Puppet I've really had it with Puppet. I used to be able to put up with all its downsides

• Non-Unix approach to everything (own transport, self-made PKI, non-intuitive configuration language, a faint attempt at versioning (bitbucket), and much much more )
• Ruby
• Abysmal slowness
• Lack of basic functionality (e.g. replace a line of text)
• Host management and configuration programming intertwined, lack of a high-level approach to defining functionality
• Horrific error messages
• Catastrophic upgrade paths
• Did I mention Ruby and its speed?
• Lack of IPv6 support
• [I could keep going ]

but now that my fourth attempt to upgrade my complex configuration from version 0.25.5 to version 2.7 failed due to a myriad of completely incomprehensible errors ("err: Could not run Puppet configuration client: interning empty string") and many hours were lost in trying to hunt these down using binary searches, I am giving up. Bye bye Puppet.

An alternative But I need an alternative. I want a system that is capable of handling a large number of hosts, but not so complex that one wouldn't put it to use for half a dozen machines. The configuration management system I want looks about as follows: It

• makes use of existing infrastructure (e.g. SSH transport and public keys, Unix toolchain, Debian package management and debconf)
• interacts with the package management system (Debian only in my case)
• can provision files whose contents might depend on context, particular machine data and conditionals. There should be a unified templating approach for static and dynamic files, with the ability to override the source of data (e.g. a default template used unless a template exists for a class of machine, or a specific hostname)
• can edit files on the target machine in a flexible and robust manner
• can remove files
• can run commands when files change
• can reference data from other machines (e.g. obtain the certificate fingerprint of each hosts that define me as their SMTP smarthost)
• can control running services (i.e. enable init.d scripts, check that a process is running
• is written in a sensible language
• is modular and easily extensible, ideally using a well-known language (e.g. Python!)
• allows to specify infrastructure with tags ("all webservers", "all machines in Zurich", "machines that are in Munich and receive mail"), but with the ability to override every parameter for a specific host
• should just do configuration management, and not try to take away jobs from monitoring software
• logs changes per-machine and collects data about applied configurations in a central location
• is configured using flat files that are human-readable so that the configuration may be stored in Git (e.g. YAML, not XML)
• can be configured using scripts in a flexible way

Since for me, Ruby is a downside of Puppet, I won't look at Chef, but from this page, I gleaned a couple of links: Ansible, Quattor, Salt, and bcfg2 (which uses XML though). And of course, there remains the ephemeral cfengine.

cfengine I haven't used cfengine since 2002, but I am not convinced it's worth a new look because it seems to be an academic project with gigantic complexity and a whole vernacular to its own. There is no doubt that it is a powerful solution, and the most mature of all of them, but it's far away from the Unix-like simplicity that I've come to love in almost 20 years of Debian. Do correct me if I am wrong.

Ansible Ansible looks interesting. It seems rather bottom-up, first introducing a way to remotely execute commands on hosts, which you can then later extend/automate to manage the host configurations. It uses SSH for transport, and its reason-to-be made me want to look at it. My ventures into the Ansible domain are not over yet, but I've put them on hold. First of all, it's not yet packaged for Debian (Ubuntu-PPA packages work on Debian squeeze and wheezy). Second, I was put off a bit by its gratuitous use of the shell to run commands, as well as other design decisions. Check this out: there are modules for the remote execution of commands, namely "shell", "command", and "raw". The shell modules should be self-explanatory; the command module provides some idempotency, such as not running the command if a file exists (or not). To do this, it creates a Python script in /tmp on the target and then executes that like so:

$SHELL -c /tmp/ansible/ansible-1350291485.22-74945524909437/command

Correct me if I am wrong, but there is zero need for this shell indirection. My attempts at finding an answer on IRC were met by user "daniel_hozac" with a reason along the lines of "it's needed, believe me", and on the mailing list, I am told that only the shell can execute a script by parsing the interpreter line at the top of the module. Finally, the raw execution module also executes using the shell And there a few other design decisions that I can't quite explain, around the command-line switch --sudo see the aforementioned message In short: running a command like

ansible -v arnold.madduck.net -a "/usr/bin/apt-get update" --sudo

does not invoke apt-get with sudo, as one might like; it invokes the shell that runs the Python script that runs the command. Effectively therefore, you need to allow sudo shell execution, and for proper automation, this has to be possible without a password. And then you might just as well allow root logins again. The author seems to think that "core behaviour" is that sudo allows all execution and that limiting the commands to run is not a use-case that Ansible will support. Apparently, I was the first to ever suggest this. There are always ways around (e.g. skip --sudo and just use sudo as the command, simply ignore the useless shell invocation and trust that your machine can handle it, but when such design decisions remain incomprehensible and get defended by the project people, then I am hesitant to invest more time on principle.

