Search Results: "cas"

28 June 2008

Martin F. Krafft: Tatort: quality television

When I got home last night, I couldn t sleep and instead popped a DVD into the drive and sat back to watch an episode of the famous Tatort series (German only). Tatort ( crime site ) episodes tell the tale of police investigations, but without stuntmen and special effects, without sci-fi elements or threadbare settings and stories, without technology and gadgets. In fact, it just feels plain as if it could happen next door tomorrow. The characters are normal as you and I, but played beautifully, with witty and enjoyable dialogues, which seem familiar and natural to me as a German, rather than trying to be funny or cool. Yet, the two main investigators, Batic and Leitmayr, are awesome and it s good fun to watch them inch towards solving the mysteries. I watched the episode Norbert , and I really enjoyed it. The plot is full of surprises, and the viewer is (purposely) mislead on various occasions. It was suspenseful until the end. I ve seen maybe 20 of the thousands of episodes (it airs every Sunday night since 1970), and this one was so far my favourite. Quality television! It s a shame the (Dutch) DVDs I have do not have English subtitles. NP: Dimmer: I Believe You Are a Star

27 June 2008

Russell Coker: The New DNS Mess

The Age has an interesting article about proposed DNS changes [1]. Apparently ICANN is going to sell top level DNS names and a prediction has been made that they will cost more than $100,000 each. A suggestion for a potential use of this would be to have cities as top level names (a .paris TLD was given as an example). The problem with this is that they are not unique. Countries that were colonised in recent times (such as the US and Australia) have many names copied from Europe. It will be interesting to see how they plan to determine which of the cities registers names, for the .paris example I’m sure that the council of Paris Illinois [2] would love to register it. Does the oldest city win an international trademark dispute over a TLD? The current situation is that French law unambiguously determines who gets to register paris.fr and someone who sees the URL will have no confusion as to what it means (providing that they know that fr is the ISO country code for France). As well as city names there are region names which are used for products. Australian vineyards produce a lot of sparkling wine that they like to call Champagne and a lot of fortified wine that they like to call Port. There are ongoing battles about how these names can be used and it seems likely to me that the Australian wine industry will change to other terms. But in the mean-time it would be interesting if .champagne and .port were registered by Australian companies. The fuss that would surely cause would probably give enough free publicity to the Australian wine industry to justify an investment of $200,000 on TLDs. The concern that is cited by business people (including the client who forwarded me the URL and requested my comments) is that of the expense of protecting a brand. Currently if you have a company named “Example” you can register example.com, example.net, and example.org if you are feeling enthusiastic. Then if you have a significant presence in any country you could register your name in the DNS hierarchy for that country (large companies try to register their name in every country - for a multinational registering ~200 domains is not really difficult or expensive). But if anyone can create a new TLD (and therefore if new ones are liable to be created at any time) it becomes much more difficult. For example if a new TLD was created every day then a multi-national corporation would need to assign an employee to work full-time on investigating the new TLDs and deciding which ones to use. A small company that has an international presence (IE an Internet company) would just lose a significant amount of control over their name. I don’t believe that this is as much of a concern as some people (such as my client) do. Currently I could register a phone line with a listed name indicating that it belongs to the Melbourne branch of a multi-national corporation. I don’t expect that Telstra would stop me, but the benefit from doing this would be minimal (probably someone who attempted fraud using such means would not gain much and would get shut down quickly). I don’t think that a DNS name registered under a .melbourne TLD would cause much more harm than a phone number listed in the Melbourne phone book. Incidentally for readers from the US, I’m thinking of Melbourne in Australia not a city of the same name in the US - yet another example of a name conflict. Now I believe that it would be better if small companies didn’t use .com domains. The use of country specific names relevant to where they work are more appropriate and technically easier to implement. I don’t regret registering coker.com.au instead of some name in another country or in the .com hierarchy. Things would probably be working better right now if a .com domain name had always cost $100,000 and there were only a few dozen companies that had registered them. But we have to go with the flow sometimes, so I have registered RussellCoker.com. Now when considering the merit of an idea we should consider who benefits and who (if anyone) loses. Ideally we would choose options that provide benefits for many people and losses for few (or none). In this case it seems that the suggested changes would be a loss for corporations that want to protect their brand, a loss for end-users who just want to find something without confusion, and provide more benefits for domain-squatters than anyone else. Maybe I should register icann.port and icann.champagne if those TLDs are registered in Australia and impersonate ICANN. ;)

