Hey, long time no see! Okay, so what's new in FusionForge land these days? Well, I guess the most prominent news is that we've just declared 5.2 stable. It's been uploaded to fusionforge.org already, and Debian packages are on their way to Debian unstable. Yay! Not-yay: the final weeks convinced us that the state of the 5.2 release candidates, and especially the packages in Debian Wheezy, wasn't near good enough for inclusion in a stable Debian release. So the packages won't be officially part of Wheezy when it comes out, to our great shame. The packages from unstable should work fine however, and we'll provide backports via the official Debian channel, backports.debian.org as soon as possible. And finally: the developers (and some users) of FusionForge will gather for a work session in Paris on the 10th of October, as described on the Meeting/Oct2012 page on the FusionForge wiki. Join us if you're interested!

Last week, I was invited to give a talk about my Debian bootstrapping efforts at IRILL in Paris. The slides of my talk are online as pdf. The time I spent in Paris with Pietro Abate was very fruitful. I have to thank him and Roberto di Cosmo for inviting me and even compensating for my travel expenses. The things we actually managed to implement during my visit:

• removed huge chunks of code that were not needed anymore, making everything more concise and pretty: ended up removing over 1600 lines
• basebuildsystem.ml can now fill add-cross-sources.list with sources for debhelper (as debhelper is quite build-essential)
• start evaluating Gentoo as a source for reduced build dependencies
• add unit test skeleton and material
• compile with dose3 master
• add graphML output
• feed graphs into analysis tools for visualization

The two most important things (in my opinion) that we came up with for future implementation, were the idea to harvest reduced build dependency information from Gentoo as well as finding a flaw in the way the current dependency graph relates to binary packages and their installation sets. I am still busy with evaluating output from my trials with Gentoo, so I will cover this topic in a later blog post once I generated the actual impact on the dependency graph. The current status is, that Gentoo USE flags allow me to find possibly droppable build dependencies for 250 out of the 350 interesting Debian source packages that are part of the main scc. Pietro also found a current flaw in how the dependency graph is generated. While source package A and B might both depend on binary package C (and its installation set), it is wrong to add a dependency to C from both source packages without further verification. Due to virtual packages and disjunctive dependencies, C might have many possible installation sets. Only one of them is chosen in the current code. The problem is, that this one chosen set might conflict with the other build dependencies of source packages depending on C. Therefor, there must exist multiple binary package nodes C, each with a different installation set, dynamically generated as they are needed. Source packages must point to the node for C that possesses an installation set that doesnt conflict with its own build dependencies. Other TODO notes that we came up with and that I will be implementing are:

• integrating dose3 as a git submodule
• create a proper build system
• try using a different cudf solver
• unit tests
• finally coming up with a name (suggestions welcome - I'm bad at name-finding)
• building a Debian package (depends on having a name first)
• formalize/visualize/document the current algorithms
• to break the main scc, use additional heuristics like:
  • the order induced by reduced_dist to classify nodes in the graph
  • centrality/distance in graph
  • comparing scc of different Debian snapshots with each other

As I cannot always depend on new dose3 versions being pushed to Debian Sid right after their release, I will do the dose3 git submodule integration over the weekend. This will allow me to evaluate the results I got from my evaluation of Gentoo USE flags that I gathered over the past week.

So, yay! Title says it all! On Saturday September 22, Regina and I got married in my parents' house, in Cuernavaca, Morelos. We had a very very nice little party with our family and a small group of friends Of course, due to the nature of our life, we could not forego inviting our family and friends in Argentina, as well as those in other parts of the world, so we set up a simple video stream so that our friends could follow along And they did, with much greater success than what I expected! So, besides those people present with us in Cuernavaca, we had people tuning in (at least to the degree I could get from the log files) from Argentina (Buenos Aires, Paran , Formosa), Austria, Canada, France, Germany, Hungary, Italy, Macedonia, Mexico, Poland, Spain, Sweden and the United States. This next Saturday (September 29) we will have a second party, to which our friends in Mexico are invited, at home. And for the people from far away,, the stream will be available again Expect at least one interesting surprise :) PS- Visit also our wedding page, with some photos, video, and general information (Warning! Part of it is outdated by now)

The only mail-filing feature that is consistently available across all mail clients (web, mobile, desktop) and most often via a convenient button, keypress or gesture, is Delete. For a long time, I've had an email work-flow that involved archiving most mail: saving both sent and received mails to a series of folders, so I could refer back to them if necessary (and they turned up in search results). Lots of mail clients make this easy: Thunderbird supports defining an Archive folder and pressing 'a' when a mail is highlighted will move it into Archive/YYYY. Mutt, of course, can be configured to do almost anything, and I've had it set up to move mail into =archive when you hit 'a' for a long time. Sadly, other clients are not as friendly. Outlook doesn't support anything quite so convenient. Mobile clients on Android, iPhone etc. don't have easy archiving support. Neither do webmail clients like OWA. Increasingly, I check my work mail on the go: waiting for a lift, on the train to work, in a irrelevant part of a meeting, waiting for a coffee refill, etc. However, I can rarely file mail this way: I learn facts, I can react to things quickly, but I can't keep my inbox under control. For this reason I'm adjusting my workflow around 'Delete'. For work, I've set up an Exchange filter to automatically copy any message that lands in my Inbox into an Archive folder. This was surprisingly difficult to get right, and there are ongoing problems with conversation view and other things. However, once that is in place, I can merrily delete stuff from my Inbox with impunity, safe in the knowledge that I can still get stuff via search if needed. I'll need a separate process to further organise filtered mail, but that's fine. Launching mutt or Thunderbird specifically to shuffle mail into e.g. archive/2012 works for me. I still need to run my mail archiving script to extract attachments on occasion anyway.

