I hearby now call for Revolution, that is how angry and radikal I have really become


Angry about things like the Russian bombings that Madduck blogged about, that so closely ressemble September 11 or Pearl Harbour.
Radikal about the greed that kills both the planet, and the people in it.




I think it is about time for another Weather Underground but, this time, well done [IMDB] [Wikipedia] [torrent].


That is where the question lies. How is a Revolution done right?

Linpus Lite (or maybe just aspire one mail) is only going to last a few more days on this aspire1, it's beginning to annoy me:
Update
sylpheed has now replaced aspire mail. OK, I still use aspire mail for calendar and addressbook stuff (for now), but sylpheed is a much better email client.

1. aspire one mail has no GnuPG support


2. aspire one mail has no non-HTML composition support. No, really, it doesn't even send plain text alongside the HTML. email sent from the aspire to myself comes in as an attachment in other email clients! (i.e. spam)

So, I would have to investigate a different email client but then there are niggles with Linpus itself:

1. the aspire default kernel build lacks the pl2303 kernel module so that I can't use the aspire to control my balloon3 board over usb serial


2. intermittent problem with network manager forgetting WPA passphrases

Testing continues - probably resulting in installing Lenny at the end of this week. Some of these things might be fixable using pages like taoofmac and Reg Hardware.
Unfortunately, the problem with usbserial means that I'll have to take two laptops if I want to demonstrate the balloon3 board in places.
I also don't seem to be able to locate any copyright files which makes me nervous. Maybe it's just a lack of knowledge of Fedora (at least not since FC5).

Since the past few months I've been getting a lot of email at gmail.com not intended for me. Initially I thought it was spam but I realised that people have been inadvertently sending me mail thinking appaji is somebody else. So I get:

• Digitally signed (unencrypted) stock market contract notes
• Business emails like tender plans, press releases etc.
• Bank credit card and Mutual fund account statements
• Match Alerts and frequent updates from jeevansathi.com
• Invitations to web-casts, conferences etc.
• A bunch of personal email, possibly from friends and relatives

Obviously, I also get mail that sometimes says "I did not get your response". I've often tried responding explaining to the senders that I am not who they think I am, but there is no use. There is a LOT of personal or otherwise important information like addresses, phone numbers, financial transactions, passwords to some web-service accounts, domain transfer authorisation keys etc. in these emails. This makes me very uncomfortable.

After reading on Jimmy Schementi's weblog that IronPython, the .NET implementation of Python, is just an apt-get install ironpython away, I thought I'd give it a whirl. Here's what I got. Huh? Maybe Microsoft took that "significant whitespace" thing a little too literally... It turns out that IronPython really wants you to use a dark background (bug report). Ah, so that's why the background of Jimmy's blog is black! As you can see from the screenshot, it's also a bit difficult to quit from the Ubuntu version of IronPython. That weird symbol is a result of pressing Ctrl+D. Even Ctrl+\, which usually helps in such cases, only produces a nasty .NET CLR traceback with no ill effects to the interpreter. On the bright side, this is a good start. IronPython seems to be more or less functional, with speed comparable to CPython, even though the example code included in Debian looks a little "heavy" (see /usr/share/doc/ironpython/Tutorial).

I found some weird opcodes in the s390 instruction set some time ago. I finally want to use it as I have access to such a machine. The result is rather slim:

.globl cu41
        .type   cu41, @function
cu41:
.L2:
        cu41    %r2,%r4
        ipm     %r1
        srl     %r1,28
        chi     %r1,3
        je      .L2
        ltr     %r1,%r1
        je      .L3
        lcr     %r1,%r1
        lgfr    %r3,%r1
.L3:
        lgr     %r2,%r3
        br      %r14

The cu41 opcode translates UTF32 to UTF8. Each "parameter" is a register pair [1], which describes address and length of the buffer. This opcode will return after a not specified number of translated characters. The rest is boiler plate code for condition code checking. The loop makes sure that anything is converted within the function unless another error occured.

[1]	An even pair. gcc is not yet able to allocate such pairs on its own, so it is hardcoded.