Salt Finally, I've looked at Salt, which is what I've spent most time on so far. From the discussions I started on host targeting and data collection, it soon became apparent that Salt is very thin and flexible, and that the user community is accomodating. Unfortunately, Salt does not use SSH, but at least it reuses existing functionality (ZeroMQ). As opposed to the push/pull model, Salt "minions" interestingly maintain a persistent connection to the server (which is not yet very stable), and while non-root usage is still not unproblematic, at least there has already been work done in this direction. I think I will investigate Salt more as it does look like it can do what I want. The YAML-based syntax does seem a bit brittle, but it's the best I've found so far. NP: The Pineapple Thief: Someone Here is Missing

Most of the day before the conference, and the conference morning spent working and finalizing my RTL status presentation. My apologies to the lecturers whose lectures I attend only physically (sorry, I can t split my attention too well). To my disappointment I had very few attendees in the talk, but I can understand the competition, as the other parallel talks were quite interesting. In at least one of them I wished to attend my self (if I could only be in two places in the same time ). Maybe next year we should have less parallel talks (4 tacks is a lot). To still push some of the RTL issues, I ve done a private talk over RTL issues for Caolan and Jan (kendy), which was interesting with some feedback. Jan took fdo#44657 on himself, and by the evening he showed me a great improvement in the status of things, so at least there s horizontal scrolling in Calc with RTL interface. With the help of Rene, I got master builds for Debian, and would spend the rest of the conference to check some bugs with it. During the evening dinner and social event I wanted to thank Miklos personally for really improving the RTF support for RTL and Hebrew documents, and he showed me a few of the new stuff he d done in master/3.7. While working I ve noticed a few regressions, and I m glad they were caught early. Cedric told me that after last years talk, he started to check his features also in RTL interface, which for me was the best feedback on my efforts. Having developers keeping RTL in mind (even only nce in a while) saves a lot of trouble along the road. I would prefer to check and double check features while they re being created instead of trying to get bugs fixed later on the release process. Another thing which I enjoyed noticing is the fresh blood the GSoC project brings to LibreOffice. I ve met with Miklos and Eilidh and got impressed with how a successful internship was used as a springboard into a good job. As there almost aren t any Israelis who take part in GSoC, I m not used to notice the effect closely. The event dinner and mingling was very successful for me, I ve got a chance to talk with old friends and meet some of the new attendees (and even get some technical work done by talking with people) Thanks again for the organizational team.
Filed under: LibreOffice