Share This

26 June 2008

Decklin Foster: The data are

So I always knew that my ThinkPad's display sucked. But now I have scientific proof! (Long-winded post about my job follows.) I was running some timing tests at work on the code for a psychology experiment. This involves quickly presenting a stimulus to the subject, then measuring reaction time and synchronizing with EEG readings. Nothing very complicated, but accurate timing is essential; you don't want another variable confounding your results. So I have this photocell device that sends a signal to a Mac through the EEG hardware when there is really actually physical light coming off of the screen, not just when I told the computer to display something. Now CRTs, of course, are actually scanning (with an electron gun) the display at 75 or 85 Hz or something, not constantly pumping out light to the whole screen. This means 12 or 13 (or whatever) ms between refreshes. So if you want something to appear for 100 ms, you have to fudge a little, and make it so that you get maybe 8 or 9 scans. You can synchronize your presentation to the refresh so this is feasible. But how long the subject really perceives it ultimately depends on how "flickery" the monitor is at a given refresh rate. LCDs, on the other hand, do not have this problem. They actually do produce light constantly -- their refresh rate is pretty much always only 60 Hz or less, but you get the same(ish) output over the entire cycle, instead of in blips that give the illusion of a constant image (in fact, as Matthew points out, they can continue to hold the same image for even longer periods between refreshes. Can't wait to try out that patch). And luckily for us, 6 cycles are in theory exactly 100 ms (in practice, it's close enough). Or so I thought. I could not, no matter how many times I banged my head against it, get consistent results between our laptop (also a ThinkPad) and any external display. For reasons I do not entirely understand (probably scheduling issues), on CRTs I was getting one extra cycle, so I had to reduce the time by one to compensate. This was done for published studies years before I arrived at the lab, so (for the sake of not introducing additional variables) there is an extremely large disincentive to go back and fix it the Right Way, whatever that is. Our laptop's internal display was producing results that were skewed like those of a CRT. I thought for a minute I was going nuts from testing all day, but it kept happening. Curious, I swapped out the lab's T60 for my faster T61 and (to rule anything else out) killed all my other processes and wrote a fresh PyEPL script that did nothing but repeatedly blink some text for 100 ms. Here is, on the external VGA port, a cheap old 15" Dell LCD I pulled from the server room: http://www.rupamsunyata.org/~decklin/blogfiles/20080626/vga-lcd.png (These images are from the Mac, which is still using System 9.something. I had to remember Command-Shift-3 to take a screenshot and use StuffIt to get them off of it. Srsly. I can't remember the last time I used StuffIt.) And here is a CRT, showing the refreshes: (The DIN3 line is the actual signal, and the others are integrated over some number of milliseconds to compensate for scanning and attempt to get a usable number. Of course, this is done in hardware, not synchronized to anything else.) http://www.rupamsunyata.org/~decklin/blogfiles/20080626/vga-crt.png Now, this is the one that blew my mind. The ThinkPad's internal LCD: http://www.rupamsunyata.org/~decklin/blogfiles/20080626/lvds-lcd.png You can see that 60 Hz is spaced much farther apart, and that there are 6 cycles as intended, but. It's acting like a CRT! On the refresh, it puts out enough light to trigger the photocell, but inbetween, nothing. I ought to be noticing flicker and/or getting headaches all the time, if this is truly the case. (I guess I did get glasses for and because of staring at computer displays all the time. Should update my hackergotchi.) I have to admit I do not understand what is going on here at all. But it seems like making any assumptions about a display is (as the voice in my head was telling me all along) a very bad idea. Perhaps someone can email me some clue. But at least I have some hard data to validate my subjective opinion of the ThinkPad's internal LCD. Anyway: I still recommend the ThinkPad, even if the display is awful. I have a nice external monitor connected through DVI to the dock at home, and I mainly use a laptop so I can get out of the house and go hack outside or in a coffeeshop (not ideal lighting). The build quality, keyboard/trackpoint, performance, and the fact that Debian (testing or unstable, anyway) Just Works are all higher up on the list for me. I do wish I could afford the new lighter one, though.

Uwe Hermann: Configure Firefox/Iceweasel 3 to be more secure / usable / bearable

Today seems to be Firefox/Iceweasel 3 Bashing Day on Planet Debian, so let me join the fun :) I agree with most other people that the default Firefox/Iceweasel 3 config is not ideal, so here's what I did to fix it. Some of these items improve performance, some remove annoyances, some remove privacy issues, some remove security issues. Not everything here may be desirable for people other than me. General Preferences Select "Edit / Preferences". Main: Tabs: Content: Privacy: Security: Advanced:

Neil Williams: Migrating Emdebian changes into Debian, not Ubuntu

During the Emdebian Worksession at TCl, various improvements were made to dpkg-cross, apt-cross and emdebian-tools packages. After a few delays caused by (what turned out to be) a 4 extension cable that blew up 300 of equipment, I'm finally merging those changes into the Debian packages - yet I don't have any control over the same changes in Ubuntu.

I really don't like Launchpad (I have quite enough web-logins thank you very much) or the PTS link that shows Ubuntu bugs that I cannot close from Debian. Lucas' assurance that "I don't expect Debian maintainers to reply to bugs on launchpad", makes it even harder to see the point of the bug listed in the emdebian-tools PTS.



Makes me wonder if a Not-For-Ubuntu field could be used in debian/control to force the removal of Debian packages from Ubuntu Universe where the Ubuntu setup is simply incompatible with the Debian package. This isn't something that the MOTD can "patch-up" in Ubuntu - it is a fundamental difference between Debian and Ubuntu that goes right back to the roots of why Ubuntu was created in the first place.