I found some weird opcodes in the s390 instruction set some time ago. I finally want to use it as I have access to such a machine. The result is rather slim:

.globl cu41
        .type   cu41, @function
cu41:
.L2:
        cu41    %r2,%r4
        ipm     %r1
        srl     %r1,28
        chi     %r1,3
        je      .L2
        ltr     %r1,%r1
        je      .L3
        lcr     %r1,%r1
        lgfr    %r3,%r1
.L3:
        lgr     %r2,%r3
        br      %r14

The cu41 opcode translates UTF32 to UTF8. Each "parameter" is a register pair [1], which describes address and length of the buffer. This opcode will return after a not specified number of translated characters. The rest is boiler plate code for condition code checking. The loop makes sure that anything is converted within the function unless another error occured.

[1]	An even pair. gcc is not yet able to allocate such pairs on its own, so it is hardcoded.

It seems to be a common idea by non-bloggers that the comment they enter on a blog is somehow special and should be taken seriously by the author of the blog (everyone is a legend in their own mind). In a recent discussion one anonymous commentator seemed offended that I didn’t take his comments seriously and didn’t understand why I would take little notice of an anonymous comment while taking note of a later comment on the same issue by the author of the project in question. In most forums (and I use the term in the broadest way) an anonymous comment is taken with a weight that is close to zero. That doesn’t mean that it will be ignored, it just means that the requirement for providing supporting evidence or of having a special insight and explaining it is much greater. One example of this is the comment weighting system used by Slashdot.org (AKA “/.”). The /. FAQ has a question “Why should I log in?” with the answer including “Posting in Discussions at Score:1 instead of Score:0 means twice as many people will see your comments” [1]. /. uses the term “Anonymous Coward” as the identification of users who are not logged in, this gives an idea of how they are regarded. Advogato uses a rating method for blog posts which shows you only posts from blogs that you directly rank well or which match the trust metric (based on rankings of people you rank) [2]. I believe that the automated systems developed by /. and other online forums emulate to a some extent the practices that occur off-line. For any discussion in a public place a comment from someone who does not introduce themself (or gives an introduction that gives no reason to expect quality) will be treated with much less weight than one from someone who is known. When someone makes a comment their background will be considered by people who hear it. If a comment is entirely a matter of opinion and can not be substantiated by facts and logical analysis then the acceptance of the comment is solely based on the background of the author (and little things like spelling errors can count against the author). Therefore if you want your blog comments to be considered by blog authors and readers you need to make sure that you are known. Using your full name is one way of not being as anonymous but most names are not unique on the Internet (I’ve previously described some ways of ensuring that you beat other people with the same name in Google rankings [3]). The person who owns the blog can use the email address that is associated with the comment to identify the author (if it’s a real email address and it’s known by Google). But for other readers the only option is the “Website” field. The most common practice is to use the “Website” field in the comment to store the URL of your blog (most blog comments are written by bloggers). But there is nothing stopping you from using any other URL, if you are not a blogger and want to write comments on blogs you could create a personal web page to use for the comments. If the web page you use for such purposes gives links to references as to your relevant experience then that would help. Someone who has skills in several areas could create a web page for each one and reference the appropriate page in their comment. One problem we face is that it is very easy to lie on the net. There is no technical obstacle to impersonation on the net, while I haven’t seen any evidence of people impersonating others in an attempt to add credibility to blog comments I expect it’s only a matter of time before that happens (I expect that people do it already but the evidence of them getting caught has not been published anywhere that I’ve read). People often claim university education to add weight to their comments (usually in email but sometimes in blog comments too). One problem with this is that anyone could falsely claim to have a university degree and no-one could disprove their claim without unreasonable effort, another is that a university degree actually doesn’t mean much (lots of people remain stupid after graduating). One way in which adding a URL to a comment adds weight is that for a small web site the author will check a reasonable portion of the sites that link to them, so if someone impersonates me and has a link to my web site in the comment then there’s a good chance that I will notice this. OpenID [4] has the potential to alleviate this by making it more difficult to forge an association with a web site. One thing that I am working on is enabling OpenID on all the web sites that are directly associated with me. I plan to use a hardware device to authenticate myself with the OpenID server (so I can securely enter blog comments from any location). I expect that it will become the standard practice that comments will not be accepted by most blogs if they are associated with a URL that is OpenID enabled unless the author of the comment authenticates themself via OpenID. Even when we get OpenID enabled everywhere there is still the issue of domain specific expertise. While I am well enough known for my work on SE Linux that most people will accept comments about it simply because I wrote them, the same can not be said for most topics that I write about. When writing about topics where I am not likely to be accepted as an expert I try and substantiate my main points with external web pages. Comments are likely to be regarded as spam if they have too many links so it seems best to only use one link per comment - which therefore has to be on an issue that is important to the conclusion and which might be doubted if evidence was not provided. The other thing that is needed is a reasonable chain of deduction. Simply stating your opinion means little, listing a series of logical steps that led you to the opinion and are based on provable facts will hold more weight. These issues are not only restricted to blog comments, I believe that they apply (to differing degrees) to all areas of online discussion.

