PostgreSQL upgrade from 8.2 to 8.3. This really should be automated (... but I guess I understand why it's not.) At least it does work as advertised, thanks a lot to Julien Danjou. And thanks to Martin Pitt and the PostgreSQL developers for making it so painless to run several PostgreSQL versions side by side. Now there's a serious database.

Daily installer images are now available for the QNAP TS-109, TS-209 and TS-409. This means that complete installations of Debian testing are possible now. You can consider the daily image as a beta release of RC1 of the debian-installer for Debian lenny. It should only be used by experienced users and only if you can make a serial console in case something goes wrong. As the name suggests, the daily images change on a daily basis and they install Debian testing which also changes on a daily basis (although testing should be fairly stable since we're close to the freeze of testing in preparation for the release of Debian lenny). If you install Debian with these installer images, please send an installation report to debian-boot send an email to me so I can let you know in case there are any important news you should be aware of. There is a web site now with complete installation instructions and other information about Debian on QNAP Turbo Station. If you have any questions or suggestions, please let me know.

After excruciatingly long months of waiting for all pieces of the puzzle to fall into place, I am pleased to announce that the dayjob finally rolled out its very first online shop! The process of putting this together has been quite an experience: I had to learn about the wonders of payment authorization gateways, different taxation jurisdictions, etc. For instance, we have to deal with 4 taxation jurisdictions:

1. Estonian corporates and individuals: always add 18% VAT.
2. Other EU individuals: always add 18% VAT.
3. Other EU corporates: can be exempted from VAT, if their EU tax registration number is valid. Otherwise, add 18% VAT.
4. Corporates and individuals from outside EU: always exempted from VAT.

As much as we looked around, we could not find any e-commerce site engine that can handle all the intricacies of dealing with EU corporate customers who may or may not have a valid EU taxation exemption number so, for now, our online shop only handles cases 1, 2 and 4 properly. What can you find on our online shop?

• Our acclaimed LTSP client hardware solution, the ThinCan.
• Our really cool Programmable LPC Dongle, which is an Open Source tool for developing and debugging firmware running on devices attached to an LPC bus. I mentioned Open Source, because we publish the FPGA code and Python scripts needed to access the LPC Dongle under the LGPL.
• Various other products which we happen to sell in the Baltic market.

Anyhow, I'm really happy to finally see this online shop deployed. So many people had wanted to purchase a ThinCan using a credit card or from countries for which shipping costs were difficult to determine and we unfortunately could not easily accommodate them. This is now resolved. Enjoy!

As summarized by Ace Suares, to validate my first rough upgrading instructions:

1. Upgrade the packages in the LTSP chroot First become root: sudo chroot /opt/ltsp/i386 Then add the repository, update and upgrade: echo "deb http://ppa.launchpad.net/q-funk/ubuntu hardy main" >> /etc/apt/sources.list apt-get update && apt-get upgrade && apt-get clean APT will inform you that some packages cannot be authenticated. This is normal, since the PPA is not digitally signed. Simply answer Yes.
2. Purge the transitional AMD driver apt-get --purge remove xserver-xorg-video-amd Then, exit the chroot:

   exit

3. Update the LTSP boot image

   sudo ltsp-update-image

   On a 64-bit server, the correct command is:

   sudo ltsp-update-image --arch=i386

4. Profit?

Happy Midsummer, everyone!

It had to happen sooner or later: The X.org drivers for the old GX1 variants of the Geode chips formerly made by Cyrix and NSC no longer build against the current X.org release. Given the imminent release of X.org 7.4 (server core 1.5), this essentially means that users of older Geodes will have a nasty surprise, the day they upgrade to Ubuntu/Intrepid, which ships with core 1.5. Soon after, the release immediately following Debian/Lenny will be affected too. There is a planned milestone to eventually reintegrate support for older GX1 products into the clean and up-to-date xf86-video-geode framework, but this will unfortunately come too late for those upgrading to Ubuntu/Intrepid, unless... ...unless someone volunteers to copy gx_* files inside xf86-video-geode and graft GX1 support into the resulting gx1_* files. If you have access to Cyrix/NSC GX1 + CS5530 or AMD SC hardware and a reasonable knowledge of the X.org codebase, your contribution would be most welcome.

I've just changed the behaviour of oldsys-preseed in the case when a static IP address is set in the configuration of the device that is the default setting from the vendor. In the past, oldsys-preseed would try to be smart in this case and do DHCP in the assumption that the users never configured the static IP address themselves and might not want to have that setting. However, Mike (mwester) convinced me that doing DHCP when the configuration clearly says to use a static IP is a bad idea. Apparently quite a few users got confused by the old behaviour of oldsys-preseed. The new behaviour exists as of version 2.0 of oldsys-preseed which will be in rc1 of debian-installer for lenny. This change affects the Linksys NSLU2 and Thecus N2100.

I put the Nokia E51, which I had previously acquired, onto Ebay last night, and it sold within minutes. Even though I made a 50 loss on the whole affair, this made me very happy! The phone is crap in so many ways that it made me quite angry. I now consider those 50 the investment I had to make to bring you this post: First of all, the reason why I bought the phone was because it sports wireless LAN as well as Voice-over-IP. Since I ve recently gotten into VoIP, I was looking for reasonable VoIP phones and even though the Siemens C450IP DECT phone works very well, it only does so at home, or where I find a switch port for it. So my theory was to get this Wifi+VoIP phone and be able to use my VoIP infrastructure from anywhere around the world. Penny has the Nokia E65 and loves it, so I went for the E51, a newer model that promised to address some of the issues she had with hers. All of the following is based on the E51 with the 100.34.20 firmware dated 29 September 2007, which runs the (crippled) Symbian S60r3 operating system.