Yes, I can ignore Ubuntu (already do) but it is still annoying that there are bugs that simply cannot be fixed (and that the Debian PTS reminds me of that fact).

Maybe if someone who does care about such things and has a Ubuntu launchpad login wants to close the bug as "wontfix" or equivalent . . .
https://bugs.launchpad.net/ubuntu/+source/emdebian-tools/+bug/121369 - just to clear it off my radar?

(Oh and why does LP insist on https??? I'm not logged in, that's the entire POINT!) Bah.

Martin F. Krafft: Euro 2008 rage

As some of you may know, the Euro 2008 football championships are on in Austria and Switzerland at the moment. I am not a football fan at all, although I won t mind watching a game between two skilled and fairplaying teams (which is becoming a rarity, I heard). But I don t care much about it, unless it negatively affects those who don t care (which includes myself). For instance, last night, after Germany beat Turkey in the semi-finals, a group of hooligans roamed about in Dresden and vandalised Turkish food shops and hurt the people working there (German only). I can kind of understand fans getting overly excited and driving their cars madly through the city, honking the horns at frequencies directly proportional to their cumulative personality disorders (or inversely proportional to their penis size), but violence in reaction to winning? Fuck you, you low pieces of shit. ! Update: there seems to be no information on whether the attackers were German. A foreigner living in Berlin has written in to complain that my blog post casts a negative light onto Germany in terms of hostility towards foreigners, which he disputes. Germany has had to fight that image for decades, and my blog post puts fresh petrol on the fire. I do not intend that. I leave it up to each individual to make up their own mind, and to me, a group of hooligans is in no way representative of an entire nation. End update Quite clearly, there are people on the street who should be locked up. I won t go there though, at least not in this post. Instead, let s talk more about football and its effects, because encouraging this sort of violence is only one of many consequences, which we are forced to tolerate in the interest of the public. Everyone wants football, right? What follows are somewhat related, but otherwise incoherent rants. Enjoy, or stop reading. I m not a misanthrope, I think. There are many other aspects of this football event which make me want to throw up. One of them is the (sight of the) average organism who participates in the craze. Look at them! Monkeys are more intelligent than that! Has evolution taken a 180 degree turn? Of course, you can t blame the individuals, as their brains have been flooded and effectively shut off, so they don t make any trouble when they trott along the path to dumbification. It s the big companies and the media industry, blinded by short sight, do everything in their power to speed up this decline, fueling the consumerism of the stupified morons making up our the populace, just for the paycheck at the end of the day. The UEFA is primarily a huge money-making machine, and if you want more information on that I suggest that you look a bit into the distribution of media rights for the event. Another instance, which has a little more relevance to the normal person on the street is their ticket distribution: people have to pay hundreds of Euros to UEFA a year before the event for a chance to be given a ticket for any random day. The ticket is made out in their name and cannot be transferred. If you can t make the game, you can return the ticket to get you money back after the event. If you don t get a ticket, you ll also get your money back a year later. Interest-free loans, anyone? But hey, I actually don t care about most of that. Let those who want to consume consume, let those who can t entertain themselves watch television, let the UEFA and media people get rich by making people stupid, and let me go about my daily business. We held a small barbeque party some days ago, and I went out to buy a few kegs of beer from a local brewery. That was my first confrontation with the football circus, as the brewery happens to be about half a kilometre from the stadium where a match was on that night. It took me at least 40 minutes until I had argued successfully with five police officers and could pick up the kegs. Swap brewery for any of the other shops in the area, who did not receive any compensation whatsoever, and you ll note how the football circus takes priority over everyone s everyday life, even if you don t give a single flying food for the sport. I love Zurich, and just like most people, taking a stroll along the lakeside, between Bellevue and the Chinese Garden on a sunny afternoon is one of the more delightful ways to spend time in the city and enjoy its beauty unless they are putting up massive public viewing areas everywhere (and make shitloads of noise in doing so), and even dump elevated VIP platforms into the lake to add noise in the view to the noise in the ear. The official entities of Switzerland surely pushed for the event, as it drives tourism and brings money into the country. But were the people actually considered? Could we have done anything against this craze? I bet noone ever asked. I find it very sad how much garbage these fan monkeys produce. Switzerland is well-organised, and there are plenty of garbage cans around, many of which have been put in place specifically for the event, but it s already too much to ask of these low organisms to put the shit left from their consumption into those bins. And I won t even go near the question of how much energy this entire event wastes. Yay entertainment! Yay stupification of the populace! If you have football to celebrate, you don t have to consider the environment, or poverty, or other such annoying issues. Sunday night, the circus will come to an end, and what ll be left is a few days of cleaning and tearing down all the structures. Then this place will finally retun back to normal, and there ll be a little less idiots on the street, at least in the places I frequent. NP: Dimmer: There My Dear