• [1] http://slashdot.org/faq/accounts.shtml


• [2] http://www.advogato.org/person/raph/diary.html?start=224


• [3] http://doc.coker.com.au/internet/personal-seo/


• [4] http://en.wikipedia.org/wiki/Openid

Share This

People frequently ask me what I am doing typing on my Palm right before logging in one of my remote systems. The answer is quite simple: generating my next password . People always seem puzzled by that answer Maybe I am just too old to have had only telnet sessions available to remote connections (that was the time before SSH took over)... or maybe I am just too paranoid regarding the access to my systems Anyway, I like One Time Passwords, and here is an article I can refer to when I get asked again ;-) One Time Passwords are just that: passwords that are good for one time use. They never repeat and once used you can throw it away securely. They were quite common when the authentication was done in clear text (so that any man-in-the-middle could steal your passwords), back in the r-tools age (rcp, rsh, rlogin, rexec, etc). After the SSH-related tools took over, providing easy tunneling and remote access, MITM attacks were of much concern, so OTPs became less relevant. What a shame, for they even have a couple of standards for those! But there s still room for OTPs Question: Is it easier to deploy a MITM attack or a keylogger? That s right We are always connecting to our remote systems in public terminals (well at least I am right now typing from the hospital computer), and a keylogger is so easily installed in one of those terminals, even remotely, that no one would ever get close to deploy a refined MITM attack just to steal someone s password. One would just install a keylogger! All the security SSH provides would just be gone by then. That s why I use SSH to connect to my remote machines, but use OTPs to authenticate myself. It s so easy to deploy it. In Debian you ll find packages opie-server and libpam-opie and those are the only things you ll need on the server side (besides SSH, obviously). OPIE means One-time Passwords In Everything , and combined with PAM, one can really use it everywhere. After installing it, you ll have to generate the password file for your account:

spectra@home:~$ opiepasswd -c
Adding spectra:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID spectra OTP key is 499 ho6484
HAVE COOK LOLA AIRY NEIL ROAM

The pass phrase will be used to generate the passwords in a step before your login. Please, try not to forget it (specially if you re following this article and playing with some remote system at the same time). Now you can edit /etc/pam.d/ssh file (or its equivalent in non-Debian systems) to require that kind of authentication. Mine just looks like this:

# /etc/pam.d/ssh
auth       required     pam_env.so
auth       required     pam_env.so envfile=/etc/default/locale
auth       required     pam_opie.so

First two lines are unrelated and just load the environment variables. Last line is where the fun is. Please, note two things: (1) I removed references to pam_unix.so, which is what would ask for my real password, that I want to disable (no login is allowed with that password). And (2), I declared it as required, meaning that failing it will keep one out of the system. We are not ready yet! SSH will work by now, but will not present you the OTP challenge. Probably you could still login, but you d have to remember which is the current password (Trust me, you would not!). To get the challenge you ll need to enable it in /etc/ssh/sshd_config change the following line:

ChallengeResponseAuthentication yes

That s it. Now to login to your remote machine, that s what will usually happen:

spectra@hospital:~$ ssh home
otp-md5 498 ho6484 ext, Response:
spectra@home:~$

Voil ! It asks for password #498. By default, it starts with 500 passwords and goes down from that. Password #498 were asked, so the next will be #497. After that, #498 is not useable anymore, and #496 is not useable yet. You can generate a list of those passwords (let s say 10), print it and keep it in your pocket. This is the command you d use for that:

spectra@home:~$ opiekey -n 10 498 ho6484
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
489: CALM INTO WEEK APS LOON VIE
490: HASH GYM RAID GOSH HOYT DUAL
491: BELL GIN RIFT HELM GUY BUNK
492: HEBE OBOE SUP LEG LULU LANG
493: HOYT JOT ASK JOG GIBE BETH
494: NASH MOOT HIND YEAH  YAP CARL
495: MATE OF BARD LAVA LEAK AHOY
496: TAB BAG KEY GILT AVID VEAL
497: MOLE FORM NIB LEER ROSS HAVE
498: SING WERE OVEN SOD VEIN NIBS