# Copyright (C) YEAR Free Software Foundation, Inc. # This file is distributed under the same license as the PACKAGE package. # FIRST AUTHOR <email>, YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2012-10-12 11:14+0300\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME <email>\n" "Language-Team: LANGUAGE <ll>\n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. type: Title # #, no-wrap msgid "Status hos doktoren" msgstr "" #. type: Plain text #, no-wrap msgid "\n" msgstr "" #. type: Plain text #, no-wrap msgid "\n" msgstr "" #. type: Plain text #, no-wrap msgid "" "**Jonas Smedegaard** [dr.jones at pobox.com " "](mailto:friends%40jones.dk?Subject=Status%20hos%20doktoren&In-Reply-To=1.5.4.32.19971011010004.0067de34%40kaospilot.dk) " "\n" msgstr "" #. type: Plain text msgid "_Sat Oct 11 15:22:00 CEST 1997_" msgstr "" #. type: Bullet: ' * ' #: msgid "Previous message: [Spamming? ](000001.html)" msgstr "" #. type: Bullet: ' * ' #: msgid "" "**Messages sorted by:** ? date (date.html#2) ? thread (thread.html#2) " "? subject (subject.html#2) ? author (author.html#2)" msgstr "" #. type: Plain text #, no-wrap msgid " Hej Patrik (og alle Jer andre )!\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " >_Vad sker med dig det var ett stycke tid diden?\n" " _>_Vad skedde der med ditt arbejde pa cafeet og pa skolen?\n" " _\n" " Lang historie!\n" " (den kommer nu )\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Jeg tror snart jeg har laert (the hard way) hvor dyr jeg egentligt er i " "drift.\n" " Jeg har nu i 3 maneder "ligget med r ven *under* vandskorpen" " " konomisk: minus 15.000,- pa kontoen. Det vender forhabentligvis indenfor " "den naeste maned - ellers pa jeg tage et regulaert lan, hvis jeg fortsat " "skal have firma som fuldtidsbeskaeftigelse.\n" " Det betyder, at jeg for tiden arbejder fra ca. 9 morgen til 0:30 nat syv " "dage om ugen (med enkelte eftermiddage eller aftener fri). Der er faktisk " "opgaver at lave, som ogsa gi'r penge i kassen - men det har der ikke vaeret " "for nogle maneder siden, og nar der var, har jeg taget mig for billigt " "betalt (men du kender mig jo!). Jeg er begyndt mere at involvere min " "storebror, nar jeg udarbejder tilbud, til at hjaelpe mig med en mere reel " "prissaetning.\n" msgstr "" #. type: Plain text #, no-wrap msgid " Her er lidt(?) om, hvad jeg beskaeftiger mig med for tiden:\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " *** Homebase ***\n" " Jeg far forbindelse fra mit kontor og ned til Mejlgade om en lille uge - " "rent teoretisk ihvertfald - derefter skal jeg ha' elektronikken til at " "fungere \n" " Jeg administrerer deres servere og netvaerk, og er "Boss" for Morten " "P. fra Frontl berne, som er blevet hyret til at vedligeholde alle " "arbejdspladserne pa skolen.\n" " Jeg har *intet* at g re med content pa webserveren. Efter i foraret at " "have haft DogSystem (et par nystartede edb-folk) til at udarbejde noget " "smart (som vist aldrig blev rigtigt til noget) har Uffe nu faet samlet nogle " "studerende (vist primaert fra hold 3), som skal hitte pa noget \n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Her er et uddrag af en mail til Rasmus fra hold 3:\n" " >>_Du ma gerne f lge lidt med i arbejdet og sende mig en kommentar " "eller\n" " _>>_gode rad, hvis du f ler for det.\n" " _>_\n" " _>_Jeg har et ambivalent forhold til Jeres arbejde:\n" " _>_ - Jeg f ler for det, Ja. Meget!\n" " _>_ - I sidder og laver mit arbejde \n" " _>_ - Meningen med mit arbejde er ar g re mig selv arbejdsl s - sa det " "er\n" " _>_*godt*, at I laver det \n" " _>_ - I laver det maske bedre, maske darligere end jeg ville ha' gjort " "det -\n" " _>_men helt sikkert anderledes!\n" " _>_ - Min force (og min kaephest!) er grundstrukturer mere end visuel " "(og\n" " _>_anden) indpakning. Det er svaert at kommentere og komme med gode rad, " "nar de\n" " _>_er omkring grundstruktur. Det kraever naesten, at man sidder ved " "roret \n" " _>_ - Hvis ikke jeg kommer med mine kommentarer nu, skal jeg enten holde " "mund\n" " _>_med det (og det er svaert) eller de vil udvikles til bagklogskab og\n" " _>_bedrevidenhed \n" " _>_ - Jeg har egentligt for travlt til at beskaeftige mig med det: Jeg " "har hele\n" " _>_tiden haft "travlt". At jeg har "for travlt" er et udtryk for, at " "jeg er\n" " _>_blevet klar over, at for at leve et liv som selvstaendigt " "erhvervsdrivende\n" " _>_er det ikke nok at arbejde hardt - man skal ogsa ta' penge for " "det Jeg\n" " _>_har derfor ikke for travlt, hvis der er penge i lortet (men det er " "sjaeldent\n" " _>_tilfaeldet i Mejlgade - til gengaeld er der sa meget andet " "dernede!).