Russell Coker: Dell PowerEdge T105

Today I received a Dell PowerEDGE T105 for use by a client. My client had some servers for development and testing hosted in a server room at significant expense. They also needed an offsite backup of critical data. So I suggested that they buy a cheap server-class machine, put it on a fast ADSL connection at their home, and use Xen DomU’s on that for development, testing, and backup. My client liked the concept but didn’t like the idea of having a server in his home. So I’m going to run the server from my home. I selected a Dell PowerEDGE tower system because it’s the cheapest server-class machine that can be purchased new. I have a slight preference for HP hardware but HP gear is probably more expensive and they are not a customer focussed company (they couldn’t even give me a price). So exactly a week after placing my order I received my shiny new Dell system, and it didn’t work. I booted a CentOS CD and ran “memtest” and the machine performed a hard reset. When it booted again it informed me that the event log had a message, and the message was “Uncorrectable ECC Error” with extra data of “DIMM 2,2“. While it sucks quite badly to receive a new machine that doesn’t work, that’s about the best result you can hope for when you have a serious error on the motherboard or the RAM. A machine without ECC memory would probably just randomly crash every so often and maybe lose data (see my previous post on the relative merits of ECC RAM and RAID [1]). So I phoned up Dell (it’s a pity that their “Packing Slip” was a low quality photocopy which didn’t allow me to read their phone number and that the shipping box also didn’t include the number so I had to look them up on the web) to get technical support. Once we had established that by removing the DIMMs and reinserting them I had proved that there was a hardware fault they agreed to send out a technician with a replacement motherboard and RAM. I’m now glad that I bought the RAM from Dell. Dell’s business model seems to revolve around low base prices for hardware and then extremely high prices for extras, for example Dell sells 1TB SATA disks for $818.40 while MSY [1] has them for $215 or $233 depending on brand. When I get the machine working I will buy two 1TB disks from MSY (or another company with similar prices). Not only does that save some money but it also means that I can get different brands of disk. I believe that having different brands of hard disk in a RAID-1 array will decrease the probability of having them both fail at the same time. One interesting thing about the PowerEdge T105 is that Dell will only sell two disks for it, but it has four SATA connectors on the motherboard, one is used for a SATA DVD player so it would be easy to support three disks. Four disks could be installed if a PCIe SATA controller was used (one in the space for a FDD and another in the space for a second CD/DVD drive), and if you were prepared to go without a CD/DVD drive then five internal disks could probably work. But without any special hardware the space for a second CD/DVD drive is just begging to be used for a third hard disk, most servers only use the primary CD/DVD drive for installing the OS and I expect that the demand for two CD/DVD drives in a server is extremely low. Personally I would prefer it if servers shipped with external USB DVD drives for installing the OS. Then when I install a server room I could leave one or two drives there in case a system recovery is needed and use the rest for desktop machines. One thing that they seem to have messed up is the lack of a filter for the air intake fan at the front of the case. The Opteron CPU has a fan that’s about 11cm wide which sucks in air from the front of the machine, in front of that fan there is a 4cm gap which would nicely fit a little sponge filter. Either they messed up the design or somehow my air filter got lost in transit. Incidentally if you want to buy from Dell in Australia then you need to configure your OS to not use ECN (Explicit Congestion Notification [2] as the Dell web servers used for sales rejects all connections from hosts with ECN enabled. It’s interesting that the web servers used for providing promotional information work fine with ECN and it’s only if you want to buy that it bites you. But in spite of these issues, I am still happy with Dell overall. Their machine was DOA, that happens sometimes and the next day service is good (NB I didn’t pay extra for better service). I expect that they will fix it tomorrow and I’ll buy more of their gear in future. Update: I forgot to mention that Dell shipped the machine with two power cables. While two power cables is a good thing for the more expensive servers that have redundant PSUs, for a machine with only one PSU it’s a bit of a waste. For some time I’ve been collecting computer power cables faster than I’ve been using them (due to machines dying and due to clients who want machines but already have spare power cables). So I’ve started giving them away at meetings of my local LUG. At the last meeting I gave away a bag of power cables and I plan to keep taking cables to the meetings until people stop accepting them.

Share This

25 June 2008

Russell Coker: Safety of Child Seats

I have just watched an interesting lecture by Steven Levitt about car safety for children in the 2-6 age range [1]. The evidence he presents shows that the benefits for children in that age range are at best insignificant and that in some corner cases (EG rear impacts) the child seat may give a worse result than an adult seat belt! He advocates a 5-point harness [2] for children in the 2-6 age range that is based on a standard adult seat and seems to be advocating a child “booster seat” integrated into the adult seat (which approximates the booster seats offered by some recent cars such as the VW Passat). He has a picture of a child in a child-sized 5-point harness to illustrate his point. But one thing that should be considered is the benefit of a 5 point harness for adults. Race car drivers use 5 point harnesses, I wonder how the probability of a race car dying during the course of their employment compares with the probability of an average adult dying while doing regular driving. I also wonder how a 5 point harness compares to a three point harness with a pre-tensioner, it seems quite possible that a 5 point harness would be cheaper and safer than the 3 point harness with pre-tensioner that is found in all the most expensive cars manufactured in the last few years. He believes (based on tests with crash-test dummies) that part of the problem is that the child seat will move in an accident (it’s attached to a soft seat). It seems that one potential solution to this is to have child seats that firmly attach to some solid part of a vehicle. I had previously suggested that child seats which replace existing seats as an option from the manufacturer would be a good idea [3]. But there is a good option for making better child seats for existing vehicles. It is becoming common in the “people mover” market segment to design vehicles with removable seats. For example the Kia Carnival has three seats in the middle row which are removable and which attach to four steel bars in the floor. It should not be difficult to design a child seat which attaches to those bars and could therefore be plugged in to a Carnival in a matter of minutes. The Carnival is designed to have the mid row seats installed or removed easily and safely by someone who is untrained, while for comparison it is recommended that a regular child seat should only be installed by a trained professional (IE your regular mechanic can’t do it).

