Additionally, the VIA EPIA SN series of Mini-ITX boards sports 4 S-ATA ports and either a passively cooled 1 GHz C7 processor or an actively cooled 1.8 GHz C7 processor. That should be enough power for a small multi-purpose home server while still keep the power consumption low. And I’m not the only one having this idea, Mini-ITX.com suggests this combination and Chenbro officially supports the VIA EPIA SN boards. Additionally, Debian 5.0 Lenny seems to run fine on the SN series, only lm-sensors seems to have problems with SN18000G and SN10000EG (but not SN18000 and SN10000E). So when the Chenbro ES34069 case showed up in digitec’s online shop, I ordered one there and a VIA EPIA SN18000G board at Brack. I didn’t order any disks since for data storage I plan to use the four Samsung 400 GB 3.5" S-ATA disks I bought for the N4100, and for the system I plant to use the 2.5" disk I initially bought for my MicroClient JrSX “c1”, but then continued to use it only with the CF card. Not yet sure, if I’ll also equip the slim-line optical drive slot, too. The case took several weeks to deliver and the mainboard hasn’t arrived yet. Instead I got an e-mail from Brack that VIA products are currently very difficult to get in Switzerland. Reason is said to be that VIA tries to channel the distribution of their products to a single distributor. (Sounds somehow similar to what Apple tried with the iPhone and failed.) Mini-ITX boards and power consumption So I now have a nice case without a board. There aren’t that many Mini-ITX boards out there sporting 4 S-ATA ports. One which cleary stood out was the new Intel DG45FC Mini-ITX board with LGA775 socket. (In Switzerland neither available at Brack nor at digitec, but e.g. at PCP.) But reading the specs of this board it was also clear that it wasn’t thought for NAS systems but high-performance HTPCs — the focus seems to be on multimedia performance which a NAS doesn’t need. Its newer sister, the Intel DQ45EK Mini-ITX board is focussed more on office and business PCs than on multimedia. But Intels remote adminstration is not really a plus for me (don’t need it, I’ve got SSH ;-) and it’ neither cheaper than the DG45FC nor has it significantly lower power-consuption. Despite the 120W power-supply there are people who already combined the Chenbro ES34069 with the Intel DG45FC or DQ45EK board, e.g. one of the administrators of the German NAS-Portal forums built such a machine and this German guy who wants to build a Windows Home Server based on such a combination. At least the NAS-Portal administrator found out that the board consumes so much power that together with the 4 S-ATA disks the included 120W power supply doesn’t suffice and the system is not stable in this configuration. Trusted Reviews review of the DG45FC explains why: It’s one of the first Mini-ITX board not following the MoDT idea, has a desktop chipset instead a mobile chipset and therefore hasn’t all of the power-saving features of those mobile chipsets. But it’s easy to see anyway: Most of the CPUs supported by the DG45FC and DQ45EK boards have a TDP of 65W. Offically the processor cooler delivered with the case supports processors with up to 65W, but 65W is already more than the half of what the power supply delivers and according to the Trusted Reviews review, the board itself consumes another 35W itself. So for the four 3.5" S-ATA disks — which are usually not as economical as notebook disks — about 20W are left. This can’t work! The guy from NAS-Portal.org plans to solve the problem by using a universal 180W notebook power supply instead of the original one. In comparison to the 100W of the both Intel boards, VIA’s SN18000G consumes only 26W (the fanless SN10000EG even only 22W) and that’s board and processor! That’s about ¼ of what the Intel board consumes. Imagine the difference between having a 100W light bulb (suffices for a whole small room) shining 365 days a year compared to a 25W light bulb (often used in bedside lamps) in a year. Other Mini-ITX mainboards with 4x S-ATA include the following ones:

• Jetway JNC62K: According to Mini-ITX.com it fits into the Chenbro ES34069 case, but requires at least a 120W power supply which again questions its power consumption and its usage together with four 3.5" harddisks, although it is recommended for the ES34069 by Mini-ITX.com. But I haven’t made that good experiences with NVidia chipsets yet, so this board seems currently no option for me anyway. OTOH there’s German speaking guy who build a ES34069 based server using this board and only three SATA harddisks and runs the OpenSolaris based and commercial NexentaStor on it, so the hardware can’t be too exotic. (Review at Bit-Tech; Review at MiniITX.biz)
• Albatron KI690-AM2: Already over one year old and Silent PC Review says it has an extremely restrictive BIOS and poor fan control. (Another Review at TweakTown)
• iEi KINO-9454-R20: Seems to support only Pentium 4 and Pentium D.
• Several Commell mainboards: LV-66A (VIA C7 1.5 GHz), LV-672 (Pentium 4), LV-674 (Pentium D).
• Gigabyte GA-6KIEH-RH (not yet available)
• Kontron 986LCD-M/mITX: Socket mPGA478 and mPGA479, supports Intel Core 2 Duo Mobile beyond others; 3x GBit network interfaces, but also quite multimedia focussed — the review at EPIACenter.de (German written) says using it for NAS or a network-focussed machine is casting pearls before swine. :-) But the same counts for the DG45FC surely, too. ;-) Importer for Switzerland seems to be fabrimexSystems and end customers can buy it e.g. at ichbinleise.ch (which seem to sell only Kontron mainboards), but it’s way more expensive than the Intel DG45FC and even more expensive than the VIA SN18000G.
• J&W MINIX™ 780G-SP128MB: Another new multimedia focussed mainboard, but unless ATI drivers are way less usable than the NVidia drivers, I prefer not to use ATI graphics cards. (Review at MiniITX.biz)
• Advantech AIMB-221, AMD/ATI based and said to have a power-consumption less than 100W and a low TCO. But 100W are still too much for the 120W PSU. (German review at MiniTechNet)