\n" " _\n" " *** Brugerflade-design ***\n" " Jeg har faet et job ved Frontl berne: VPAE (Virtual Project Assistance " "Environment).\n" " De er med i et faelles-nordisk projekt om at lave en "virtuel " "projektvugge" - altsa et forum pa Internet med en raekke vaerkt jer til " "projektudvikling og administration af gamle projekter.\n" " Konkret arbejder jeg i diss uger pa design af brugergraenseflade " "(dialogbokse osv.) og n dvendige datastrukturer til et system til " "udarbejdelse af en projektbeskrivelse.\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Jeg arbejder taet sammen med Morten P., og det er utroligt spaendende at " "arbejde med en konkret, mindre opgave med stor paedagogisk og funktionel " "vaerdi.\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " *** Praktikant ***\n" " En af mine venner fra gymnasietiden, Henrik, studerer informatik (det " "hedder vist noget lidt andet ) her i rhus, og meget tyder pa, at han " "snart kommer i praktik her hos mig i en maned.\n" " Han skal arbejde meget selvstaendigt. Jeg har brug for hans viden " "indenfor PR, han kan bruge mig som "pr veklud", og jeg kan stille medier " "(webserver o.l.) til hans radighed.\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Jeg har en ide om at vaere meget aben overfor brug af praktikanter - " "ikke bare som nem arbejdskraft (det er kraevende at saette i arbejde, og at " "give opgaver fra sig!), men mere fordi det giver mig en traening i " "formidling af min viden, og erfaringer mht. "s saetning" af mine metoder " "og ideer som tekniker - men det kraever maske lidt uddybning :\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Mit virke er grundliggende at bygge bro mellem teknikere og brugere " "indenfor IT. Det har 2 aspekter - at naerme teknikeren til brugeren, og at " "naermere brugeren til teknikken. Jeg arbejder med undervisning (arketyper, " "paedagogik og kommunikation), brugerfladedesign og almen radgivning for at " "hjaelpe brugeren pa vej. For at hjaelpe teknikeren tager jeg udgangspunkt i " "mig selv og mit arbejde med brugeren, og udvikler herigennem en raekke " "metoder og tankesaet, som jeg vil formidle - gennem praktikanter eller " "evt. decideret undervisning - til andre teknikere, som ikke i det daglige " "arbejder "i begge lejre", og derfor ikke ser de samme problematikker som " "mig.\n" " konomisk skulle "Projekt dr. Jones" gerne baeres igennem " "vha. konkrete projekter - virksomheder og enkeltpersoner, som har behov for " "min viden og mit arbejde, og som er villige til at betale merprisen for " "forskning fremfor traditionelle l sninger (NB! jeg bruger bevidst ikke ord " "som "udvikling" og "innovation" - for mit arbejde f rer til tider " "tilbage til udgangspunktet - det er ikke *altid* n dvendigt at opfinde den " "dybe tallerken igen!)\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Henrik vil ikke give mig de store erfaringer mht. formidling af min " "viden - jeg har for stor en pukkel af opgaver liggende til at kunne gabe " "over ham ogsa. Denne gang er det primaert hans felt - PR - jeg kan drage " "nytte af.\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " *** Undevisning ***\n" " Jeg har nu i en maned undeervist i edb som valgfag pa IDA " "(Idraetsdagh jskolen). Indtil nu har det vaeret 2 timer om ugen, elever i " "alderen 30-60 ar - men om fa uger bliver der yderligere 4 timer om ugen med " "elever pa 20-30 ar.\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Afl nningen er symbolsk (nej, god l n regnet som underviser, jeg far " "samme l n som en uddannet laerer - men ikke sammenholdt med, hvor " ""dyrebar" min tid er som selvstaendig ), men sjaeldent har jeg oplevet " "sa tydeligt et ryk i min paedagogiske forstaelse og opmaerksomhed.