Good things Let s start with the few good things up front: the E51 comes with a regular USB jack, allowing you to plug it into any computer and use it as mass storage device without the need for any Nokia-specific cables. I also liked the remote lock functionality: in the event of a stolen phone, you could send it a pre-defined passphrase that would cause the phone to lock itself. Also, the phone could be configured to lock itself (like a screensaver) after a given amount of idle time. Other than that, I could not find anything outstanding, so let s turn to the downsides, of which there are many more:

VoIP/SIP shortcomings I had previously dismissed the E series phones for good reasons, but both the E65 and the E51 improved their SIP clients a fair bit, and with the SIP VoIP settings utility, it was even possible to configure STUN. But unfortunately, the SIP client, while a nice toy, ended up being unusable in production. Here are some of the reasons: I got VoIP working at home and in some other places, but definitely not everywhere. It may be that some of those networks blocked the SIP port (5060/udp), or that the phone didn t feel well on the day, but in the majority of cases, I could not get the SIP client to connect. And there was no way to find out what was going on, as the client would just claim that registration failed without any additional information. It was also hard to retry, often requiring the phone to be restarted. Whenever if failed, the client would helpfully tell me that it could not establish a connection to the connection network . To get the phone to log on to the SIP server automatically, I had to define a home network for the SIP profile. Changing the access point for that network required a phone reboot to get SIP working again. It was possible to define multiple SIP profiles with different access points and add them all to the one, global VoIP profile, and theoretically get auto-login to work across multiple Wifi networks; unfortunately, I cannot say that this worked, there were always some problems requiring me to change defaults and shift things around. Also, after I had defined a few of those profiles and needed to make a change to the SIP settings (move the SIP port to 53/udp), I had to modify all profiles in turn; it was not possible to share settings. On the other hand, NAT traversal settings and timeouts, which can only be configured with the aforementioned SIP VoIP settings utility, applied to a VoIP profile and thus to all SIP profiles, without exception. I found it mildly annoying that I couldn t use # and * as part of the number/SIP address to call, nor was it possible to dial single-digit extensions the phone will ask you to associate a quick dial number with the key, even if quick dial has been explicitly disabled). I could also not dial a SIP address ad-hoc if I wanted to call sip:someone@sip.somewhere.org, I had to define a contact and add the Internet phone address. One can define Internet calls to be the default call type, thus routing all calls via VoIP if available. Unfortunately, once I dialed a number, the event was hardwired to the call type: I could not redial a number used previously for a VoIP call when all I had available was GSM coverage.

Gripes with the IMAP client The IMAP client, while an interesting addition to my day, turned out to be pretty unusable. The first mistake I made was to tell it to synchronise all messages in some of my larger mailboxes, which caused the phone to take tens of seconds until it switched a folder, and a few seconds just to scroll to the next screen in any given folder. I found that once any mailbox accumulates more than 100 messages, the client turns useless (Nokia s default is to synchronise 30 messages). I could tell the client to synchronise every hour, but only if I locked it to an access point, the home network . If I roamed to a different Wifi network, I could no longer connect to the IMAP server, as this access point would not be found. The phone would not let me use a different access point unless I changed the home access point, but changing that turned off the automatic mail sycnhronisation. If I say mail synchronisation, I mean header synchronisation. Even though there is an option for Headers only , it only applies to POP3; it is impossible to have the phone download message bodies automatically, only manually and then only per-message or per-folder, not for all folders at once. The IMAP client could delete messages, but it could not move a message to a different folder, nor create or delete folders. And even though I could turn off the message tone the phone would play when it received new email, it insisted on vibrating nevertheless. The only other IMAP client I found for Symbian phones is ProfiMail, which looked interesting and much more powerful, but which would randomly crash on me while browsing or operating on larger mailboxes.

Connection hickups While the an application was running that was using the network, the Wifi connection stayed open, but I could not make it stay open between sessions. The phone would obtains an IP, do what I asked it to, and then immediately close the connection. From a power management perspective, this makes sense, but not from the usability angle. I could not make the phone connect to a Wifi network that advertised both, WPA and WPA2 and had to disable WPA at home to let it connect. At times, it was not possible to reuse an existing connection. I haven t been able to figure out the details, but it seemed to me that whenever an application like the IMAP client was locked to an access point, it would be unable to make a connection to the IMAP server, even if e.g. the VoIP client was connected to the server by way of exactly the same access point. The phone would just say that a connection was already active and that I should close it and try again . I had a really hard time working with SSL-enabled websites and IMAP servers, because even though the phone presented me with the server certificate and offered the choice of accepting it permanently, it didn t and would ask the question again and again (which made the phone pretty unusable if the IMAP client was running in the background). Only after I had found out how to import the CACert root certificates, did this problem become irrelevant.

Other pet-peeves The phone came with a lot of smaller issues that made me ask the question of whether its designed ever had to use it too often. Possibly the most annoying aspect of the phone was its speed. It s a lot faster than the E61, but it still takes on the order of seconds to update screens or display simple text messages. Speaking of text messages, I am a little spoiled by the Sony Ericsson K610i (to which I now return), which would offer the contacts with whom I d recently interacted instead of presenting me with the full list, like the E51 does. I could filter the full list, but only by typing the start of the name substring matching was not implemented. It was impossible to receive text files via bluetooth and have them put onto the filesystem. On receipt, the phone just said text file saved , and it took me a while to figure out that it had stored them into the notepad, from where it could not be exported. To get my SSH identity onto the filesystem for PuTTY to use required me to access the phone via USB. The phone could receive vCards with new contacts, but it only offered to import the first contact, even though the standard allows for an arbitrary number of contacts per file. What s even worse though is that the phone silently failed to import contacts with non-ASCII characters in their name, such as or they just didn t show up even though the phone gave every indication of a successful import; creating such contacts on the phone worked, on the other hand. Each time I started the phone, the Nokia greeting screen would show up, accompanied with the Nokia tune, which could not be disabled. Enough said. The last problem I feel worth mentioning is hardly a Nokia or Symbian problem: battery life. With Wifi turned on, the phone would last about 24 hours on standby, which makes it pretty unusable for roaming Wifi or even VoIP usage.