That is not so secure, since you can loose the paper and be doomed Luckily there are lots of small softwares that does this generation for you. Some you can use from your Palm or from some J2ME-enabled phone (such as N95). Some your can use from another (trusted) computer. Some are even online, written in javascript! There are at least one other side-benefit of using OPIE as above: You can give away your user password (even root password OK, probably not a Good Thing^TM), that the system would still be secure, since it only allows SSH authentications via OPIE! If the session is started with a username whose opiepasswd was not activated (first step scroll back to the beginning of the article), SSH will greet you with a bogus challenge only opie-activated users will be allowed to login with the above configuration. Easy enough, isn t it? Now, next time you see me typing on my Palm before opening an SSH connection you ll know what I am doing ;-)

I played with a friend’s Atom based EEEPC yesterday. The EEEPC is an amazing achievement considering it’s comparable to the Thinkpad X61, yet it’s a fifth of the price in the UK. I like the idea of carrying an EEEPC as I’m a bit nervous about losing my $$$ Thinkpad when I am out and about. If it just runs a kiosk like browser, with a HSPDA 3G modem, it would be very handy. I wouldn’t sob as much if it got stolen. In other news: I upgraded my beloved slug to lenny which I use as a NAS at home, only to get bitten by a serious NFS permission issue in Debian. Urgh. Update: Thinkpad lovers rejoice. Lenovo has released the EEEPC rival SL300, which seems like half the price of the X61.

I wonder what would have happened if Obama had put lipstick on a pitbull would there be any less of this circus put up by the Republican monkeys? Are we back in Kindergarten? Mom! Mom! He hit me! . Is the next thing we ll see tears on stage? Or some sort of fake emotional outbreak? Anything goes in America, I say Both, Obama and McCain have used the lipstick analogy in the past (see previously linked article, and this AP writeup), so why are the Republican monkeys trying to nail him on sexism? They are (trying to) play the gender card (thanks to Erinn Clark for the link). Sexism surely is a word to grab attention, especially in the Excited States of America. By shifting attention to sexism, the Republican monkeys are not only stealing Obama s show and dragging the short-attention-span media (and populace) away from any Palin-related scandals, they are also covering up that they don t have anything else to say. Finally, sexism is an emotional topic, unlike the other political and policy crap the entertainment-hungry television crowd has to put up with, so hooray for excitement! I am disgusted by this American election circus. And I wish we d get about as much coverage of American news in these times as international news gets airtime on American TV. Even though I hope Obama wins for no other reason than that he s not in the same political camp as George W. International Terrorist and War Criminal Bush, I couldn t really care less and don t have any reason to believe that things will improve when the Democrats move back into the White House. And neither do lobbyists care who s sitting at the top. Idiots exist on every level and all over the globe. The rich will still pull the strings. The capitalist avalanche (euphemistically called the strive for democracy ) doesn t slow down. Other countries political monkeys have tasted totalitarianism and lost their senses, and no US government will get them back on track. And the media, who controls it all anyway, is just cashing in on the whole spectacle, which is why I have to continue to be subjected to it. Which brings us back to the rich I wouldn t be surprised to find the likes of Haliburton in the financial support list of the Republican monkeys. PS: I know and respect many American citizens, and I know most of them think like me. Nevertheless, I feel it necessary to point out that none of the above is an attack on those of you with a clue. I feel sympathy at the same time as I feel the rage expressed in the above, but this rage is solely with the political monkeys, the media, and merciless capitalists. None of those are US-specific, it just happens that you seem to have the most pronounced combinations. NP: Mogwai: Come On Die Young