\n" " Jeg bliver sandsynligvis ikke haengende ved IDA i mere end et 1/2-1 ar - " "det er simpelthen for tids- og ressourcekraevende - men h ster gode " "erfaringer salaenge (og bader mig i deres positive feedback :-)\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " *** Brugerflade-programmering ***\n" " Samtidig (egentligt burde jeg forlaengst vaere faerdig, men opgaven greb " "om sig) arbejder jeg pa mit eget projekt: BOS (BrugerOpdateringsSystem).\n" " Det er et CGI-script (lille program pa en web-server), som muligg r " "redigering af indholdet pa websider uafhaengigt af sidens grafiske " "opsaetning, og - vaesentligst - UDEN AT SKRIVE EEN ENESTE KODE!\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " 1. udgave af BOS betalte jeg en programm r 15.000,- for at udvikle. Jeg " "havde brug for det til en opgave for AC (Akademikernes Centralorganisation), " "som skulle bruge det til bl.a. pressemeddelelser og publicering af et " "manedsblad pa deres 200+ siders websider (som jeg ogsa har lavet!).\n" " Da AC i sensommeren kom med rettelser og udvidelser til deres website " "blev der brug for forbedringer af BOS, og jeg erfarede, at min programm r " "havde lavet meget u-fleksibel kode, som var umulig at bygge videre pa.\n" " 2. udgave af BOS er nu naesten faerdig. Jeg valgte at skrive det om fra " "grunden selv (med hjaelp fra en god ven, som studerer datalogi), og har " "efterhanden skrevet ca. 750 linjers kode i programmeringssproget Perl \n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Jeg havde ikke troet, at jeg nogensinde skulle kunne programmere. Det " "kraever disciplin og god forstaelse for grundliggende datastrukturer, som " "jeg hidtil troede n dvendiggjorde et mangearigt universitetsstudie " "(datalogi).\n" " Jeg vil ikke sla mig ned som programm r, men kan nu bruge det som ekstra " "fjer i min vifte af erfaringsomrader, i min rejse mod "At vaere det ledende " "radgivningsorgan i Danmark indenfor anvendt edb"!\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " *** Internet-Cafe ***\n" " Jeg har jo kontor i 2 lokaler hos NETLAB, en spillecafe (computerspil i " "netvaerk). Det tog ikke mange jeblikke at slutte deres og mit netvaerk " "sammen, sa alle spillecomputerne ogsa kunne komme pa Internet - desvaerre " "fungerede det ikke med store computerspil (lang teknisk forklaring ), kun " "med alm. ting som e-mail og at "surfe" pa nettet.\n" " Jeg far snart (indenfor fa uger) "aegte" adgang til Internet, via fast " "forbindelse d gnet rundt. Sa kan der spilles computerspil via Internet, og " "spillecafeen er reelt blevet en Internet-Cafe \n" " Den kommende Internetforbindelse er dog ikke saerligt kraftig (64kbit - " "2-4 x modemhastighed) til deling mellem 20 kraftige maskiner, og har lagt en " "f ler ind hos Telia: Om ikke de har lyst til at sponsorere stedet. Give os " "en kraftig forbindelse til Internet, og til gengaeld fa reklamevaerdien af " "en stabil og hurtig forbindelse Folk der bliver rigtigt bidt af det vil " "jo f r eller siden k be en maskine selv, og sa far de jo brug for en " "Internet-udbyder \n" " Min rolle bliver at administrere "hullet" (eller "hullerne" til " "Internet, og evt. ogsa at strukturere og administrere mail-adresser til " "bes gende pa cafeen.\n" " konomisk forestiller jeg mig en fast procentdel af indtaegterne i " "cafeen - eller evt. simpelthen en billigere husleje?!?. Det gaelder om at " "finde en prispolitik, som spiller sammen med den grundliggende holdning ved " "bade dr. Jones og NETLAB om et indbydende, seri st (uden at blive kedeligt!) " "milj fremfor "flest muligt forbi kasseapperatet".\n" msgstr "" #. type: Plain text #, no-wrap msgid " -\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Det blev et laengere brev - og jeg tror faktisk, jeg vil genbruge det " "til ogsa at fortaelle familie og andre venner, hvorfor de har h rst sa lidt " "til mig pa det sidste \n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Hej allesammen!\n" " Haber I nyder tilvaerelsen. Det g r jeg - men traenger ogsa snart til et " "lille pusterum - juleferie i Sydfrankrig, regner jeg med!\n" msgstr "" #. type: Plain text #, no-wrap msgid "" " Ha' det bra!\n" " Jonas\n" " :_-)\n" " _\n" msgstr "" #. type: Plain text msgid "" "[More information about the Friends mailing list](http://mail.jones.dk/cgi- " "bin/mailman/listinfo/friends)" msgstr "" #. type: Plain text msgid "This text is part of my friends scriblings." msgstr ""