I ve just read Diego s response to an ill-informed NYT article about data-center power efficiency [1]. This makes me wonder, how much server use does each person have? Google Almost everyone uses Google, most of us use it a lot. The main Google product is also probably the most demanding, their search engine. In a typical day I probably do about 50 to 100 Google searches, that sounds like a lot, but half of them would probably be for one topic that is difficult to find. I don t think that I do that many Google searches because I generally know what I m doing and when I find what I need I spend a lot of time reading it. I m sure that many people do a lot more. Each Google search takes a few seconds to complete (or maybe more if it s an image search and I m on a slow link), but I think it s safe to assume that more than a few seconds of CPU time are involved. How much work would each Google search take if performed on a single system? Presumably Google uses the RAM of many systems as cache which gives a result more similar to a NUMA system than one regular server working for a longer time so there is no way of asking how long it would take to do a Google search with a single server. But I m sure that Google has some ratio of servers to the rate of requests coming in, it s almost certainly a great secret, but we can make some guesses. If the main Google user base comprises people who collectively do an average of 100 searches per day then we can probably guess at the amount of server use required for each search based on the number of servers Google would run. I think it s safe to assume that Google doesn t plan to buy one server for every person on the planet and that they want to have users significantly outnumbering servers. So even for core users they should be aiming to have each user only take a fraction of the resources that one server adds to the pool. So 100 searches probably each take more than 1 second of server use. But they almost certainly take a lot less than 864 seconds (the server use if Google had one server for every 100 daily requests which would imply one server for each of the heavier users). Maybe it takes 10 seconds of server use (CPU, disk, or network whichever is the bottleneck) to complete one search request. That would mean that if the Google network was at 50% utilisation on average then they would have 86400*.5/10/100 == 43 users per server for the core user base who average 100 daily requests. If there are 80M core users that would be about 2M servers, and then maybe something like another 4M servers for the rest of the world. So I could be using 1000 seconds of server time per day on Google searches. I also have a Gmail account which probably uses a few seconds for storing email and giving it to Fetchmail, and I have a bunch of Android devices which use Google calendars, play store, etc. The total Google server use on my behalf for everything other than search is probably a rounding error. But I could be out by an order of magnitude, if it only took 1 second of server use for a Google search then I would be at 100 server seconds per day and Google would only need one server for every 430 users like me. Google also serves lots of adverts on web sites that I visit, I presume that serving the adverts doesn t take much resources by Google standards. But accounting for it, paying the people who host content, and detecting fraud probably takes some significant resources. Other Big Services There are many people who spend hours per day using services such as Facebook. No matter how I try to estimate the server requirements it s probably going to be fairly wrong. But I ll make a guess at a minute of server time per hour. So someone who averages 3 hours of social networking per day (which probably isn t that uncommon) would be using 180 seconds of server time. Personal Servers The server that hosts my blog is reasonably powerful and has two other people as core users. So that could count as 33% of a fairly powerful server in my name. But if we are counting server use per USER then most of the resources of my blog server would be divided among the readers. My blog has about 10,000 people casually reading it through Planet syndication, that could mean that each person who casually reads my blog has 1/30,000 of a server allocated to them for that. Another way of considering it is that 10% of a server (8640 seconds) is covered by me maintaining my blog and writing posts, 20% is for users who visit my blog directly, and 3% is for the users who just see a Planet feed. That would mean that a Planet reader gets 1/330,000 of a server (250ms per day) and someone who reads directly gets 1/50,000 of a server (1.72s per day) as I have about 10,000 people visiting my blog directly in a month. My mail server which is also shared by a dozen or so people (maybe that counts as 5% of a server for me or 4320 seconds per day). Then there s the server I use for SE Linux development (including my Play Machine) and a server I use as a DNS secondary and a shell server for various testing and proxying. Other People s Servers If every reader of a Planet instance like Planet Debian and Planet Linux Australia counts as 1/330,000 of a server for their usage of my blog, then how would that count for my own use of blogs? I tend to read blogs written by the type of people who like to run things themselves, so there would be a lot of fairly under-utilised servers that run blogs. Through Planet Debian and Planet Linux Australia I could be reading 100 or more blogs which are run in the same manner as mine, and in a typical day I probably directly visit a dozen blogs that are run in such a manner. This could give me 50 seconds of server time for blog reading. Home Servers I have a file server at home which is also a desktop system for my wife. In terms of buying and running systems that doesn t count as an extra server as she needs to have a desktop system anyway and using bigger disks doesn t make much difference to the power use (7W is the difference between a RAID-1 server and a single disk desktop system). I also have a PC running as an Internet gateway and firewall. Running servers at home isn t making that much of an impact on my computer power use as there is only one dedicated 24*7 server and that is reasonably low power. But having two desktop systems on 24*7 is a significant factor. Where Power is Used/Wasted No matter how things are counted or what numbers we make up it seems clear that having a desktop system running 24*7 is the biggest use of power that will be assigned to one person. Making PCs more energy efficient through better hardware design and better OS support for suspending would be the best way of saving energy. Nothing that can be done at the server side can compare. Running a server that is only really used by three people is a significant waste by the standards of the NYT article. Of course the thing is that Hetzner is really cheap (and I m not contributing any money) so there isn t a great incentive to be more efficient in this regard. Even if I allocate some portion of the server use to blog readers then there s still a significant portion that has to be assigned to me for my choice to not use a managed service. Running a mail server for a small number of users and running a DNS server and a SE Linux development server are all ways of wasting more power. But the vast majority of the population don t have the skills to run their own server directly, so this sort of use doesn t affect the average power use for the population. Nothing else really matters. No matter what Google does in terms of power use it just doesn t matter when compared to all the desktop systems running 24*7. Small companies may be less efficient, but that will be due to issues of how to share servers among more people and the fact that below a certain limit you can t save money by using less resources particularly if you pay people to develop software. Conclusion I blame Intel for most of the power waste. Android phones and tablets can do some amazing things, which is hardly surprising as by almost every measure they are more powerful than the desktop systems we were all using 10 years ago and by many measures they beat desktop systems from 5 years ago. The same technology should be available in affordable desktop systems. I d like to have a desktop system running Debian based on a multi-core ARM CPU that can drive a monitor at better than FullHD resolution and which uses so little power that it is passively cooled almost all the time. A 64bit ARM system with 8G of RAM a GPU that can decode video (with full Linux driver support) and a fast SSD should compete well enough with typical desktop systems on performance while being quiet, reliable, and energy efficient. Finally please note that most of this post relies on just making stuff up. I don t think that this is wrong given the NYT article that started this. I also think that my estimates are good enough to draw some sensible conclusions.