Share This

David Moreno Garza: YAPC::NA 2008

So I attended the conference last week in Chicago, IL. I was just been procrastinating to write about this.

As a (almost) complete outsider of the Perl community, I have countered thoughts about the whole event:

After all, it was quite a nice and new experience. I'm not totally sure I'll attend YAPC::NA 2009 in Pittsburgh, PA, we'll see.

Clint Adams: Relaxation

I was misled. That much is probably true. I certainly had no idea what I was getting myself into. Enough of that though; there's narrative fading away. The part I should take responsibility for is the decision I made to stray off the map. Perhaps it was not so much a decision as a compulsion. I looked at the map. I saw the suspicious unmarked area at the edge, and concluded immediately that there was something good there, something the people wanted to keep hidden from me. I was correct, but I presumed far too much about the terrain. I thought I would make a quick exploration of the secret place, then backtrack to the more mapped area and get back with the program. Enough of that though; I've nearly forgotten the story. First I should point out that, had the map been to scale, it should have taken me an leisurely fifteen minutes to get to my first destination. It should have, assuming the land would be as flat as the map that represented it. Instead, it turned out to be something one could cover in fifteen minutes if one had, say, a jetpack and spring boots. I'm probably wrong; I'd probably injure myself in the process and take longer. Anyway, the average incline was close to 45 , and luckily was mostly uphill. Luckily. When I got to a resting place, I was able to conclude that my supply of fluids was almost certainly insufficient for me to continue. On the other hand, there was probably no way I would return if I went back for more drink. I told myself that there would likely be a beverage-selling shack out in the middle of nowhere around the next bend or so. Having solved this probability problem, I pressed on into the blazing sun. I came to a path leading down to the sea. It was unclear what was down there, but it was clear that it seemed to be a million miles down, and that that path might be the only way back. Given my current state of exhaustion and hydration, I decided to pass on this opportunity. After continuing for a while, the features at the bottom of that path became visible. A very pretty cove was down there, and almost certainly no shack o' drinks. I then came upon a fork. A wide path led downward: to what, I could not see. To its left, a narrow and rough path led straight. Knowing that a descent probably meant climbing four to eight times the altitude back somehow, and assuming the less pleasant-looking path led somewhere better, I went left. After a while, the land began to slope down, ever so slightly. Little clusters of bottles and newspapers were left on the rocks here and there. Then came a sofa under a tent. I began to wonder what hippies were traveling this path. The slope grew greater, and I passed a bench in a tent. Then I came to a giant staircase, almost straight down. It was covered in weeds and insects. Some were vegan, some wanted my flesh. As I got toward the bottom I thought about how glad I was that I had come that way from the top and not the other way around. Oh, I was very glad. At the bottom was something resembling a plastic bottle graveyard and barrels among barrels filled with water. Rubber hoses seemed to run randomly between certain barrels. A kitchen stood at the edge of some barrels. I suddenly got the feeling that I was not supposed to be here. After discovering that a couple of escape routes were actually dead ends, I proceeded to descend a small staircase to a terraced garden. Hoses lay about the rows, presumably for watering the plants. A cot under a tent lay empty, and I hurried past hoping I would not encounter the owner. Then I was at the ocean. The coast was lined with huge boulders, and a wooden bridge led me to the first one, and another wooden bridge took me to the second. Then the bridges stopped. In the distance, I could see that pretty little cove from before. I took stock. I could either return whence I came, up that horrifying staircase, or I could try to traverse the rocky coast over to the cove, then maybe do a faceplant on the beach and let the tide drown me rather than climbing back up. It seemed like a no-brainer, so I began making my way toward the cove. It got harder. Several times I became very afraid, either of falling and smashing my head against a rock or falling into the water below, or some sequential combination thereof. In the end I turned out to be more afraid of going back, at least until I got to what I judged the point of no return. I was reasonably close to where I imagined the sandy beach started, but there was a huge and impassable boulder in the way. Also, if I went further there was no way I would be able to climb back up in case I needed to retreat. I was thinking I would need to retreat, because unless there was some magical hidden toehold, I would be forced to jump into the water and swim around. I did not want to jump into the water. I wanted my phone to stay unfried in the event that I would need to use it to get rescued. I also did not want to call anyone to get rescued, especially since I didn't really know how to explain where I was. With a heavy sigh, I gave up, turned, and went back. This time I moved more quickly, though incurring more damage to my hands and feet. No humans were visible at the crazy farm/garden and makeshift reservoir, but plenty of bugs were visible on the staircase. I made the mistake of trying to lean against the railing to catch my breath. When I finally got to the bench in the tent, I understood exactly