Credit Unions are financial co-operatives where a community s savings are used to fund other community borrowing and both savers and borrowers can become members. Thursday 18 October 2012 is International Credit Union Day, as well as being in the United Nations International Year of Co-operatives. This year s theme is Members Matter Most which was suggested from Ireland. In the UK, there will be events including one at Westminster with speeches from Damian Hind MP, Chair of All Party Parliamentary Group on Credit Unions and Simon Hughes MP, its Vice Chair. I m a member of my local credit union. I can pay in at my bank or any PayPoint and withdraw by bank transfer. If you re fed up with the fat cat plc bankers, there s no better time to Move Your Money in general and Find Your Credit Union (international visitors, start at WOCCU) in particular, is there?

Sometimes one stumbles upon artists by accident and immediately falls in love with them. A link to a video from Lindsey Stirling was dropped in a chat I was paying attention to at that time, and it immediately touched me. She's got style, and she's got great videos. Speaking of videos, here they are:

• Electric Daisy Violin: This was the song that was dropped. And it touched me, especially her dressing style. Maybe her legs will also catch your attention like they did to me. :)
• Crystallize: The subtitle Dubstep Violin of this video is what describes her style best. Great play.
• Shadows: Another great song with terrific video.

I hope her plans to come to europe might work out soonish. Enjoy!

/music permanent link Comments: 4 Flattr this

For writing tests for GVFS (current tests, proposed improvements) I want to run Samba as normal user, so that we can test gvfs smb backend without root privileges and thus can run them safely and conveniently in a make check environment for developers and in JHBuild for continuous integration testing. Before these tests could only run under gvfs-testbed, which needs root. Unlike other servers such as ssh or ftp, this turned out surprisingly non-obvious and hard, so I want to document it in this blog post for posterity s benefit. Running the server Running smbd itself is mainly an exercise of figuring out all the options that you need to set; Alex Larsson and I had some fun figuring out all the quirks and hiccups that happen between Ubuntu s and Fedora s packaging and 3.6 vs. 4.0, but finally arrived at something working. First, you need to create an empty directory where smbd can put all its databases and state files in. For tests you would use mkdtemp(), but for easier reading I just assume mkdir /tmp/samba here. The main knowledge is in the Samba configuration file, let s call it /tmp/smb.conf:

[global]
workgroup = TESTGROUP
interfaces = lo 127.0.0.0/8
smb ports = 1445
log level = 2
map to guest = Bad User
passdb backend = smbpasswd
smb passwd file = /tmp/smbpasswd
lock directory = /tmp/samba
state directory = /tmp/samba
cache directory = /tmp/samba
pid directory = /tmp/samba
private dir = /tmp/samba
ncalrpc dir = /tmp/samba
[public]
path = /tmp/public
guest ok = yes
[private]
path = /tmp/private
read only = no

For running this as a normal user you need to set a port > 1024, so this uses 1445 to resemble the original (privileged) port 445. The map to guest line makes anonymous logins work on Fedora/Samba 4.0 (I m not sure whether it s a distribution or a version issue). Don t ask about dir vs. directory , that s an inconsistency in Samba; with above names it works on both 3.6 and 4.0. We use the old smbpasswd backend as shipping large tdb files is usually too inconvenient and brittle for test suites. I created an smbpasswd file by running smbpasswd on a real Samba installation, and then using pdbedit to convert it to a smbpasswd file:

sudo smbpasswd -a martin
sudo pdbedit -i tdbsam:/var/lib/samba/passdb.tdb -e smbpasswd:/tmp/smbpasswd

The result for password foo is

myuser:0:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:AC8E657F83DF82BEEA5D43BDAF7800CC:[U          ]:LCT-507C14C7:

which you are welcome to copy&paste (you can replace myuser with any valid user name, of course). This also defines two shares, one public, one authenticated. You need to create the directories and populate them a bit:

mkdir /tmp/public /tmp/private
echo hello > /tmp/public/hello.txt
echo secret > /tmp/private/myfile.txt

Now you can run the server with

smbd -iFS -s /tmp/smb.conf

The main problem with this approach is that smbd exits ( Server exit (failed to receive smb request) ) after a client terminates, so you need to write your tests in a way to only run one connection/request per test, or to start smbd in a loop. Running the client If you merely use the smbclient command line tool, this is rather simple: It has a -p option for specifying the port:

$ smbclient -p 1445 //localhost/private
Enter martin's password: [enter "foo" here]
Domain=[TESTGROUP] OS=[Unix] Server=[Samba 3.6.6]
smb: \> dir
  .                                   D        0  Wed Oct 17 08:28:23 2012
  ..                                  D        0  Wed Oct 17 08:31:24 2012
  myfile.txt                                   7  Wed Oct 17 08:28:23 2012

In the case of gvfs it wasn t so simple, however. Surprisingly, libsmbclient does not have an API to set the port, it always assumes 445. smbclient itself uses some internal libcli API which does have a way to change the port, but it s not exposed through libsmbclient. However, Alex and I found some mailing list posts ([1], [2]) that mention $LIBSMB_PROG, and it s also mentioned in smbclient s manpage. It doesn t quite work as advertised in the second ML post (you can t set it to smbd, smbd apparently doesn t speak the socket protocol over stdin/stdout), and it s not being used anywhere in the current Samba sources, but what does work is to use good old netcat:

export LIBSMB_PROG="nc localhost 1445"

with that, you can use smbclient or any program using libsmbclient to talk to our test smb server running as user.