• [1] http://blog.diegodoval.com/2012/09/23/a-lot-of-lead-bullets-a-response-to-the-new-york-times-article-on-data-center-efficiency/

Related posts:

1. Name Server IP and a Dead Server About 24 hours ago I rebooted the system that runs...
2. Google Custom Search Engine I ve just been experimenting with Google Custom Search [1]. Below...
3. Google Server Design Cnet has an article on the design of the Google...

in this series of articles, I will be talking in depth about power management through the NUT project, its packaging on Debian, how to use it in general and how I see it being part of the GreenIT thing. So, let's start with an introduction: NUT is a Free Software (GPL v2+ and 3 to be precise), originally created for power protection using UPS, from home to data-centers:
To shortly describe the main features, I would say that NUT:

• has the most comprehensive list of supported devices: 127 manufacturers and thousands of devices,
• is modular and flexible, to address all possible use cases,
• weight a few hundreds Kb,
• runs on any system, is packaged for the major ones, and is bundled with most (if not all) Linux,
• provides tons of features,
• is network oriented: you can access uniquely devices all around the world, in a secured way,
• is optimized for integration and interfacing,
• is supported by many 3rd party software,
• is already embedded in several devices, found in home, enterprises and datacenters.

NUT used to stand for Network UPS Tools. That is, a software for talking to your UPS and shutting down your systems when needed. This definition is a bit limited nowadays, since NUT supports 4 types of power device:

• UPS, obviously, since the origin.
• PDU (power distribution units), for 4 years. These are somehow big intelligent power switches, that you find in datacenters. These allow to switch on and off specific outlets and / or to measure power consumptions. The latter is more interesting for Green IT and PUE calculation. But this is the topic of another article
• SCD (solar controller device), for more than 2 years. NUT only supports 1 SCD (IVT SCD series), but support for another can be very easily added.
• PSU (power supply unit), for more than a year. This support is limited to server PSU, that are IPMI compatible.
• meters and gensets are also new device types that are considered. Meters would provide more measurement capabilities, still mainly for PUE calculation, while gensets.

Considering this, is the name Network UPS Tools still suitable? Not really! But the acronym NUT is well known! So, for the time being, I just stick using it, and focus on other more important things, until a better opportunity (ideas and comments are welcome!). That said, what can you do exactly with NUT? Currently, you can:

• monitor and manage UPS(s) that protect(s) your system(s), with no redundancy limitation,
• manage your PDU, to power on / off your systems (not servers directly!), and measure power consumptions,
• monitor and manage your servers power supplies, power these on / off, and measure power consumption.
• monitor all these links of the powerchain, that feed your servers.
• discover all USB, SNMP and IPMI supported devices, locally or on the network.