Summing up I am happy to have sold the phone and look forward to returning to my Sony Ericsson K610i. After checking out the E61/E71 a bit, playing with the E65, and trying the E51 out for several weeks, I can conclude that Nokia has a long way to go before they can offer a usable smartphone with Wifi/VoIP capability. It would be a good step forward if they would open-source the Symbian operating system, but until that s done, I am going to look at the OpenMoko FreeRunner next. The E51 once again made it perfectly clear for me that proprietary software is no alternative for my use case. NP: Fat Freddy s Drop: Live at the Matterhorn

I managed to get my hands on a HP Media Vault mv2120, a nice ARM based NAS device, a few months ago with the intentions of porting Debian to it. Unfortunately, I have been really busy lately and most of my time was spent on adding support for the QNAP TS-109/TS-209 and TS-409 (which required a lot of generic work to get Marvell Orion support into Debian, a new SoC used in many NAS devices, including the QNAP TS-x09 and HP mv2120). There were a number of things that had to be worked out before Debian would run on the mv2120. The good news is that Marc Singer and Eugene San have done all of the heavy lifting in the last few weeks in figuring out how the mv2120 works and that now it's just a matter of putting everything together for Debian to work. Here are the issues that had to be worked out:

• Figure out how the rescue mode works and how to construct a rescue image that the device can boot: I knew that the mv2120 had a rescue mode that can be activated by keeping the the power and reset buttons pressed when starting that would request a rescue image via the network. This rescue mode can be used to start the Debian installer. Eugene San figured out how to construct a rescue image that the mv2120 would accept. Marc Singer has also written a tool, uphpmvault, to serve such rescue images from Linux.
• Figure out the best way to make one image that contains the kernel and ramdisk: the mv2120 only loads a kernel and no ramdisk, but a ramdisk is needed to start Debian. I discussed some really ugly hacks with Marc Singer to get the mv2120 to accept an image consisting of kernel and ramdisk but Marc wanted to try something else first. u-boot, the boot loader used on the mv2120, can accept something called a multipart image which can consist of a kernel and a ramdisk. When Eugene San heard that we were trying to load a multipart image, he went ahead and figured out how to construct an image that the mv2120 would boot.

Now that these two issues are resolved, I simply need to put everything together and add support for the mv2120 to a number of debian-installer components. We already have Orion kernel images in unstable that support the HP mv2120 (along with a number of other Orion based NAS devices) and the rest shouldn't take too long.

When I got home last night, I couldn t sleep and instead popped a DVD into the drive and sat back to watch an episode of the famous Tatort series (German only). Tatort ( crime site ) episodes tell the tale of police investigations, but without stuntmen and special effects, without sci-fi elements or threadbare settings and stories, without technology and gadgets. In fact, it just feels plain as if it could happen next door tomorrow. The characters are normal as you and I, but played beautifully, with witty and enjoyable dialogues, which seem familiar and natural to me as a German, rather than trying to be funny or cool. Yet, the two main investigators, Batic and Leitmayr, are awesome and it s good fun to watch them inch towards solving the mysteries. I watched the episode Norbert , and I really enjoyed it. The plot is full of surprises, and the viewer is (purposely) mislead on various occasions. It was suspenseful until the end. I ve seen maybe 20 of the thousands of episodes (it airs every Sunday night since 1970), and this one was so far my favourite. Quality television! It s a shame the (Dutch) DVDs I have do not have English subtitles. NP: Dimmer: I Believe You Are a Star

As some of you may know, the Euro 2008 football championships are on in Austria and Switzerland at the moment. I am not a football fan at all, although I won t mind watching a game between two skilled and fairplaying teams (which is becoming a rarity, I heard). But I don t care much about it, unless it negatively affects those who don t care (which includes myself). For instance, last night, after Germany beat Turkey in the semi-finals, a group of hooligans roamed about in Dresden and vandalised Turkish food shops and hurt the people working there (German only). I can kind of understand fans getting overly excited and driving their cars madly through the city, honking the horns at frequencies directly proportional to their cumulative personality disorders (or inversely proportional to their penis size), but violence in reaction to winning? Fuck you, you low pieces of shit. ! Update: there seems to be no information on whether the attackers were German. A foreigner living in Berlin has written in to complain that my blog post casts a negative light onto Germany in terms of hostility towards foreigners, which he disputes. Germany has had to fight that image for decades, and my blog post puts fresh petrol on the fire. I do not intend that. I leave it up to each individual to make up their own mind, and to me, a group of hooligans is in no way representative of an entire nation. End update Quite clearly, there are people on the street who should be locked up. I won t go there though, at least not in this post. Instead, let s talk more about football and its effects, because encouraging this sort of violence is only one of many consequences, which we are forced to tolerate in the interest of the public. Everyone wants football, right? What follows are somewhat related, but otherwise incoherent rants. Enjoy, or stop reading. I m not a misanthrope, I think. There are many other aspects of this football event which make me want to throw up. One of them is the (sight of the) average organism who participates in the craze. Look at them! Monkeys are more intelligent than that! Has evolution taken a 180 degree turn? Of course, you can t blame the individuals, as their brains have been flooded and effectively shut off, so they don t make any trouble when they trott along the path to dumbification. It s the big companies and the media industry, blinded by short sight, do everything in their power to speed up this decline, fueling the consumerism of the stupified morons making up our the populace, just for the paycheck at the end of the day. The UEFA is primarily a huge money-making machine, and if you want more information on that I suggest that you look a bit into the distribution of media rights for the event. Another instance, which has a little more relevance to the normal person on the street is their ticket distribution: people have to pay hundreds of Euros to UEFA a year before the event for a chance to be given a ticket for any random day. The ticket is made out in their name and cannot be transferred. If you can t make the game, you can return the ticket to get you money back after the event. If you don t get a ticket, you ll also get your money back a year later. Interest-free loans, anyone? But hey, I actually don t care about most of that. Let those who want to consume consume, let those who can t entertain themselves watch television, let the UEFA and media people get rich by making people stupid, and let me go about my daily business. We held a small barbeque party some days ago, and I went out to buy a few kegs of beer from a local brewery. That was my first confrontation with the football circus, as the brewery happens to be about half a kilometre from the stadium where a match was on that night. It took me at least 40 minutes until I had argued successfully with five police officers and could pick up the kegs. Swap brewery for any of the other shops in the area, who did not receive any compensation whatsoever, and you ll note how the football circus takes priority over everyone s everyday life, even if you don t give a single flying food for the sport. I love Zurich, and just like most people, taking a stroll along the lakeside, between Bellevue and the Chinese Garden on a sunny afternoon is one of the more delightful ways to spend time in the city and enjoy its beauty unless they are putting up massive public viewing areas everywhere (and make shitloads of noise in doing so), and even dump elevated VIP platforms into the lake to add noise in the view to the noise in the ear. The official entities of Switzerland surely pushed for the event, as it drives tourism and brings money into the country. But were the people actually considered? Could we have done anything against this craze? I bet noone ever asked. I find it very sad how much garbage these fan monkeys produce. Switzerland is well-organised, and there are plenty of garbage cans around, many of which have been put in place specifically for the event, but it s already too much to ask of these low organisms to put the shit left from their consumption into those bins. And I won t even go near the question of how much energy this entire event wastes. Yay entertainment! Yay stupification of the populace! If you have football to celebrate, you don t have to consider the environment, or poverty, or other such annoying issues. Sunday night, the circus will come to an end, and what ll be left is a few days of cleaning and tearing down all the structures. Then this place will finally retun back to normal, and there ll be a little less idiots on the street, at least in the places I frequent. NP: Dimmer: There My Dear

This one had been a long time in the making, but here it goes: I'm orphaning Planner. Why? Because upstream hasn't been too active in ages, save from a few random bug fixes, and because the GCC 4.3 transition at Debian has exposed yet more bugs that make it FTBFS. The package had been marked as RFA for a while, but I decided that I'm not gonna wait any longer; O it is. Hopefully, an experienced GNOME maintainer will take over and revamp the upstream code into a usable shape. If not, then I guess we just found another dead package in the archive. So be it.