One thing I had wondered was why home air-conditioning systems are more efficient than air-conditioning systems for server rooms. I received some advice on this matter from the manager of a small server room (which houses about 30 racks of very powerful and power hungry servers). The first issue is terminology, the efficiency of a “chiller” is regarded as the number of Watts of heat energy removed divided by the number of Watts of electricity consumed by the chiller. For example when using a 200% efficient air cooling plant, a 100W light bulb is rated as being a 150W heat source. 100W to Heat it, 50W from the cooling plant to cool it. For domestic cooling I believe that 300% is fairly common for modern “split systems” (it’s the specifications for the air-conditioning on my house and the other air-conditioners on display had similar ratings). For high-density server rooms with free air cooling I have been told that a typical efficiency range is between 80% and 110%! So it’s possible to use MORE electricity on cooling than on running the servers! One difficulty in cooling a server room is that the air often can’t flow freely (unlike a big open space such as the lounge room of your house). Another is the range of temperatures and the density of heat production in some parts (a 2RU server can dissipate 1000W of heat in a small space). These factors can be minimised by extracting hot air at the top and/or rear of racks and forcing cold air in the bottom and/or the front and by being very careful when planning where to place equipment. HP offers some services related to designing a server room to increase cooling efficiency, one of the services is using computational fluid dynamics to simulate the air-flow in the server-room [1]! CFD is difficult and expensive (the complete package from HP for a small server room costs more than some new cars), I believe that the fact that it is necessary for correct operation of some server rooms is an indication of the difficulty of the problem. The most effective ways of cooling servers involve tight coupling of chillers and servers. This often means using chilled water or another liquid to extract the heat. Chilled water refrigeration systems largely remove the problem of being unable to extract the heat from the right places, but instead you have some inefficiency in pumping the water and the servers are fixed in place. I have not seen or heard of chilled water being used for 2RU servers (I’m not saying that it doesn’t get used or that it wouldn’t make sense - merely that I haven’t seen it). When installing smaller servers (2RU and below) there is often a desire to move them and attaching a chilled-water cooling system would make such a move more difficult and expensive. When a server weighs a ton or more then you aren’t going to move it in a hurry (big servers have to be mostly disassembled before the shell can be moved, and the shell might require the efforts of four men to move it). Another issue related to water cooling is the weight. Managing a moderate amount of water involves a lot of heavy pipes (a leak would be really bad) and the water itself can weigh a lot. A server room that is based around 20Kg servers might have some issues with the extra weight of water cooling (particularly the older rooms), but a server room designed for a single rack that weighs a ton can probably cope. I have been told that the cooling systems for low density server rooms are typically as efficient as those used for houses, and may even be more efficient. I expect that when designing an air-conditioner the engineering trade-offs when designing for home use favor low purchase price. But someone who approves the purchase of an industrial cooling system will be more concerned about the overall cost of operations and will be prepared to spend some extra money up-front and recover it over the course of a few years. The fact that server rooms run 24*7 also gives more opportunity to recover the money spent on the purchase (my home A-C system runs for about 3 months a year for considerably less than 24 hours a day). So it seems that the way to cool servers efficiently is to have low density server rooms (to the largest extent possible). One step towards this goal would be to have servers nearer the end users. For example having workgroup servers near the workgroup (instead of in the server room). Of course physical security of those servers would be more challenging - but if all the users have regular desktop PCs that can be easily 0wned then having the server for them in the same room probably doesn’t make things any worse. Modern tower servers are more powerful than rack mounted servers that were available a few years ago while also being very quiet. A typical rack-mounted server is not something you would want near your desk, but one of the quiet tower servers works quite well.

• [1] http://en.wikipedia.org/wiki/Computational_fluid_dynamics

Share This

As some might know, I've been working at the university for a few weeks now. I'm very happy how it all worked out, because of the people there and the subjects to work on. It's just great to think through some mind-bending index structure to improve reverse-k-nearest-neighbor queries. And the professor (who is very well known for his work on R*-Trees, the X-Tree, and the DBSCAN and OPTICS algorithms) really manages to aggregate excellent people.(rkNN is the problem of finding those points for which a Nearest Neighbor Search [Wikipedia] would return the given point. There are many use cases for example in location based services.)A lot of my work involves a framework which has been published recently on the SSDBM 2008 conference: ELKI - Environment for DeveLoping KDD-Applications Supported by Index-StructuresThe goal of ELKI is to become what WEKA is for machine learning. And it's well on it's way for that.ELKI aims at the data mining researcher, it's not designed to squeeze out the last bit of performance. Instead it allows you to compare different algorithms, try different index structures (including various spatial and metrical trees) and offers all kinds of functionality you can reuse. If you are planning to do some real world applications, it likely is still useful for prototyping.In the last weeks I've already put quite some effort in ELKI, so expect the next version to be released with significant changes and new functionality. In fact some working functionality was just left out of the release because we hadn't cleaned up the code yet.Currently, getting started with ELKI can be a bit tricky. It's not hard to use, but you just need to find out where to start. The next release will therefore include a "dummy algorithm" that mostly serves as being a template for implementing custom algorithms (it can also be used for benchmarking an index structure, though).