All the above is available in a standardized way:

• the manufacturer name will always be in the variable called device.mfr. The first outlet will always be outlet.1, whatever the device is (UPS or PDU here),
• Tons of command line tools, libraries / language bindings and software are available to help in NUT integration! You can even make your own NUT client implementation very easily and quickly (experiences reports are ~ 2 hours).

Well, this is already a long and dense post, so I will stop there for today. In the next post, we will have a deeper dive into using NUT, for various use cases: submit yours if you can cheers,
-- Arno

It seems I am still having problems with spam on this site now. Instead of getting tons of spam comments posted, I get false positive, that is legitimate content marked as spam. First off, I wish to apologize for the people that haven't seen their comments published immediately. Next, I will work on improving this and explaining the current situation. Here are the statistics that the spam module gives me:

• prevented comment spam: 100 (27% aka positives)
• marked comment as spam: 242 (65% aka positives)
• manually marked comment as spam: 3 (0.8%, aka false negatives)
• marked comment as not spam: 17 (5% negatives)
• manually marked comment as not spam: 8 (2.2% false positives)
• total: 370 comments

Another way to put it:

• spam: 93%, 99% of which is automatically detected
• ham: 7%, 32% of which is marked as spam

In other words, the filter works very well at marking spam, so well in fact that it also marks non-spammy comments as spam... Which is a shame because it breaks the interactivity of the site. Basically, you have one chance out of 3 of not seeing your content posted online, which leads people to try to submit it three times, which actually gets them blocked even more. And this is only the spam module filters: the CAPTCHA module tells me it's blocked 26535 attempts (26 thousand) - amazing. So overall, the solutions I put in place a year ago work, somehow, but are too aggressive. I have therefore bumped the threshold from 65% to 80%, hopefully that will help with this. I have also updated the Honeypot module since they have done lots of releases since 1.5, fixed the issue I reported and it's now in use on Drupal.org after some tweaking by our venerable webmaster killes. If this fails, I will look again at other solutions, like the blogspam plugin that relies on the communnity-run blogspam.net site which powers, amongst other things, Debian Administration and Ikiwiki sites. Back then, I also was considering the Bad Behavior and Block Anonymous links modules. (Note to self: I have also removed around 150 comments sitting in the spam module moderation queue, that it didn't seem to remove as it should have done.)

Hello Planet Debian. This post serves as a confirmation that my feed/blog setup is working. I am a DD since a few months and will blog occasionally about my Debian activities.

Last weekend, I was a member of the off-stage choir in the Cinderella production in Wilrijk. As the off-stage choir didn't have all that much to do (out of 24 scenes, only five of them had music with the off-stage choir; and then, one of them only required women, and another only required male voices for about 8 bars out of 200+), I had a lot of spare time on my hands; and since I'm in the possession of a laptop with 8h+ of battery life, I used some of that time for hacking on dvswitch. Obviously, when you're typing away on a computer using an uncommon user interface (I use awesome as my window manager), questions will arise. I expected this; and luckily, dvswitch is not the kind of code that requires a lot of explanation for people to understand how it's useful a short demonstration is very enlightening. For most people, that simple demonstration would be enough. But one person asked me a question that I've heard other people ask me in the past (albeit in relation to different projects), and that I've always found the most baffling question people can ask someone who's writing some computer program: "Why?" Setting aside the fact that no, his example of Adobe Premiere cannot do what dvswitch can, I've never understood the thought train that leads to "it's been done already, so that's useless." Why does a poet write poems, when they'll never get something similar to Shakespeare's works on paper? Why does my father insist on painting portraits of people including their hands, when he knows he's not very good at it? Why does my mother teach a bunch of amateurs in the ways of floristry? Hasn't that been done before? Because it's fun, that's why.