what it was for. I sat down, took a sip of my remaining water, ate an apple, and kept going up. When I got to the couch, I sat again. This time I sat and tried to figure out a plan. I still clung to the belief that once I got back to somewhere less wild I'd be able to buy a drink. I noted that I only had a little bit of water left, that I was dehydrated, that I was sunburned, that my pulse was about 180, and that there were no dogs or Russian people wandering past me. I ate a pear and drank my last few drops of water. I kept sitting until my pulse was down to around 150, then I figured I needed to keep moving. I was experiencing most of the effects of caffeine, and for free. Oddly, I passed a dog a few steps later. It was just standing by a rock, looking at me. I decided not to converse. When I had nearly reached the fork again, a couple came my way. I thought about begging them for water. I decided not to be rude. I have no idea what happened to them. I'm betting they wisely decided not to go down the steps. Resolving that the only sane option was to go back all the way to where I absolutely knew I could buy something potable, I headed in that direction. Still, I took two risks. Instead of going up the exact way I had come, or taking a well-travelled path down, I took a narrow and flat dirt path. It was actually a bit of a dilemma. I started down the latter two more than once each. Finally I saw that the down path was rather V shaped, and I concluded correctly that the straight path would bypass that angular-half-pipe-like construct. When I finally got to a point I recognized, it was smooth sailing the rest of the way down. I bought water and a snack, since I had had almost nothing to eat that day. At this point it would have been prudent to call it quits and go off and gorge myself on seafood or something, but no, I was now in the mapped area and surely it would all be roses and manna. Finishing one bottle, I bought two more. Five minutes later I bought another. I had now overcompensated, but I was playing it safe. I continued my explorations. Bicyclists kept nearly running into me, and, aside from the obvious, I viewed this as a good sign. Bicyclists, especially those that can't seem to steer straight for some reason, avoid difficult terrain. This is why they take their bikes on subways, trains, and buses. I don't like bike-riding, but if I had my druthers, I would always go downhill. No up, no flat, just down. Like downhill skiing, just down. It is a good thing I don't ride a bike. Once I got to the point where the bicycles thinned out to nonexistence, I was at an intersection. The way I wanted to go was up. The way I didn't want to go, but was a reasonable option, was only very slightly up. Additional factors complicated this decision point. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. Moving hurriedly away from there, I headed upward. After a couple of turns, I ran into Catholics. First there were dead Catholics. Then there were Catholics pre-occupied with dead Catholics. Then there were Catholics waiting to die. Then there were seminarians. Then there were teens with prayer books. When I reached the next pinnacle, there were more teens with prayer books. There were benches, and there were no teens on them, for the teens were standing or sitting on the ground, quietly contemplating the Word. Unfortunately, they had decided that the benches were more suitable for holding all their bags, so there was nowhere for me to sit. I considered interrupting their reverie, but decided it wouldn't be very Christian of me to disturb them, so I just placed an ancient Drasnian curse on them and plodded down the hill toward a small beach. I really didn't need any more sun, but at least there probably wouldn't be anyone praying there. The water was tempting, but I'm always paranoid about my belongings when swimming alone, and if my phone were taken I wouldn't be able to call anybody to come rescue me at the next crisis point, sure to come. So I skirted the coastline and arrived at a much larger beach, one with facilities and services. Opting to save money but complicate things by using the public changing rooms and showers, I made a discovery. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. Nonetheless, I changed into my swimming trunks, stuffed everything else but my towel, sunglasses, and a disgusting sugary drink I never should have bought into my bag, and went barefoot a few buildings down to rent a locker. The locker was ridiculously large for a single person, which is good to know should I ever want to kidnap a family and torture them at this place. The proprietor informed me that they were closing at some specific time, about an hour from then. I had no timekeeping device outside of the locker, so I had to wing it, and erring heavily on the side of caution, I had a short beach diversion. Given that large swathes of my epidermis were turning bright red, it's probably for the best. Handling the shower, locker, and changing in the other direction was slightly more complicated, but I did it and then I headed inland, figuring I should have a substantial meal for once that day. On my way to find dinner is when things got really crazy. [elision] This passage has been marked friends-only and you will not be able to view it without logging in. I wandered over to a bench to eat my newly-acquired snack, and did not exercise enough caution, because the flimsy paper bag ripped and I got sauce all over my pants and a little on my shirt. Unfortunately I had used my napkin in that earlier episode, and I'm not sure how much it would have helped anyway. Thus I continued on, looking like a slobby retard. Then I made an obviously-poor decision and ended up having a subpar dinner. What happened after that is a story for another time.