So, a couple of days ago, I came home tired after a intense weekend of learning Akonadi and hacking on KDEPIM. At each meal, we attended 12 people, but it wasn t the same people every time. And a couple of people participated remotely. Several people, including me, got their feet wet in kdepim & akonadi code. Talks about the future with Qt 6 and Qt 7 and Akonadi 3 were also held in the corners. Hopefully, others will tell more closely about what they did, including fixing kmail memory usage to not grow until all headers of all emails was in memory and improving the address completion job to help filling in to/cc/bcc fields. Personally, I started off several times with the same issue. Not doing several synchronous calls from KMail to Akonadi during message writing and sending. On my way, I cleaned up some code and started over a couple of times. And the code is still a work in progress on my laptop. But the most important synchronous call is in that WIP patch now actually asynchronous \o/. There is still work to do on that area though and I hope to get around polishing it and finishing it this month somehow. I currently have function names like second_half_of_generateCryptoMessages and this_function_should_be_renamed . And next up will Andras Mantia hopefully blog about his accomplishments. And poke some other person for a blog post. Oh. and if you like developers taking a weekend or so out of their busy schedule to meet up for hacking, please consider supporting KDE by Joining the game

It's one of those things that you read about, but are never really sure about: you think "maybe he was doing something fishy, and isn't tellling it straight in the public account of the incident". So I'll try to stick to "just the facts". A few weeks ago, I dug up some old book reviews I'd done, and posted to Facebook, and opened a site here: http://davids-book-reviews.blogspot.com/ as a way of collecting them. Naturally, I also added Amazon referral links, because, hey, it helps feed my reading habit! Last month I got enough to buy two whole Kindle books, so we're not exactly talking about "get rich quick" territory here. We're not even talking about anything remotely close to my day job, for that matter. But hey, if I can get a little bit extra to spend on books, it's nice. The reviews were basically quick notes on books I read. Nothing that I or the rest of humanity can't get along without, but I felt like writing up a little something for myself and people I know on the internet - maybe it'll help someone else find an interesting book to read. Several days later, I believe on October 8th, I woke up to find my phone was 'not signed in to Google', and, after repeated attempts, wouldn't sign in. Same thing with my Nexus 7. Logging in to my computer, in something of a cold sweat at this point, I find I can't get into Gmail or anything else, either. Luckily, on the computer, Google's system did redirect me to a page where they mentioned suspicious activity, and gave me the chance to reactivate things by sending an SMS to my phone. This did work quickly, and did a little bit to alleviate some of my stress. I understand that locking things down quickly is probably to my benefit as well as theirs in the event of an actual security breach of someone's account: it keeps the attacker from doing any more damage. However, it was sure a bad way to start a Monday morning. However, the actual 'blog' (sorry, I hate the word!) was still blocked. It too has a form to fill out to prove that you're human. Although: as a computer guy, you'd think that with all the clever people at Google, they would be able to tell from my access patterns to the site, browser footprint, IP addresses and so forth, that...well, I am me. In any event though, they promised to review the blog within two days. So, I waited patiently. A week later, still nothing. Then, the next day, I went back to check on the status, and they had reset the review request: it no longer said anything about October 8th, when I had originally made the reinstatement request. So I filled in their form again, asking to have my blog back. That was yesterday, we'll see what happens next. As far as I can tell, I did not violate their actual terms of conditions, which say nothing about referral links: http://www.blogger.com/content.g Since the people at Google are loth to speak with their users directly, it seems as if one of the best ways of getting support is to complain loudly and publicly about this kind of shennanigan. And to forestall the somewhat inevitable comments on anything related to Google: 1) Yes, I know I signed an agreement where they say they can do whatever the hell they want and I can f**k off if I don't like it. Try and do anything on line with a major company and not get a contract like that, or for even more entertainment value, try and negotiate the contract with t he company. Good luck. If you don't say yes, you're pretty much on your own; there doesn't seem to be much of a market for "more humane terms and conditions" out there. 2) I know, I know, relying on the Google beast is a great way to set yourself up for a big fall if anything ever goes wrong, because it's impossible to appeal, or pretty much even to talk with a human. But with a limited amount of time in my life, to date, Google has been a pretty good deal. I suppose it's something of a "black swan" situation: everything seems fine until one day WHACK, and Google pulls the carpet from under your legs. Conclusions? Well, I hope someone out there can help me recover my content. I wrote it myself, and I would like to save my book reviews somewhere. What alternatives are there to the Google colossus? Not too many that I can see that are anywhere at all as convenient. Edit: 2012-10-17: I don't know what did it, but they have reinstated the site. Strange and disconcerting, but I guess things are ok for the time being. Thanks to whoever it was at Google that finally had a look.