Dear lazyweb: I ve been a satisfied IBM Thinkpad X40 user for about three years, and the fact that the X40 is still one of the most commonly seen laptops at geek conferences speaks for the machine. However, as my baby s end-of-warranty approaches, I am toying with the thought of a new laptop, with which I d also like to address some of the issues I have with the X40, namely that it supports at most 1024x768 pixels on the screen, is limited to 1.8 harddrives (which to my knowledge come in 40Gb and 60Gb variants only and are quite slow), and whose Pentium M 1.4GHz processor often reaches its limits, even though I rarely do very computationally-intensive stuff. On the other hand, I get a good 4 hours of battery run-time out of the machine. The Lenovo Thinkpad X61 would be a logical successor, but it has not won me over: it looks and feels a bit clunkier, has under 3 hours of battery time, and the screen is still limited to 1024x768 pixels. There s the Lenovo Thinkpad X300, which comes with a 64Gb solid-state disk which will weigh even less on the battery, but the the machine is still too expensive, it s first generation (meaning it ll have more problems than a second generation issue), and the options for extending the storage capacity seem limited. While visiting Penny in London, we passed by a number of electronics stores, and the Samsung Q45 and Q70 models attracted our attention. We would love to hear any feedback from owners out there (and maybe you could send us the output of lspci -vv, lsusb -vv and the file /var/log/dmesg, please?). After Lenovo has switched the Thinkpad power adapter plug format, I have very little reason not to look elsewhere The ultra-mobile Q45 (which would be a Thinkpad X-series competitor) comes with an Intel Core Solo, Duo, or Duo 2 processor, clocked at 1.6GHz, an Intel graphics card and the 3945BG wireless chipset (or its 4xxx successor), uses a 2.5 harddrive, and its 12.1 screen can display a resolution of 1280x800 pixels. It weight just under 2kg. We ve seen models with 3Gb of RAM and a 320Gb harddrive for a little over 1000 . The business class Q70 (a Thinkpad T-series competitor) has an Intel Core 2 Duo processor clocked between 1.8GHz and 2.4GHz, and its 13.1 display can also display 1280x800 pixels. It seems like it will require a bit of effort to find one with an Intel graphics card, though I am not going to get a laptop with anything else, mainly because of Intel s excellent dedication to open source. The devices are over 2kg in weight, and a 3Gb RAM, 320Gb harddrive version costs about 1400 . Does anyone have experience with these laptops and could speak for or against them? Also, what other laptops (not desktop replacements or lap warmers) might be worth looking at? You can leave a comment, or write to me. Thanks! NP: Oceansize: Frames

It happened a number of times now that my inbox would shrink in message count without my explicit doing. Generally, your inbox automatically emptying should be conceived a good thing, but it isn t always. It took me a while to put together the pieces:

• left over messages are all new or old, meaning not read ,
• offlineimap logs suggested that I deleted those messages on one of my workstations, before offlineimap synchronised those changes to the other machines, and
• it seems to coincide with instances of use of Mozilla Thunderbird and maybe other IMAP clients.

I think I unvealed the mystery: some IMAP clients automatically mark read messages as deleted. Don t ask me why, I did not configure it, and even though I told Thunderbird specifically not to do it, I have no other explanation than to assume that it doesn t care about what I want, but marks them for deletion anyway. Firefox decides to block cookies several times a day, despite my explicit requests to store them, and the two are from the same project, so it seems plausible. Once marked for deletion (by way of an IMAP flag), offlineimap propagates the flag to all clients. Since I set delete=yes for mutt, if I then open and close a mailbox with such messages without noticing them, the messages are purged. I gave up fighting and solved the problem at a different point, namely mutt (which was doing the deleting anyway):

folder-hook . push '<undelete-pattern>~D<enter>'

Since mutt deletes mail marked for deletion when I close a mailbox, finding those messages at time of mailbox opening must mean that they have been marked outside of the mailer I use mutt for everything, exclusively. So let s undelete them. I can t see any negative consequences of the above hook. NP: Oceansize: Efflorescence

Or theming PS1 I am not fanatical about my command prompt. No sirree, not me. It is just that I spend half my life either staring at an Emacs window, or at an xterm command prompt; so even a marginal boost in productivity goes a long way. And I am often logged in over ssh to machines half a continent away, and am still comfortable enough on the Linux VT to spend time there, and I often do not have the GUI gew-gaws feeding me data. Hmm. Data. inpuuut. No. Must focus. With all these open xterms and Emacs terminal mode frames floating around, it is easy to lose track of where I am on each terminal, and what the working directory is. So I want my command prompt to help me keep track of where I am. If the terminal is an xterm, the title can be setup like

 "user@host:../shotened/path/to/current/working/dir"

I want to know what machine, id (am I root?), and directory I am in. If I am deep down in the labyrinths of some work related directory tree, I want the path to be pruned, from the left, one component at a time. However, this does not help me on the console; so I also want the path to be in the command prompt; but it should not take up too much of the command line; and ideally, should just go away as I type a longish command. Gawd, I love zsh. I once did a analysis of the command history. The most often used command sequences were

 cd some-place, ls

So. pwd and ls. I really really want to see the directory listing when I change directory to a new one. As one grows old, memorizing the directory contents for dozens of machines all the time taxes the gray cells a bit. So, I figure, why not let the command prompt handle all that? Having the current working dir always visible cuts down a heck of a lot on the pwd commands, and so all that s left is to insist that the command prompt thingy always run ls after a change directory. Simple enough. Saves on typing. And time. And this is not just some crazy talk. I want help with noticing whether the previous command exited with an error status (useful for commands that normally do not create an output). If I am logged in to a machine on battery power, I want to know that. I also like visual cues to the amount of power remaining (good for my laptop on the long flights). I don t want to have to know f the machine uses APM or ACPI, I just want my prompt color to change as the power fades. I want my command prompt to let me know if I am in a directory which is under version control, and if so, what branch I am on. (I occasionally have to come in contact with arch, bzr, git, subversion, svk, and mercurial). If I am in a version controlled project, where I am relative to the root of the checked out tree is often more important than the absolute path, so I want to see relative paths, not absolute paths. I want to know if there are uncommitted files in the working directory. Visually. I want to be reminded if I am in the middle of an ongoing

 rebase -i .