24 June 2008

Lucas Nussbaum: question to Git (power)users

I’m slowly switching to Git for my personal projects, and I like it more and more. And it seems that I can only find nice things to read about it. So, I’m wondering: what are the things that you dislike with Git? That make you regret/prefer another VCS? If Git was redesigned from scratch, what should be changed?

Pablo Lorenzzoni: Ruby security advisory and fix

Debian 4.0 version of Ruby is open to the, now widely known, Ruby security vulnerabilities. The bug is reported as 487238 in Debian s BTS, and is closed, since the version now in sid (version 1.8.7.22-1) is already fixed. Users of stable can apply the patch provided by Daniel Franke (it doesn t seem to fix all, but goes a long way). Apparently, this brought up (again) the rants over full disclosure. Indeed, what is vulnerable is not that hard to find, as Zed Shaw showed us, so, why not talk about it in a plain and bold form? Why just provide the CVE numbers and ask for everybody to upgrade? Zed goes more deep about the quality of C code, but that is not the issue I want to talk about As a Free and Open Source Software supporter (and developer), I can see the benefits of full disclosure. As a not-full-time webmaster, I can see the benefits of not having a proof-of-concept piece of code attached to the vulnerability report. Of course, there s a lot of things a webmaster can do to prevent having a machine completely compromised in case a security advisory is published with a proof-of-concept code in it (think about chrooting, randomized memory protection, security libraries, grsecurity, SELinux, etc) and my machines, although vulnerable to the bug, would not be fully compromised if exploited. I guess one should be prepared to whatever comes from the Internet Full disclosure, in this sense, have more pros than cons, IMHO. For instance it was not clear if Debian 4.0 were vulnerable There were no security advisory coming from Debian (and there s still not), and it is not promptly obvious if the version packaged is affected. I know that at least I wanted to run a proof-of-concept to check if my server is vulnerable or not before going all the way into packaging a fix (or backporting the sid version), and it was not until I read Matasano Chargen Blog that I could test older versions. But different people have different ideas

Matthew Garrett: Power management design philosphy

One of the traditional problems with power management has been balancing power savings against reduced functionality. The two traditional approaches to this have been to have sane defaults or to let the user tweak them, with a hybrid approach being to have sane defaults and an "advanced" box that lets users set their own parameters.

Both of these options suck.

The problem with sane defaults is that power management is an area where the "sane default" genuinely does differ between users. Usage patterns will determine the appropriate spindown period for a hard drive. AHCI's ALPM will disable hotswap detection, which is fine for home users but a pain if people want to rip out a failed RAID element. ALPM also introduces a small amount of latency (on the order of a seek in the most aggressive mode), which is entirely irrelevant for almost everyone but is a pain if you're trying to offer i/o latency guarantees. PCI-E link power management adds small quantities of latency. Letting the CPU run to full speed whenever it wants to is good for power management but potentially bad for thermal management. Screensaver timeouts vary depending on whether you're watching a movie or not.

The problem with leaving everything tweakable is that you're asking users to make choices about things but not giving them the information they need to make those choices. Whether you get a power saving from hard drive spindown depends on whether the drive is idle for long enough to save the power you'll spend spinning it back up. Get it wrong and you'll be putting your drive under extra load, reducing performance and consuming more power than you were to begin with. If you limit the maximum speed of your CPU to keep it cool, you'll be wasting power and performance even when it's well below the thermal limits. Disabling ALPM because you might want to change a RAID device at some stage means you're consuming power despite generally not needing to use the additional functionality.

But while these options both suck in different ways, they share one fundamental failure. They both imply static configuration. The correct power management policy depends on the way that a machine is being used at a specific instant in time, and no matter how many power management profiles you add there's no way for a user to switch between them fast enough to obtain a decent power/performance ratio.

Adaptive power management adopts a different strategy. Rather than define a static policy (or several static policies), the hardware is monitored to determine the best power management settings. An example of this is the ondemand CPUfreq governor. Rather than attempt to provide a static configuration, the processor frequency is automatically changed to meet demand while also keeping the overall power consumption as low as possible. This patch adds a thermal component to its policy, preventing the machine from overheating. Result? No requirement to provide tunables to userspace.

Something similar is achievable with hard-drive spindown. By simply monitoring how often reads or writes actually hit disk, it's possible to automatically adjust the spindown period to obtain decent power savings while reducing the number of spinups. This approach is imperfect - in an ideal world we'd know to spin the drive up before it's needed, but that simply isn't possible. However, the user is almost certainly unable to make a better guess. It's not realistic for a user to be able to predict whether or not a given page is still in cache or has been evicted. Nothing is lost by providing a dynamic policy, and another unnecessary tunable has vanished.

The difficult part of an adaptive policy comes when roles are switched in ways that don't correspond to changse in hardware status. One of the most common cases is that of screensaver settings when the user is watching a video. It's not practical for the kernel or a system daemon to predict this case, so we have two choices:.One of these choices involves the user having to explicitly state something that's obvious - playing a video automatically implies the desire to adopt a different power management policy, and so asking the user to manually adjust that is ridiculous.