A few days ago I wrote an article about the lawsuit the producers of ColonHelp are trying against Wordpress in the attempt to silence a blogger who wrote some unfavourable and science-based articles on his blog.

Meanwhile Petter Reinholdtsen (who seems to be a fellow skeptic, hi!) sent further this information via his blog, but on another front, I found out the German skeptics tried to contact Zenyth Phamaceuticals on Facebook and asked them why did they use lawyers for threats against critics, instead of using words and thorough scientific studies to talk to the critics.


The people at Zenyth Pharmaceuticals probably wanted to show they do not only use lawyers, but they can be very proficient at using the 'Delete' function of Facebook, so they did just that, it seems.

This really motivates me to go ahead and translate the article Zenyth's money didn't translate, the one that shows their entire case is baseless.

Phishing is a fraud technique that consists in reproducing the content of a targeted website, directing users to it, and recording their credentials when they log into your website. It is like fishing fish with fake food, only you phish humans with fake websites. Well, I have a good news for the phishers: people are using more and more smartphones, and mobile browsers are making your job really easy. In fact, many regular smartphone user simply have no way to tell your fake website apart from the real one.For instance, this is what my bank website looks like in my desktop browser, and what a corresponding phishing website would look like: See the difference? It is not that obvious, but it is easy to detect when you are trained: the page address is not the same, with the fake website it refers to the phisher's server instead of the bank's one. Now, what does it look like on a Firefox Mobile? Well, here is the answer: the same, absolutely the same: The page address is hidden for space reasons, and only shown when touching the address page title bar. Want to browse the Web safely? After each link you follow, click on the page title bar. Good luck if you are using such a mobile Web browser. Fortunately, I am not.

The GNOME infrastructure runs a Piwik s istance and it s been amazing seeing some of the statistics published there. A few details: Traffic during the 27/09/2012 GNOME 3.6 Launch Visits: 23063 Page views: 50352 Traffic during the last month. (from 15/09/2012 to 15/10/2012) Visits: 187598 Page views: 454313 Traffic during the last six months. (from 15/05/2012 to 15/10/2012) Visits: 773153 Page views: 1867200 GNOME is growing really fast and a great thank you goes to its great community and contributors! Let s keep rocking!

In case you tried to use git-buildpackage and wanted to use cowbuilder as a builder, you might have ran into the error

sudo: sorry, you are not allowed to preserve the environment

This is due to a change in sudo default configuration in version 1.7.4p4-2 (I know, is true since 2010) which doesn't allow the execution of commands via sudo using the parameter '-E' which means 'setenv'.

The news item even explicitly states pbuilder can be affected by this because it wants to port over to the pbuilder environment the HOME environment variable and suggests using

Defaults env_keep += HOME

But adding such a line to your /etc/sudoers.d/01_pbuilders file (/etc/sudoers is recommended to be touched only by the package) will do the same for all commands and users ran via sudo, which is, according to my preferences, too permissive.

The irony is that running git-buildpackage --git-pbuilder will invoke sudo -E cowbuilder so the env_keep suggested fix will not work because for -E to be allowed, setenv needs to be set in sudoers. This would defeat the purpose of env_reset, if done for all commands, but we can do a better job if we allow this kind of change only for the cowbuilder and pbuilder commands. You do have different commands that are allowed explicitly stated, don't you?

On my system I have made a group especially for people allowed to do packaging work, the group is called 'pack'. The only account in that group is my own.

Also, I have defined a command alias named PBUILDERS which looks something like this:

Cmnd_Alias PBUILDERS = /usr/sbin/pbuilder, /usr/sbin/cowbuilder

Running PBUILDERS is already restricted to the pack group. Here is an example that requires password on run:

%pack ALL=PBUILDERS

So all that needs to be done is to allow setenv for the PBUILDERS commands. Reading through the sudoers manpage and after some trial and error (use visudo for editting sudoers files - visudo -f /etc/sudoers.d/01_pbuilders) I found out that the symbols that distinguish between commands, users and groups in a 'Defaults' line needs to be right next to the 'Defaults' word. For command the sign is an exclamation sign '!' (for user lists it's ':') so since we want to link the exception to the command, not the user list, we'll use 'Defaults!':

Defaults! PBUILDERS setenv

Assuming you also have a PBUILDERS commands alias, this is what you need to be able to use git-buildpackage in conjunction with cowbuilder and sudo.

If there is a non-intrusive way to prevent sudo to use -E when invoking cowbuilder, please add your comment, I would be interested to know it.