This is not asking for too much, is it? So, here is a screen-shot of this in action: I start from my home directory, go to a directory not under version control, go to a project under git, then a different project with uncommitted files, and then finally to a subversion checkout. All with an angry fruit salad of colors warrantied to make Martin Krafft want to claw his eyes out . If you use zsh, then just grab hold of this, and then do:

 autoload -U promptinit
 promptinit
 prompt manoj

This might be a bit of a hit on slow machines, but even my laptop is a core 2 duo, so I do not find it noticeable. Oh, and if you liked this article, you might also like Theming Emacs, and Theming XTerms.

Thanks to Oliver Grawert and Michael Haas for this idea!

1. Check your LTSP server's sources.list Ensure that the server has the relevant APT sources to fetch the latest updates:

   deb http://security.ubuntu.com/ubuntu hardy-security main universe restricted multiverse
   #deb-src http://security.ubuntu.com/ubuntu hardy-security main universe restricted multiverse
   deb http://fi.archive.ubuntu.com/ubuntu/ hardy-updates main universe restricted multiverse
   #deb-src http://fi.archive.ubuntu.com/ubuntu/ hardy-updates main universe restricted multiverse
   deb http://fi.archive.ubuntu.com/ubuntu/ hardy main universe restricted multiverse
   #deb-src http://fi.archive.ubuntu.com/ubuntu/ hardy main universe restricted multiverse
   deb http://ppa.launchpad.net/q-funk/ubuntu hardy main
   #deb-src http://ppa.launchpad.net/q-funk/ubuntu hardy main

   In this example, the Finnish Ubuntu mirror for the Hardy suite is used. Change this as necessary. Notice that all source package lines are purposely commented out.
2. Build a boot image using that sources.list Build the image using the following command:

   ltsp-build-client --copy-sourceslist --accept-unsigned-packages

   This builds the image using the repositories found in the server's sources.list. Accepting unsigned packages is necessary, because the PPA is not digitally signed.

The above method is a good way to check what would happen on a clean install, if any particular package were updated to a newer proposed release that is currently sitting on someone's PPA. Enjoy!

It happens from time to time that bug reports I file receive attention, but I don t notice because our bug tracking system still does not auto-subscribe bug submitters to their own bugs (see bug #37078 and bug #351856). I thus decided to take the matter into my own hands. Just in time, before I started hacking this up myself, I found Justin Pryzby s procmail recipies, which are installed to /usr/share/doc/devscripts/examples/bts_autosubscription.procmail by the devscripts package. The result is available in my mailfilter git repository. So far, I only auto-subscribe in response to bugs I file; Justin also auto-subscribes to bugs he manipulates via the control bot. For completeness, I also wanted to subscribe to all bugs that I have submitted. This turned out to be easier than I thought, thanks to bts in the devscripts package; note the sleep instruction in the loop to prevent hammering the system:

bts select submitter:madduck@debian.org \
    while read bugno; do
      echo X-debbugs-autosubscribe: madduck \
          sendmail -f madduck@debian.org $ bugno -subscribe@bugs.debian.org
      echo subscription to \#$ bugno  sent
      sleep 30
    done

NP: The Dukes of Leisure: The Dukes of Leisure

Even though I ve dealt with IPv6 for almost a decade, have delivered presentations, and given multi-day courses on IPv6 security aspects, I ve never actually added IPv6 to my own server/home network infrastructure because it seemed that Linux and/or Debian just weren t ready for it. This seems to have changed (although there are still a number of problems) and in less than a day, I put a few of my machines online. In the following, I d like to share with you how I did it.

Kernel versions and stateful connection tracking Unfortunately, I have to start off with some bad news: even though Debian etch, our current stable release, which uses a Linux kernel version 2.6.18, speaks IPv6, I cannot recommend it for deployment, as the 2.6.18 kernel does not support proper stateful connection tracking for IPv6, and thus makes it impossible to firewall hosts in a sensible manner (I always add local packet filters to all my hosts, and if only to guard against the situation when a user installs a malicious programme to listen on a high port). Of course, it is possible to configure a packet filter statelessly in an acceptable manner once you know the use case, so do with this information what you wish; I prefer to stay general for now. For me, a remedy is almost around the corner: the 2.6.24 kernel seems to support stateful connection tracking for IPv6, and it s even available for etch as it will be included in the upcoming etch-and-a-half release. I simply ended up using the kernel packages pre-release, and so far have not had a problem with it. To do so, add the following line to your /etc/apt/sources.list, making sure to use a close archive mirror:

deb http://ftp.xx.debian.org/debian etch-proposed-updates main

I then just upgraded the system and pulled in all proposed updates. As that may have let in software that won t be part of etch-and-a-half, or even lenny, you may want to pin the archive and only upgrade the kernel packages, by adding to /etc/apt/preferences (replacing amd64 with your architecture):

Package: *
Pin: release a=proposed-updates
Pin-Priority: -1
Package: linux-image-2.6.24-etchnhalf.1-amd64
Pin: release a=proposed-updates
Pin-Priority: 600

Alternatively, you could use the 2.6.24 linux kernel packages on backports.org.

Xen and IPv6 One drawback of switching to 2.6.24 is that you cannot run a dom0 on that machine any longer, so by practical extension, you cannot connect it to the IPv6 network with a packet filter in place. Supposedly, running 2.6.24 instances on a 2.6.18 dom0 is reported to work, however.