Three days after I posted my last blog entry about it, a great progress was made about translation completeness for D-I. We jumped from 34 languages meeting the release criteria up to 41. Shaking out translators seems to be efficient even though t requires a big investment in time. So, welcome back to Spanish, Indonesian, Georgian, Hebrew, Khmer, Nepali, Simplified Chinese. There are still uncertainties for: Amharic, Bengali, Bosnian, Catalan, Danish, Greek, Esperanto, Estonian, Hungarian, Kurdish, Latvian, Macedonian, Norwegian Nynorsk, Northern Sami, Slovenian, Albanian, Tagalog, Ukrainian, Wolof Several of these have *very few missing strings* (as a matter of example, Catalan is only missing the strings....that warn users that the translation might be incomplete...interesting chicken-and-egg situation which could be easily solved by completing 5 miserable strings). 12 days left (the end of the translation update round is on Saturday 20th midnight UTC)....hurry!

Many people are already aware of the amount of data Google can (and does) collect on them. Some people therefore refuse to use certain google applications altogether. Others just like them too much.There are some services that won't work with heavy ad blocking and anonymizing services - others will work just fine. A prime example everybody uses is Google search.Google search will work just fine if you use anonymizers. Google Mail won't.Privoxy and TOR is a great combination for anonymizing, however you won't want to use them for bandwidth-heavy web surfing, and there is little benefit of using them for web sites where you authenticate anyway.Here's a way to do a compromise:

1. Install and configure Privoxy and TOR. Make sure they work.
2. Setup a proxy.pac file (proxy autoconfiguration) for your browser like this:

   function FindProxyForURL(url, host)  
       var google = /https?:\/\/([^/]*\.)?google\.[a-z]*($ \/)/;
       var tor = /https?:\/\/([^/]*)\.(exit onion)($ \/)/;
       if (google.test(url))  
           if (shExpMatch(url, "*.google.com/mail*"))  
               return "DIRECT";
            
           return "PROXY 127.0.0.1:8118";
        
       if (tor.test(url))  
           return "PROXY 127.0.0.1:8118";
        
       if (shExpMatch(host, "config.privoxy.org"))  
           return "PROXY 127.0.0.1:8118";
        
       return "DIRECT";
    
   

   and point your browser to it.
3. Add the following to your privoxy/user.action file:

     +client-header-filter hide-tor-exit-notation   
   .exit
     +filter js-events  +crunch-all-cookies  
   .google./(search blogsearch scholar images)
   

   And don't forget to reload privoxy.

You should now be able to access Google search with enhanced privacy (I can't guarantee you they won't be able to track you though!) while at the same time you can access your Gmail account at full speed.When using Google Search (including image, blog and scholar search, feel free to add additional services) you should be seeing a login button, while you could be accessing Google Mail at the same time in another tab.This list is of course not exhaustive. You might want to actually use privoxy and TOR by default, and only disable it for certain sites (or configure privoxy accordingly). You get the idea: this is just a very minimal approach to disable tracking exactly by the Google search site. It all depends on how serious you are about privacy and how important data throughput is for you.Also it will allow you to access certain TOR functionality (such as hidden services) without running TOR all the time (after all, it is and will always be slower than direct access).[Update: apparently some TOR exit nodes trigger a spam protection on Google, and without cookies you can't solve the captcha. So the use of TOR doesn't work well with Google. All the privoxy cookie blocking however is still recommended.]

Last week I was in Extreamdura, Spain, polishing fai for Lenny. So I only fixed one RC bug (494243), which was affecting Lenny the day mrvn pointed me to it, but wasnt anymore when I uploaded it yesterday. The reason is simple: quite some removals of buggy packages have taken place, yay! (And gerris was one of them...)

Speaking of which, the bug count has been gone quite dramatically. According to the simple graph we are down to 310 (last week 383, the week before 428), according to this turmzimmer view we are now down to 266 (last week 339), but I have found yet a better one, according to which we are at 144 RC bugs affecting Lenny!

144 bugs ain't many for a thousand developers ;-))

Last week I pointed you to rc-alert, which helps finding buggy software you are using. Rhonda pointed out

rc-alert -d TU -o and

to me, which will show RC bugs (of packages installed on your system) which are open in unstable _and_ testing. This only works in testing/lenny or with devscripts from backports.org. It won't show you which have been removed from testing though ;-) Read the rc-alert manpage for other interesting queries to hunt bugs!