I previously wrote about the changes to bundling prices by Virgin (which are similar to changes by other telcos) which make it uneconomical to take a bundled phone [1]. This makes it a little easier to compare telcos as there is no need to be concerned about which telcos offer phones you like. Now it s just a matter of call costs and this is easier to assess when the cost of a phone isn t adding to the confusion. Comparing Australian Telcos I m currently with Virgin and I ve found them to be OK in every way. They use the Optus network which isn t as good as the Telstra network but which supports more phones. Virgin charge $19 per month for a SIM without a phone, that gives you $450 worth of calls at a rate of $0.99 per minute + $0.40 connection and $0.28 SMS as well as free calls to other Virgin customers [2]. If the people you call most are on Virgin it s going to be almost impossible to use the $450 at those rates. The $19 plan only includes 250MB of data per month, for an extra $5 you can get another 500MB or for $10 you can get 2GB. For my use $29 is probably the right plan, for my wife $19 would do. Vodafone doesn t offer free calls to other Vodafone customers unless you are on a $30 per month plan, but that plan only gives 500MB of data measured in 12KB increments so that s going to be expensive. Also Vodafone have had some quality problems recently so I m not going to link to them. Optus has some interesting options, they start with a $14 per month plan that includes 50MB of data and 500SMS that could be good value if you do lots of SMS [3]. Also all their plans give free 5 minute calls to other phones on the same account this would be good if your SO is on the same phone account as you. Their plans offer small amounts of data and no apparent option for adding more which is a real problem for anyone who wants to use the Internet seriously. Telstra are really expensive, their web site is poorly designed, and they tell me to use Windows or a Mac. Everyone who spends most of their time in urban areas shouldn t consider them, the only reason for using Telstra is their coverage of rural areas. Internode have a new mobile phone service based on the Optus network which offers good value for money [4]. They start with a $10 per month plan that includes $165 of calls and SMS. The call cost is $0.90 per minute plus $0.35 flagfall and the SMS cost is $0.25. It also includes 100MB of data charged at 1KB increments. The $20 per month plan from Internode includes $450 of calls $1000 of free calls to other Internode mobile phones, and 1.5G of data transfer. Internode also has a $15 charge for sale and delivery of the SIM. Internode also offer 150GB of free social networking traffic, I wonder whether it would be viable to tunnel some other protocol over Twitter or Facebook TPG also has some good offers, $18 per month gives you 1.5GB of data measured in 10KB increments and $550 of phone calls at a cost of $0.90 per minute with $0.35 flagfall and $0.253 SMS cost and unlimited calls and SMS to other TPG mobile and land-line phones [5]. The $10 plan from TPG offers $2000 of free calls to other TPG phones, so if you only need 250MB of data in 10KB increments (which is a lot less than 250MB in 1KB increments) and want lots of free calls to your SO then TPG could be really good. I d rather pay an extra $2 to Internode and get data measured in 1KB increments. Conclusion My usage pattern includes a reasonably large number of calls to my wife and more than 500MB of data use every month. For this pattern the Internode plan is the cheapest for me and for my wife. It seems that a large portion of the phone using population who use the Internet a lot would find this to be an ideal plan. TPG is another good option, particularly for people who use TPG ADSL as they get a discount on the call rates and free calls to their land-line. It seems to me that anyone who uses a mobile phone enough that a pre-paid option isn t cheaper and who doesn t need the coverage that only Telstra can provide will be best served by Internode or TPG. I plan to transition to Internode some time after my current Virgin contract ends. I will probably delay the transition until the contracts for some of my wife s relatives expire. If we all migrate at the same time then we keep getting free calls to each other my relatives don t use mobile phones much so there s no money to save on calling them for free.

• [1] http://etbe.coker.com.au/2012/09/22/phone-prices-australia/
• [2] http://www.virginmobile.com.au/sim-card/
• [3] https://www.optus.com.au/shop/mobilephone/byomobile/simcardplans
• [4] http://www.internode.on.net/residential/phone_and_voip/nodemobile/
• [5] http://www.tpg.com.au/mobile/plans.php

Related posts:

1. Is Lebara the Cheapest Mobile Phone company in Australia? My parents have just got a mobile phone with a...
2. Choosing an Australian Mobile Telco for use with Android Since playing with the IBM Seer augmented reality software [1]...
3. Changing Phone Prices in Australia 18 months ago when I signed up with Virgin Mobile...

An interesting question popped up in my Twitter stream today is there an Android alternative to Apple configurator (for iPhone, iPad and iPod Touch) that allows to create a bunch of identical Apple devices with some added configurations and applications. The best I could come up with is not as polished, but on the other hand much more powerful option Nandroid backup and restore (also known as ClockworkMod Recovery backup). To do this, you need a source phone and a bunch of destination phones. On the source phone a ClockworkMod Recovery (CWR) must be installed (either via a root or via a bootloader unlock). On the destination phones you will either need to also install ClockworkMod Recovery or unlock the bootloader to allow the Fastboot tool to work. So the procedure then goes as follows:
1. Unlock the bootloader on the source phone (search for device specific info on how to do that)
2. Use fastboot flash recovery filename.img to write a device-specific version of CWR to the recovery partition of the device (the phone must be in fastboot mode at that point)
3. Do whatever customisations you want to the source phone at this point. You can use custorm ROMs, install whatever applications, do whatever configuration, but I would suggest keeping everything in phone memory so you don t have to flash the SD card as well.
4. Reboot the source phone into CWR mode, use the backup option to create a full backup.
5. The backup will now be in the SD card of the source device. Copy that to the computer that you will use for creating copies. For each destination phone:
6. Unlock the bootloader of the destination phone
7. Reboot the phone in the fastboot mode, connect it via USB to the copying computer
8. Flash all partitions from the backup using fastboot flash ... commands, skip flashing the recovery partition if you don t want CMR on the destination device
9. Re-lock the bootloader (with fastboot oem lock) And you are done! All the phones must be of the same model. And that model must support unlocking bootloader for this to work. I prefer this method, because this way it is possible to create an end device without root, with a locked bootloader and without CWR thus providing some security as unlocking the bootloader wipes the device, so without specific hacking an attacker can not easily get access to system data on such device. It is also possible to do this with devices that do not have an boot unlock if there is a way to root the original firmware which allows to install CWR and go on from there, but that is significantly more complicated and time-consuming, so using devices with an ability to unlock the bootloader is much preferable. However, before you go to all that trouble, it might be worth to consider if maybe for your particular use case it would be enough with the two commands from Android SDK adb install ... and adb push ... to install applications or individual files on devices or adb backup AppName and adb restore ... to backup and restore one or more individual applications with all their settings. These options have the benefit of that they will work across different device models and that they do not wipe other data or applications from the devices. As I could not immediately find a better way or even a detailed guide how to do this, I decided to write this post, so it would be easier for other people to find this information. If you know a better way, please do mention it in the comments section!