Conclusion For now, I decided to wait a little bit more for my VIA EPIA SN18000G board which still seems to be the best board for the Chenbro ES34069 case although not really cheap. But if I once in a not that distant future decide to have a desktop at home again, I’m quite sure it’ll sport a cute Mini-ITX case (perhaps a nice black-orange HFX micro M1 case by mCubed — unfortunately the M2 is no more available in a color combination including orange ;-) with an Intel DG45FC or Kontron 986LCD-M/mITX and a decent Core 2 Duo processor. Software Plans Of course my home server will run Debian GNU/Linux 5.0 Lenny on it, with software RAID-5 and LVM2 over the 1.6 TB of S-ATA disks resulting in 1.2 TB available disk space which will be offered using at least NFS, SMB and SSH (think sshfs). Planned software includes BackupPC (a very fine pulling backup system for machines which are not online 24/7) and Privoxy. I’ll perhaps also install Tor and a caching proxy like Squid or Polipo. Another idea is to run Mediatomb on that machine. :-)

Yes, it’s me again with this DSA-1571 exploitation issue. The discovery, explanation and exploitation of the bug is now part of my final coursework for my postgraduate degree career. So, yes… sorry. Some weeks ago I started suspecting about the attack to PFS in SSL with EDH. The key point is: the key space is dependent of the PRNG state. The bug affects the initialization of the PRNG, but the random string has not a pattern by it self. If you ask for many random numbers to the PRNG, you gonna get numbers that differ among them, since they are the output of a hash function of them self. So each random number depends on, besides the PID, the state of the PRNG pool in the moment (in other words, amount of bytes that you already pull from the PRNG pool before) The explained attack was based in a fixed list of private exponents (which are selected randomly during the DHE handshake), presupposing that all the application call RAND_bytes() the same number of times before get it. To make the list of exponent I ran the openssl s_client with all the possible PIDs, hoping that all the applications behaves the same way. After more tests I notice that that was an overgeneralization. The proof is in the pudding: wget and cURL, two simple CLI file retrievers, gets different exponent between them, even running with the same PID. I was working on this when I accidentally found a really nice Eric Rescorla’s post which is deeply related with this. The post goes further and analyzes the interaction between how Apache forks off and how it generates SSL handshakes. So, I made lists of secret exponents for wget, curl, openssl s_client and openssl s_server with a modification version of libssl (appling this patch) and running scripts like this:

for i in $(seq $((2**15)));
do
  export MAGICPID=$i;
  LD_LIBRARY_PATH="openssl.broken/" LD_PRELOAD="./getpid.so" \
     wget --no-check-certificate https://localhost/ -q  -O /dev/null ;
  echo $i ;
done

As you can see, I used the HD Moore’s GetPID faker shared library and a normal local Apache with mod_ssl. The broken libssl (which is in .openssl.broken/) store up in /tmp/data.key a csv with command name, PID and all the DH components (g, x, y and p). But this way is farly unconfortable for others SSL deamon servers. Have you got any better idea?

I was reading an interesting post about predicting the results of the invasion of Iraq [1]. One of the points made was that the author rejected every statement by a known liar (which includes all the world leaders who wanted the invasion). So basically regarding every statement by a known liar as potentially a lie led to a better than average prediction. It seems to me that a similar principle can be applied to other areas. A vendor or advocate of DRM (Digital Restrictions Management) [2] has already proven that they are not concerned about the best interests of the people who own the computers in question (who paid for the hardware and software) - they are in fact interested in preventing the owner of the computer from using it in ways that they desire. This focus on security in opposition to the best interests of the user can not result in a piece of software that protects the user’s best interests. I believe that any software with DRM features (other than those which are requested by people who purchase the software) should be considered to be malware. The best example of this is the Sony BMG copy protection scandal [3]. Note that I refer to the interests of the people who own the computers - not those who use them. It is quite acceptable to write software that serves the buyer not the end-user. Two examples are companies that want to prevent their employees doing “inappropriate” things and parents who want to restrict what their children can do. We can debate about what restrictions on the actions of employees and children are appropriate, but it seems clear that when software is purchased for their use the purchaser has the right to restrict their access. Also note that when I refer to someone owning a computer I refer to an honest relationship (such as parent/child or employer/worker) not the abusive relationships that mobile phone companies typically have with their customers (give the customer a “free” phone but lock it down and claim that they don’t own it). Mobile phones ARE computers, just rather limited ones at this time.

• [1] http://d-squareddigest.blogspot.com/2004_05_23_d-squareddigest_archive.html


• [2] http://en.wikipedia.org/wiki/Digital_rights_management


• [3] http://en.wikipedia.org/wiki/2005_Sony_BMG_CD_copy_protection_scandal

Share This