In an hour the online part of this combined embedded+fai meeting in Badajoz in Extremadura, Spain, will sadly be over, but the sadness will hopefully be compensated by good food (yes, the food at the last dinner was great) and more fun! To me it were three intensive days (plus some two half days of intense travelling) which were really productive. This post is a summary of what I did here, to document how useful these meetings are. I'm only one person out of 18, who did some Debian work here, much more stuff was done, most of it I probably didnt even notice, as 14 people where working on embedded stuff, which I mostly ignored... ;-) That said, I think it was still very nice to have this meeting together, a.) because I'm quite interested in embedded stuff and b.) because the embedded crowd is a fun one to hang around with!

Right now I'm quite tired so that I dont fully remember what I have done on the first day :) It included uploading the DebConf7 mpeg videos which will now be used by Miguel Gea to create DVDs from those, so that he gets familar with the toolchain, so that he then can do the DebConf8 DVDs once those videos are (fully) ready. That will still take some time though, but hopefully not too long.

Unlike DebConf8 I also brought my fancy new fonera2 with me, in the hope to give it to someone to work on emdebian support for it. This is quite a longer road, as currently uclibc is not part of Debian, but thats only one step in this puzzle. Much to my joy Per Andersson took the opportunity to play with it and now took it home with him to document how to run Debian on it. I'm looking forward to see progress on this in the future ;-) Update: uclibc support is only needed for running Debian from the 4mb flash it has. But since it also has an usbport one can attach some storage there and run a full Debian system, just like on the nslug, which also has 32mb of RAM.

Unfortunatly I basically forgot about the FSG-3 I also took with me (which was for good reasons, one the second and third day I mostly did FAI work), but then I remembered 90min before the end, which was really too late. Narf. But Riku had a short look at it and told me one thing I didn't knew before: (at least) arm(el) kernels need to have the cpu id set in the kernel and the debian kernels don't have that, as they are build for more than one cpu type, so one has to prepend an arm assembler code instruction before running the kernel... I'm curious to do this soon :-)

But I have more hardware news to tell: C sar G mez Mart n (thanks for organizing this meeting, too!!!1) gave me back my OLPC laptop which I borrowed to him quite some time ago, so he could use it for a talk he gave at a university in Extremadura, so now I finally could give Andres Salomon new debian image for the XO a try. It was really nice to finally see a nice Debian gnome desktop on the device :-)

Today the FAI group, that was Sebastian, Michael, Thomas and me, also took a break to visit the Alcazaba de Badajoz (built around 1100, so roughly 900 years ago) which is an amazing building (thats why I linked to the spanish wikipedia entry as it has nicer pictures), from where you can see most of the city. I've been to Badajoz at least three times now and I'm really glad I finally did that, it's only 5min away from the office where the meeting was held and I highly recommend it to anyone going here.

Oh, and last and definitly not least I did a lot of work on FAI too. Besides discussing stuff which will hit planet after I posted this (hah! Michael already posted it, though without proper credit, so I will do a repost) I mostly reviewed changes and patches and discussed bugs, I didn't develop many patches myself (well, except one for the changelog..) but I've read every change at least twice, once as a commit msg and once in a full review. Plus many patches I read more often... all in all I think FAI is now in an great shape for lenny (which was the only thing we worked on during the weekend, we discussed some future plans, but work was only done for lenny), except that we want to another upload (with only documentation changes) after the upcoming one (which has quite some documentation changes already, but also some RC+important and some trivial bugfixes).

As you might have guessed, I started this entry on saturday and am finishing it now. According to the topic of the #extremadura2008 channel, which we created to coordinate between the groups, we also fixed 7 RC bugs (or 8? one should really document the bug numbers and not the number of bugs..) affecting lenny and 3 more which are only relevant to sid. Which is not as many as I would have liked to be fixed, but then, it wasn't a ("traditional") bug squashing party either. Which makes me wonder, are there any planned in the coming weeks?