Configuring the packet filter The first thing I did was to configure the packet filter on each host appropriately. Unfortunately, this is harder than it should be, because to quote one of the netfilter developers when ip6tables was conceived, someone had a big bad brainfart : rather than adding IPv6 rules to your existing iptables ruleset, you have to create a new ruleset, duplicate all chains, networks, hosts, and individual rules, and maintain the two in parallel. Even though there are efforts of unification on the way, I speculate it ll take another couple of years until PF_INET6 will be fused into PF_INET and one will be able to do sensible cross-address-family packet filtering with Linux. Since I ve recently started to look (again) at pyroman, maybe the most logical way forward would be to extend it to write both, IPv4 and IPv6 rulesets from its knowledge about the hosts and networks you configured. Anyway, we want to get stuff working now! Thus, let s configure ourselves a packet filter. (Almost) all IPv6-related filtering must be configured via ip6tables (read on further down about IPv6 in IPv4 tunneling, the reason I said almost ). The following is a simple default ruleset to start with, which I put into /etc/network/ip6tables to load with ip6tables-restore:

*filter
:INPUT REJECT [0:0]
:FORWARD REJECT [0:0]
:OUTPUT ACCEPT [0:0]
:in-new - [0:0]
### INPUT chain
# allow all loopback traffic
-A INPUT -i lo -j ACCEPT
# RT0 processing is disabled since 2.6.20.9
#-A INPUT -m rt --rt-type 0 -j REJECT
# allow all ICMP traffic
-A INPUT -p icmpv6 -j ACCEPT
# packets belonging to an establish connection or related to one can pass
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# packets that are out-of-sequence are silently dropped
-A INPUT -m state --state INVALID -j DROP
# new connections unknown to the kernel are handled in a separate chain
-A INPUT -m state --state NEW -j in-new
# pass SYN packets for SSH
-A in-new -p tcp -m tcp --dport 22 --syn -j ACCEPT
# log everything else
-A INPUT -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[INPUT6]: "
### OUTPUT chain
# RT0 processing is disabled since 2.6.20.9
#-A OUTPUT -m rt --rt-type 0 -j REJECT
# allow outgoing traffic, explicitly (despite chain policy)
-A OUTPUT -j ACCEPT
### FORWARD chain
# RT0 processing is disabled since 2.6.20.9
#-A FORWARD -m rt --rt-type 0 -j REJECT
# disallow forwarded traffic, explicitly (despite chain policy)
-A FORWARD -j REJECT
COMMIT

Note that this recipe is pretty much unusable on pre-2.6.20 kernels due to their broken implementation of stateful connection tracking. The ruleset should be fairly obvious, but you might wonder about my use of REJECT and allowing all ICMP after all, you ve heard for the past 30 years that ICMP is a bad hacker protocol , and Internet security is no domain for being nice to people, so to prevent any information disclosure, you should DROP connections, not let people know that they re simply not allowed. Well, to hell with all that! I don t see a single reason or attack vector that is foiled by DROP or disallowing ICMP. In fact, it s just security by obscurity, and might inconvenient at the same time. ICMP is also much more important with IPv6 than with IPv4 (it replaces ARP, for instance), and it s actually useful to be able to ping hosts, or get back informational messages on why something failed. Finally, rejecting traffic rather than dropping it doesn t suggest to a hacker that something s hidden here. Then there is RFC 4890, which almost made me puke. This document is part of the reason why I say: let s fix problems in the kernel, rather than shielding them with unreadable and unmanageable rulesets!

Getting connected If you already have an IPv6 address, you re basically ready to go, but may want to read further down on how to connect your local network to the IPv6 Internet as well. If you are searching for a provider, have a look at the list of providers with native IPv6 connectivity over at sixxs.net. If you are reading up to here, I assume you are connected to the Net with IPv4. There are two ways for you to move towards IPv6: 6to4 or by way of a tunnel provider. A Kiwi website explains how to setting up 6to4 connectivity, and thus I will concentrate only on the tunnel approach. Even though everyone can set up 6to4 in a breeze without any accounts or waiting, there are a number of security considerations, it s pretty ugly to debug (due in part to asymmetric routing), and makes your life unnecessarily difficult when all you have is a dynamic IP that changes from time to time. If you are stuck behind a NAT gateway, you cannot use 6to4 either. Thus, I prefer the tunnel approach. With the tunnel approach, IPv6 packets are wrapped up in IPv4 packets on your host, and sent to the IPv4 address of your tunnel provider, who has native IPv6 connectivity. The tunnel provider unwraps your packet and shoves the contained IPv6 packet onto the backbone. The IPv6 address you used as source address is routed to the tunnel provider, so any replies arrive at their machines, where they re again wrapped into IPv4 packets and sent to your (publicly-accessible) IPv4 address. Those IPv4 packets specify payload type 41 ( ipv6 ), which is why we need those -p ipv6 -j ACCEPT rules in the iptables ruleset. There are a few tunnel providers out there. I chose SixXS and have not regretted my choice. I shall thus assume that you do the same: sign up for an account right now, so that you have it by the time you finished reading this document! SixXS works on a credit system: tunnels and subnets cost credits, which you can accumulate by maintaining your tunnels properly. This ensures that everyone can play around, but to do more advanced stuff, you need to first display competence with the basic concepts. Your first step with SixXS will be to request a tunnel. SixXS offers three types of tunnels:

• static tunnels, for those with static IPs,
• heartbeat tunnels, for those with dynamic IPs, and
• AYIYA tunnels, for those behind NAT gateways.

Each of these tunnels have advantages and disadvantages, as everything does: the first two types of tunnels use IP protocol 41 packets to encapsulate the IPv6 packets. As such, there are security considerations involving the impersonation by spoofing, and all upstream firewalls must let protocol 41 pass. AYIYA addresses these problems by using signed packets, but that solution comes with extra computation overhead and smaller MTUs. I suggest to use the first type of tunnel that fits your situation. Debian s aiccu package can take care of heartbeat and AYIYA tunnels for you, and it can even set up static ones. During registration, you will also need to choose a PoP , which stands for Point of Presence . If your country only has a single PoP, that s the one you will end up using (unless you have a good reason for another one), but if there are more options, I strongly suggest that you go through the list of PoPs and select the one with the best roundtrip time and lowest latency from your location! Note that you must answer ping requests (ICMP echo-request) from the PoP you chose, or else the tunnel will not be created. Once your tunnel request gets approved, you ll get a /64 prefix, in which you only use two addresses: the PoP will configure the :1 address and you need to configure your host to use the :2 address on the tunnel interface. You ll also be told the IPv4 address of your PoP endpoint . Joey Hess taught me that aiccu can set up the interface for you, using the data it queries from the SixXS registration (TIC) server. I tried it, and it works. However, I prefer the pure ifupdown approach, as it makes things explicit and allows me to use the hooks for stuff like loading the packet filter. So in my /etc/network/interfaces, you can find:

auto sixxs
iface sixxs inet6 v4tunnel
  endpoint 194.1.163.40
  address 2001:41e0:ff00:3b::2
  netmask 64
  gateway 2001:41e0:ff00:3b::1
  ttl 64
  pre-up ip6tables-restore < /etc/network/ip6tables
  up ip link set mtu 1480 dev $IFACE
  up invoke-rc.d aiccu start
  down invoke-rc.d aiccu stop