Hi! I have collected a small list of people that I want to give lifesign once in a while.
- and you are one of them Maybe we shook hands once, and for some obscure reason I kept (or found) your email address.
Maybe we are even related by blood (then you probably know - e.g. ny brothers are on the list, as is both my parents
Few of you I actually never met in person, but you made a special impression on me - either in a phone conversation or an email exchange If you dislike being "bombarded" with emails from me - or if you are not at all the one I think you are, and really I write to a stranger - then please tell me! I will immediately remove you from the list, if you ask for it - and won't take it badly Kind regards
Jonas Smedegaard

---

This text is part of my friends scriblings.

Do you deliver your mail with maildrop? If not, this post is only for your amusement . My mailserver runs Postfix as MTA and maildrop as MDA, a pretty common setup I d say. And it happens that maildrop supports quota. It supports it so good, that I have no idea how to disable that support, but I also actually never cared, as my user database declares each user has 10GB quota for mails (courier s authtest says Quota: 10000000000S , so does the configuration). And 10GB should be enough for everybody, right? Well, so I thought until I noticed that my Icedove indicated a 99% full mailbox and shortly afterwards maildrop stopped delivering mails with maildir over quota . Looking at the maildirsize file in my maildir, I noticed that the quota is set to 1410065408S, a mere 1.4GB. Where does this number come from? The proficient reader will quickly see that 10000000000 mod 2^32 = 1410065408, so this is actually an integer overflow happening somewhere in the code handling the maildirsize file (read: in maildrop). A short dig through the Debian BTS revealed a bug from 2003, saying exactly the same. The bug also indicated, the issue is fixed since maildrop 2.5. A short cowbuilder run later, I had a maildrop_2.5.5-2_i386.deb, installed it and after the next mail delivery, my quota was at 10GB as it should. TL;DR: If you run into strange maildir over quota errors with maildrop on Debian Squeeze, get a newer maildrop (or backport that single patch to Squeeze s maildrop).

0 comment(s) this blog is flattr enabled

Since this summer, I have worked in my spare time on a Norwegian docbook version of the 2004 book Free Culture by Lawrence Lessig. The reason is that this book is a great primer on what problems exist in the current copyright laws, and I want it to be available also for those that are reluctant do read an English book. When I started, I called for volunteers to help me, but too few have volunteered so far, and progress is a bit slow. Anyway, today I broken the 70 percent mark for the first rough translation. At the moment, less than 700 strings (paragraphs, index terms, titles) are left to translate. With my current progress of 10-20 strings per day, it will take a while to complete the translation. This graph show the updated progress: Progress have slowed down lately due to family and work commitments. If you want to help, please get in touch, and check out the project files currently available from github. If you are curious what the translated book currently look like, the updated PDF and EPUB are published on github. The HTML version is published as well, but github hand it out with MIME type text/plain, confusing browsers, so I saw no point in linking to that version.

After thinking a while I thought I should record my weekly FLOSS work and I'm starting by this week. This week I'm on vacation and in home town so I could give bit more time for my FLOSS activity. So here it goes this weeks work Bug Squashing

• Fixed a RC bug filed on Debian-IN team 687176 thanks to the timely patch from Kartik
• Filed an important bug on fonts-taml which was missing a dependency on fonts-samyak-taml and fixed it myself :-) 687806

Both these packages are uploaded to unstable first RC bug was related to Debian Installer hence was unblocked before we could file unblock-request. Kartik filed an unblock-request and adsb unblocked it happily and both the packages landed in unstable. New Packages

• fonts-lohit-taml-classical is a new font for Tamil community developed by Lohit projects I don't know much about font itself but I cleared a wnpp bug with this package 681655
• fonts-teluguvijayam is new package containing 3 Telugu fonts which is released by Department of Information and Technology Andhra Pradesh. This package is pending upload and will clear wnpp bug 669238 and is a pending upload.
• I finally cleared all review comments by jwilk on surf package and now 0.5 version of surf is in experimental.