So all in all I think this meeting was really very productive. Plus, I also enjoyed a special half an hour of real holidays: on saturday we had to leave lunch without having a chance to have a coffee afterwards, so I stumbled into a random cafe on the way to the venue. Turned out it was a very nice one, where due to its nice interiour I managed to reflect on life, 42 and all the rest almost immediatly. A totally unexpected but needed break. I wont say more here, because the thoughts and memories are really mostly relevant for me, but I'm really happy I found that space. DebConf8 and this meeting both were really fun, but I really didnt have a minute to reflect things. 30 minutes to do that is definitly not enough, but it was a good start. Now I just need to find another opportunity to continue with it. I hope this will happen before the next Extremadura meeting ;-)

For the last few days I’ve been in the city Badajoz in region Extremadura of Spain at the FAI developer meeting. Check out the Linex Euronews Video at youtube to get a short impression of Linux in the region. Lessions learnt:

• debcommit is great, it generates a commit message based on new text in debian/changelog (thanks for the pointer, Holger)
• rc-alert lists installed packages which have release-critical bugs, nice (again part of devscripts, I should take a whole day to take a closer look at all the nifty stuff in devscripts; thanks again, Holger)
• use caff (Debian package signing-party) for keysigning (thanks tokkee for the reminder, I always forget the name of it)
• collectd (statistics collection and monitoring daemon) seems to rock (thanks again, tokkee)
• chdk is a firmware add-on for Canon’s Digic II & Digic III cameras and really rocks (thanks for the pointer Thomas, allbest-a700-100b-50.zip works fine for my Canon Powershot A700)
• ganglia (cluster system monitoring daemon) looks nice as well (thanks Thomas)
• workrave (Repetitive Strain Injury prevention tool) seems to be perfect for me (thanks again, Thomas)

<insider>

</insider>

Nearly a week after its release, I suspect most of my audience has seen the FSF's Freedom Fry video of Stephen Fry wishing the GNU project and the free software movement a happy birthday. While I'm not usually one for birthdays, I thought I'd at least reflect on it briefly. Certainly, it's a wonderful video -- for which Matt Lee at others at the FSF should be proud. But it's fact that the GNU project is now twenty-five years old that is truly noteworthy. Wikipedia says that a generation (i.e., the average interval between the birth of parents and of their offspring) is somewhere between 25-30 years in most of the Western world. Twenty-five years isn't just a big number divisible by five, it marks a generational shift. Certainly, GNU has matured and accomplished wonderful things in last quarter-century. More importantly perhaps, it's produced wonderful progeny. It has spawned hundreds of thousands of free software projects, thousands of free or nearly-free operating systems, and an unbelievably vibrant global free and open source software community. Beyond the software realm, the free culture movement, most free licensing projects, and much of the access to knowledge movement can trace a connection back to GNU. We are living, and building, a new generation of the free software movement. It's not been an entirely smooth ride, feelings have been hurt, and it's hard for GNU's proponents -- myself included -- to not wince at some of what has been done in GNU's name and because of its example. But even cynics must admit: the world is an undeniably better place because of GNU and the efforts and ideas that it has motivated. I turn 28 in December and have spent my entire computing life in world where free software was a viable option and an active form of resistance. Here's to another generation! May we be half as productive and positive as the last!

After more than one week of string freeze for Debian Installer, here's the status (I post it daily on debian-boot and debian-i18n mailing lists). 15 days are left before the end of the string freeze 34 Languages meet the release criteria: Arabic, Belarusian, Bulgarian, Czech, German, Dzongkha, Basque, Finnish, French, Galician, Gujarati, Hindi, Croatian, Italian, Japanese, Korean, Lithuanian, Malayalam, Marathi, Norwegian Bokm l, Dutch, Polish, Portuguese, Punjabi, Brazilian Portuguese, Romanian, Russian, Slovak, Swedish, Tamil, Thai, Turkish, Traditional Chinese 27 currently activated Languages *fail* and risk to be disabled et the end of the freeze: Amharic, Bengali, Bosnian, Catalan, Danish, Greek, Esperanto, Spanish, Estonian, Hebrew, Hungarian, Indonesian, Georgian, Khmer, Kurdish, Latvian, Macedonian, Nepali, Norwegian Nynorsk, Northern Sami, Slovenian, Albanian, Tagalog, Ukrainian, Wolof, Simplified Chinese 14 more languages are under work but will probably not make it: Afrikaans, Welsh, Persian, Irish, Armenian, Icelandic, Kazakh, Kannada, Malagasy, Malay, Serbian, Telugu, Urdu, Xhosa In short, this summarizes to "hurry if you don't want your language disappear from D-I"...:-)