Make sure to read about MTU values of the tunnel and adjust the 1480 value in the above to your tunnel settings and ISP connectivity. Also set ipv6_interface sixxs in /etc/aiccu.conf, if you are using aiccu, or else aiccu will bring up a duplicate/additional interface. If you tell it to use the same interface, it will actually execute all the same commands (which will fail), but won t report any errors. A future version will have a switch to prevent it from configuring the interface. Unfortunately, this will probably not work. The reason is that your regular IP packet filter (iptables, without the 6) doesn t let those encapsulating IPv4 packets pass, unless we tell it to; we probably want to do this early on in the chain, and also limit it to our tunnel peer, so:

iptables -I INPUT -p ipv6 -s 194.1.163.40/32 -j ACCEPT

For AYIYA, you need to open port 5072, either for UDP, TCP, or SCTP, depending on how you configured it. Also have a look at this FAQ entry on what a firewall needs to pass. If it still doesn t work, you have an upstream packet filter that needs some of those holes poked. Good luck. In most situations, the FORWARD chain does not get such a rule, since the tunnel terminates at the gateway, which routes to a native IPv6 network, or another tunnel. Allowing tunnels through a gateway is almost always a bad thing, as it would allow undetected and untraceable traffic from compromised boxes in the local network. The OUTPUT chain also does not need such a rule, if you have configured stateful filtering properly. Now bring up the interface and verify the connection:

# ifup sixxs
# ping6 -nc1 2001:41e0:ff00:3b::1
PING 2001:41e0:ff00:3b::1(2001:41e0:ff00:3b::1) 56 data bytes
64 bytes from 2001:41e0:ff00:3b::1: icmp_seq=1 ttl=64 time=74.0 ms
[...]
# ping6 -nc1 ipv6.aerasec.de
PING ipv6.aerasec.de(2001:a60:9002:1::184:1) 56 data bytes
64 bytes from 2001:a60:9002:1::184:1: icmp_seq=1 ttl=55 time=91.5 ms
[...]

Welcome to the Internet of the future!

Setting up an IPv6-capable gateway Your IPv6 connection works, but it s limited to a single address, and you do not get to specify the reverse DNS PTR record for it. Since the concept of NAT is mostly absent from IPv6 (thanks! thanks! thanks!), you will not be able to connect any other hosts to the IPv6 network. If your local network has a few hosts behind a gateway, you will need to request a subnet from SixXS and configure your gateway (which has the tunnel connection) appropriately. Don t worry, this is not really very difficult. First, request a subnet for your tunnel from your PoP via your SixXS homepage. Once approved, you will get a /48 prefix for your own use: 2^80 1.2 heptillion addresses which are yours to assign to every dust particle in your office or home, if you so desire. The way I set it up is to add the first of these addresses to your internal interface on the gateway, by adding the following two lines to the interface s stanza in /etc/network/interfaces; you will need the iproute package installed (which you should be using for everything network-related anyway):

up ip -6 addr add 2001:41e0:ff12::1/64 dev $IFACE
down ip -6 addr del 2001:41e0:ff12::1/64 dev $IFACE

Instead of bringing the interface down and up, just run ip -6 addr add 2001:41e0:ff12::1/64 dev eth0. Note the use of the /64 prefix instead of the /48 that got assigned, leaving only 20 pentillion addresses. Oh no! The reason for this is buried in the specs: basically, /48 is a site prefix, but individual networks should not be larger than /64, which is the prefix length of links in the IPv6 domain. Now is also a good time to enable IPv6 forwarding, e.g. like so:

# echo net.ipv6.conf.all.forwarding = 1 >> /etc/sysctl.conf
# sysctl -p /etc/sysctl.conf

Obviously, you will also need to change the policy on the ip6tables FORWARD chain. For now, let s just set it to accept. You should later create a proper ruleset, though!

# ip6tables -I FORWARD -j ACCEPT

Bringing IPv6 to your local network The final step is to spread the love to your local network. Refrain from selecting addresses from your subnet and assigning them to the local hosts, or wondering how to configure the DHCP server, because IPv6 does it differently: your gateway will advertise its routes (which includes a default route) to your network, and each host will pick an address based on its MAC address (unless it already has an EUI-64 address assigned. This all happens automagically, at least with current Debian and Windows machines. On the gateway, you need to install radvd and simply tell it which prefix to use on which interface. My /etc/radvd looks like this, and I won t explain it:

interface eth0
 
  AdvSendAdvert on;
  prefix 2001:41e0:ff12::/64
   
   ;
 ;

Note again how we advertise a /64 network rather than the /48 we own . You cannot advertise smaller networks if you want automatic configuration to work, and you should not use networks larger than /64 in any case. If 2^64 addresses are not enough for you, I trust you ll be able to figure out how to advertise another of your 65536 /64 prefixes in the /48 subnet to appropriate hosts. Restart radvd and run over to another host to witness how it automagically gets connected to the IPv6 network by scanning /var/log/kern.log and watching the output of ip -6 addr and ip -6 route. Try ping6ing from there! Find the dancing turtle! It should all work. If you don t like the automagic aspect of this, look into stateful configuration, using DHCPv6, as provided by dibbler-server and ?wide-dhcpv6-server.