Both these packages will be backported once Wheezy freezes. One pending wnpp is left on Debian-IN which I've left for Kartik to finish ;-). Font Package Helper I bumped version on dh-make-font[1] to 0.3 now it accepts upstream URL with -u, --upstream switch this will be placed in Homepage: field of control file and in Source: field of copyright file. Probably I need to think of introducing xz compression to original source tarball where upstream is not giving any tarball and probably rewrite it using Perl so it can get included dh-make package. Already a bug filed to get it included in dh-make package 658154. [1] http://anonscm.debian.org/gitweb/?p=debian-in/dh-make-font.git;a=summary Misc and Learnings

• Helped Jonas to fix a minor issue in boxer. I still have to figure out one issue on boxer and add ramfs support to boxer. If you see boxer commit log you can find a few Thanks to Vasudev Kamath but I still didn't commit anything directly which is now in my TODO :-)
• Started learning Perl from Moder Perl book thanks to Jaldhar for pointing this book for me.

Well that is it for this week. Hopefully I will have new stuffs to put up here for the next week, till then Cya.

The IPv6 patch set for netcfg (part of debian-installer) has landed in Debian unstable. In follow-up uploads I diverged from the Ubuntu patch set a little bit:

• I dropped the use of DUID-LL as the client identifier used by the DHCPv6 client. While basically a good idea, because it's predictable, it's also against the RFC to do that. We simply don't know if the network interface is permanently attached to the device. If the NIC that's used for DUID-LL generation is reused for installation in another box, the same identifier would be generated and stored on the machine. That's what DUID-LLT (the default in other software) avoids. As much as I loathe the replacement of the current MAC address-based scheme of DHCPv4 with DUID-LLT, it seems to be more correct to use that instead of DUID-LL, because that identifier is designed to be decoupled from the presence of the NIC. If you want predictable addressing, just enable SLAAC in your broadcast domain and use the EUI-64 address, which already contains the current MAC address.
• If SLAAC is used, netcfg will activate IPv6 privacy extensions in the installed system by default. They can be turned off by editing /etc/network/interfaces post-installation. This will only affect outgoing traffic, incoming traffic can be addressed at the stable EUI-64 address. (We don't use a randomized interface identifier like Windows does.)

Thanks to Michael Tokarev's recent upload of busybox, we now also have a more featureful ping and ping6 in debian-installer's environment.

Known bugs:

• As far as I can see, the DUID generated in the debian-installer environment is not copied into the installed system. Given the low prevalence of stateful DHCPv6 for servers I don't consider this a blocker, though.
• If stateful DHCPv6 is requested by the router advertisement (other config flag being set), the DHCPv6 client will not time out and continuously retry to get an address.
• According to Debian bug #688273 preseeding of netcfg/use_autoconfig does not work correctly. netcfg/disable_dhcp needs to be re-added as a deprecated preseeding option and mapped onto the use_autoconfig value until somebody comes up with a better scheme.
• We should state in the installation guide that ftp.ipv6.debian.org and http.debian.net can both be used for IPv6-only installation. The installer does not show in the mirror list if a mirror is IPv6-capable.

If you could take another look at a current d-i daily, install a system with it and look if the installed system has a correct network configuration, that would still be appreciated. I also need somebody to test the GNU/kFreeBSD image. I fixed it up to build there but the result might be entirely wrong.

My sincere thanks go to Bernhard Schmidt and Karsten Merker, who successfully completed installations over IPv6 in various environments!

Wheezy is coming closer to the release, there though are still way too many release critical bugreports outstanding for it. Squeeze has already been released, but it has collected even more release critical bugreports than wheezy since. To be able to reduce these amounts I will be at the Linuxhotel in Essen at the weekend from 23rd to 25th of November, and it would be a great pleasure if I could convince you to join me in this effort. As readers of my blog might assume, my main aim will be those RC bugs affecting squeeze and I would be happy if some people interested to work on those could join me, I plan to give a quick quick explanation about the version tracking of the BTS and why we should care about stable too, but the event will definitely not be limited to squeeze RC bugs. Also, it will be a good chance to improve your key stats for the web of trust in case your GnuPG key hasn't got enough signatures yet or you want to transition to a stronger one. Please read the Community page of the Linuxhotel for what they offer for accommodation in case you want to use their lodging. Personally I'll go for the two-bed room with breakfast option, but you are of course free to bring your own sleeping bag and mat if you want to cut short on the expenses. In case of any questions, feel free to ask me right ahead. It would be great if we could help both our stable release and the next stable release during the weekend, and if you could join in! Please add yourself to the wiki page about the BSP.

/debian permanent link Comments: 0 Flattr this

I will be speaking at ELC-E in Barcelona this year, with a talk entitled regmap: The Power of Subsystems and Abstractions. I look forward to seeing some of you at the conference, perhaps even in the audience!

The Register covered a story on a UEFI-based attack on Windows 8. It's actually covering this technical writeup, which is a discussion of a proof of concept implementation of an attack on the Windows 8 kernel from the firmware environment. The first approach they describe is pretty straightforward, in that they simply patch the Windows bootloader directly. Since this is what's reading the kernel off disk and launching it, patching that code means you can modify the kernel in-place and run it with built-in privilege elevation exploits.

The second approach is a little more interesting, and is based on their observation that the UEFI ExitBootServices() function is called after the kernel is loaded but before it's executed. UEFI calls are simply function pointers, so if you can run code in the firmware environment it's trivial to simply replace the function pointer with one to code of your own which does whatever you want before calling the original code. This makes it pretty straightforward to add a hook that gets run when ExitBootServices() is called, finds the kernel, patches it and then continues on its way. Since the kernel is patched after it's been read, this gets around any kind of signature checking that the bootloader might carry out.

But both these cases have something in common: they rely on the ability to run arbitrary code in the firmware environment, and that's precisely the thing that UEFI Secure Boot prevents. A system with a correct implementation of Secure Boot isn't vulnerable to the described attacks, but it's fairly unsurprising that running UEFI without Secure Boot is vulnerable. UEFI on its own doesn't provide any additional security. You're as vulnerable to bootkits as you are with BIOS.

So this isn't really a story about a surprising vulnerability. It's a story about someone taking the logical step of implementing a bootkit on top of UEFI, which is what everyone should have been expecting all along. Computers that are configured to run arbitrary code will run arbitrary code, and if that arbitrary code happens to modify your kernel so your credit card details are automatically posted to pastebin, well, that's a plausible outcome.

comments

DPL August report, posted on d-d-a a while ago (yep, I forgot to blog it up to now!, sorry for the oldies).

---

Dear project members, August has been a month with a good deal of vacations for many of us, including yours truly. Therefore the monthly report of DPL activities will be briefer than usual. Which is good, as it'll leave all my readers more time to do NMUs and fix RC bugs! Ongoing discussions

• Discussion about the new trademark policy has continued on -project. I've collected quite some feedback and summarized it in a request for change that I've passed on to SFLC. I'm waiting for a second draft from them, before reviving the thread.
• on the long-running issue of de-duplicating DebConf infrastructure wrt Debian's, I've been happy to support the proposal of moving DebConf's list to Debian's software and infrastructure. There seems to be interest and consensus, but the DebConf team could probably use a couple more helping hands to make it real
• starting from the practical need of dealing with minified JavaScript files, an interesting discussion sparkled on -devel. It quickly turned in both musing on the notion of archive-wide DFSG-freeness and some new devscript tooling by Andreas Tille. AFAIU some extra testing would be welcome

Assets

• The DFGS-free logo relicensing I've mentioned last month is now on its way. Following advice from SFLC, I've slightly patched the current trademark policy (mainly to clarify scope), just enough to decouple logo relicensing under LGPLv3/CC-BY-SA 3.0 from the finalization of a new trademark policy (see above). I've also verified that the license choice is fine with teams that regularly deal with the logos. Ball is now in SPI camp (as copyright holder). They should finalize the relicensing during the forthcoming board meeting, on September 13th.
• We heard back from the trademark office in Japan, who accepted our request to transfer it from local Debian contributors to SPI. That being mainly a bureaucratic acknowledgement, we'll now need to way for a while until they confirm the transfer has been finalized. My eternal thanks for help with this matter goes to Kenshi Muto.

Core teams

• Manoj Srivastava has stepped down as tech-ctte member. I hereby thank him for his long and valuable service in that capacity. The tech-ctte has now one vacant seat, and I've encouraged present tech-ctte members to propose to me a suitable candidate. In an attempt to promote diversity of views within the tech-ctte, they are now considering various ways to solicit candidatures. You'll hear from them about this soon, I suspect.
• In the meantime, monthly IRC meetings of the tech-ctte are continuing, as you might have noticed from tech-ctte decision reports posted on this list. As it seemed to be lingering, at the last meeting I've solicited progress on the Python maintenance issue.
• The auditors have noticed the unclear situation of the Policy Editor delegation, which seems to rely on a "base" delegation dating back to Antony Towns' office and various subsequent delegation "patches". After discussion with Russ Allbery I've then proceeded to a public "ping" to assess the interest of current editors in continuing their work in such capacity, and encourage new volunteers to apply as editors. Based on the feedback I've got, I'm now preparing a new Policy Editor delegation.

Legal and RC fun

• Solicited by Jonathan Nieder and Helge Kreutzmann, I've looked into #555168 and sought legal advice to answer various questions related to the non-copyrightability of locale data. Aaron Williamson of SFLC has been blazing fast in answering them (thanks!), and Jonathan and Helge has now all the needed information to help addressing that (RC) issue. Keep an eye on the bug log for more details.

Hardware

• I've approved buying 6 console servers to improve DSA ability to act on remote machines, without having to bother^Wrely on local admins when not strictly needed. ~550 USD well spent.

See? It's been quick(er)! Talk to you here next month, with a much lower count of Wheezy RC Bugs on the horizon, hopefully.
Cheers.

---

PS the boring day-to-day activity log for August 2012 is available at master:/srv/leader/news/bits-from-the-DPL.txt.201208