Resolving names Take note of the IPv6 address of each host. There s a way to determine it given the host s MAC address, but this is easier (ipv6calc is also useful). You might want to let your local DNS server know by adding AAAA records in parallel to the existing A records, and possibly even adding PTR entries. If you re serious about IPv6, you can tell SixXS to delegate reverse lookups for the IPv6 addresses to your DNS servers, but you ought to refrain from polluting the DNS namespace. Note that bind9-host provides an improved host tool, which fetches all kinds of information about names, not just the one single information configured as default:

% host pulse.madduck.net
pulse.madduck.net has address 130.60.75.74
pulse.madduck.net has IPv6 address 2001:41e0:ff1a::1
pulse.madduck.net mail is handled by 99 b.mx.madduck.net.
pulse.madduck.net mail is handled by 10 a.mx.madduck.net.
% host 2001:41e0:ff1a::1
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.a.1.f.f.0.e.1.4.1.0.0.2.ip6.arpa
domain name pointer pulse.madduck.net.

Oh, and if you re really that curious about how IPv6 addresses are computed from MAC addresses, read RFC 2464. Basically, given a prefix 2001:41e0:ff1a:: and a MAC address aa:bb:cc:dd:ee:ff, the resulting IPv6 address is obtained by:

1. inserting ff:fe into the middle of the MAC address to yield aa:bb:cc:ff:fe:dd:ee:ff;
2. flipping the second lowest bit of the first octet to yield a8:bb:cc:ff:fe:dd:ee:ff;
3. removing the odd colons to yield a8bb:ccff:fedd:eeff, the EUI-64;
4. concatenating the prefix and this result to get 2001:41e0:ff1a::a8bb:ccff:fedd:eeff.

If you find your (Windows) IPv6 addresses changing all the time, you might be faced by privacy features .

Remaining issues Even though my IPv6 connectivity works, I have two remaining issues.

Sending larger amounts of data to the network I am experiencing a curious issue where outgoing ssh IPv6 connections time out and outgoing data transfers hiccup. I have yet to find out what s going on.

Mapping names to laptops Laptops generally have two interfaces, one with a cable, and the other wireless. Both of these interfaces will have separate MAC addresses, and by extension, the laptop will have different IPv6 addresses depending on how it is connected to the local network. I want to be able to connect to laptops without knowing the medium they use to connect to the network. Unfortunately, there seems to be no feasible way. The solutions I see are:

• override the MAC address of one interface with that of the other, which is going to cause bgi problems in the case when the laptop (accidentally) gets connected to the same network twice;
• add both IPv6 addresses as AAAA records to the laptop s DNS name, which will cause random delays when connecting as the resolver may return the currently inactive address first;
• set up mobile IPv6, e.g. by following this Mobile IPv6 how-to, which would allow accessing the laptop uniformly, no matter where in the world it is. Unfortunately, Debian s support for Mobile IPv6 is severly lacking at time of writing. Also, Yves-Alexis Perez notes that this how-to is horribly outdated and promised to tend to it Real Soon Now .

The second solution works for me for now, but I am interested in the third. In response to this document, Andreas Henriksson has suggested the replace the stateless configuration (radvd) with stateful configuration, using DHCPv6. I have yet to investigate this option. Jeroen Massar suggests to unite cable and wireless into a bridged interface, which seems like a very good idea.

Credits Thanks to Bernhard Schmidt, William Boughton, and Jeroen Massar, and everyone on #ipv6/irc.freenode.org for their help over the past few weeks, and all those who fed back comments in response to this document!

If you re trying to blow up an airplane, and you re hip and plan to use liquids to take down the silver bird, the following tips may be useful to you:

• Should your liquid containers not all fit into the one-litre resealable bag, just use two. Leave one of them in your bag and put the other into the plastic box through the x-ray machine. It seems like security checkers don t notice or care.
• Alternatively, if you need a few more millilitres of liquid or gel, put it in a tube or bottle and write on it Novartis, Roche, Bayer, or any other known manufacturer of pharmaceuticals; make up fancy names or use existing ones. Be creative, although you don t have to. Even though the EU regulations dictate that only prescription medicine is exempt from the volume restrictions, noone has yet confiscated my tube of Voltaren, nor questioned it, and I ve had it with me on every trip for three years, at least. If desiging your own tube is too much, empty out an existing tube and refill it. Baby food containers work too, but then you ought to bring a baby along for credibility.
• If your detonation strategy involves more than one litre of liquid, don t give up. Writing 100ml on a 200 millilitre container should fool most of the security checkers. I ve tried it, taking the label off a 75ml deodorant spraycan and putting it on a 150ml shaving cream can, and at least in D sseldorf, they seemed pleased.
• If your explosive substance s amount is indicated in weight rather than volume (like yoghurt), be prepared to lie. Should the substance put 150g on the scale, make the label read 100g; the concept of density is beyond the brain capacity of your average checker, and I found it pointless to explain to them that one gramme is very rarely the same amount as one millilitre.
• Consider flying out of a non-German airport, where they won t let you take just a deodorant spray can and nothing else without a bag; you ll also have to buy a bag for one Euro in these places, while at Zurich or Dublin airports, you get those bags for free at least. (Remind me why we pay extraordinary amounts of airport taxes again?)

Of course, if you re serious about blowing up an aircraft, you re probably not going to need any of the above, as you ll already have a more convenient way to get your substances on the plane. At the checkpoint, you ll behave like the perfect citizen abiding by all rules; you wouldn t want to arouse suspicion, now would you? PS: this post purposely avoids the use of the word terrorist . PPS: of all the great experiences in airports this week, I especially loved how passengers, who checked in at the counters (and had to present their passports there), were again checked after border control in D sseldorf, while passengers like myself, who used the quick check-in terminals, were just waved through. NP: Disturbed: The Sickness

Martin Krafft did a nice, if overly complicated writeup on disk encryption with Debian. Martin stated his main motivation for the setup he describes is having separate filesystems whilst still employing encryption, and not entering a passphrase per filesystem at boot. My laptop is encrypted. I have multiple filesystems, and I only enter one passphrase at boot. I used the standard installer and did nothing beyond what it offered me. I'm using LVM. I have an encrypted root filesystem and an encrypted PV for LVM, and that's the end of my partitioning.

...that Skype might be willing to port the Linux version of their application to Pulse Audio, as long as they get all the help they need to make this a quick and painless process. Rumor also has it that yours truly will have a visit from a Skype insider tomorrow at 13:00 EET to discuss this issue and, hopefully, be in a position to point the insider to a member of the PulseAudio community willing to guide them through this process. Rumor also has it that volunteers who contact yours truly on time to announce themselves might improve this port's chances of actually happening.