The loss of hotswap notifications when ALPM is enabled? Simply reenable it if SMART starts complaining or the RAID set becomes degraded or a filesystem is unmounted or any of the other things that will have to be done before a drive can be safely removed. Latency an issue? Let userspace tell you what its latency requirements are. When we get down to it, the only settings that we can't infer are things like idle-time-to-suspend, screensaver settings and default brightnesses. Which, curiously, are about the only things that Mac OS exposes[1].

The problem we face is that we don't currently have interfaces to let applications tell us what their requirements are. This is theoretically straightforward, but getting it right is important. Beyond latency and screensaver issues, what constraints do applications want to impose? How can we expose an interface to those constraints? This is the sort of thing we'll be looking at at the Linux Plumbers Conference, so if you have ideas about what they'd need to look like then sign up. Or, even better, submit a paper and be part of the process that gets Linux's power consumption as close to the theoretical minimum as possible.

[1] My Vista system gives me 25 options which can be set for each of AC and battery.

Romain Beauxis: ov51x-jpeg: a tale of hardware and kernel tricks..

The plot..
Some years ago, when I started using linux, I felt the need for video chat, and hence intended to buy a webcam..
Unfortunately, while most of usb hardware is standard, such as the usb mass storage class, this is not at all the case for video, although it is starting to get better with the usb video device class which is more and more used by modern webcams.
So, at this time, each webcam would have its own communication protocol, and each driver had to implement a different way (...)

Russell Coker: Solving Rubik s Cube and IO Bandwidth

Solving Rubiks Cube by treating disk as RAM: Gene Cooperman gave an interesting talk at Google about how he proved that Rubik’s Cube can be solved in 26 moves and how treating disk as RAM was essential for this. The Google talk is on Youtube [1]. I recommend that you read the ACM paper he wrote with Daniel Kunkle first before watching the talk. Incidentally due to the resolution of Youtube it would have been good if the notes had less than 10 lines per screen. Here is the main page for the Rubiks Cube project with source and math [2], note that I haven’t been interested enough to read the source but I’m including the link for reference. The main concept is that modern disks can deliver up to 100MB/s (I presume that’s from the outer tracks, I suspect that the inner tracks wouldn’t deliver that speed) for contiguous IO. Get 50 disks running at the same speed and you get 5GB/s for contiguous IO which is a typical speed for RAM. Of course that RAM speed is for a single system while getting 50 disks running at that speed will require either a well-tuned system from SGI (who apparently achieved such speeds on a single process on a single system many years ago - but I can’t find a reference) or 5+ machines from anyone else. The configuration that Gene describes apparently involves a network of machines with one disk each, he takes advantage of hardware purchased for other tasks (where the disks are mostly wasted). I believe that SGI sells Altix machines which can have enough RAM to store all that data. It is NUMA RAM, even the “slow” access to RAM on another NUMA node should be a lot faster in most cases for sequential access and when there are seeks the benefits of NUMA RAM over disk will be dramatic. Of course the cost of a large NUMA installation is also significant, while a set of 50 quad-core machines with 500G disks is affordable by some home users.

Share This

23 June 2008

Ross Burton: Erm...

case "$1" in
        *.sh)
                # Source shell script for speed.
                (
                        trap - INT QUIT TSTP
                        scriptname=$1
                        shift
                        . $scriptname
                )
                ;;
        *)
                "$@"
                ;;
  esac
OPTIMISATION FAIL. NP: Roseland NYC Live, Portishead

Colin Watson: Don't use sshkeygen.com to generate keys!

To my horror, I recently saw this online SSH key generator. I hope nobody reading this needs to be told why this is a bad idea. However, in case you do, here are a few reasons: I think this is probably being done in innocent seriousness (although I kind of hope it's a joke in poor taste), and have e-mailed the contact address offering to explain why it's a bad idea.

20 June 2008

Manoj Srivastava: Manoj: The Command Prompt

Or theming PS1 I am not fanatical about my command prompt. No sirree, not me. It is just that I spend half my life either staring at an Emacs window, or at an xterm command prompt; so even a marginal boost in productivity goes a long way. And I am often logged in over ssh to machines half a continent away, and am still comfortable enough on the Linux VT to spend time there, and I often do not have the GUI gew-gaws feeding me data. Hmm. Data. inpuuut. No. Must focus. With all these open xterms and Emacs terminal mode frames floating around, it is easy to lose track of where I am on each terminal, and what the working directory is. So I want my command prompt to help me keep track of where I am. If the terminal is an xterm, the title can be setup like 
 "user@host:../shotened/path/to/current/working/dir"
I want to know what machine, id (am I root?), and directory I am in. If I am deep down in the labyrinths of some work related directory tree, I want the path to be pruned, from the left, one component at a time. However, this does not help me on the console; so I also want the path to be in the command prompt; but it should not take up too much of the command line; and ideally, should just go away as I type a longish command. Gawd, I love zsh. I once did a analysis of the command history. The most often used command sequences were 
 cd some-place, ls
So. pwd and ls. I really really want to see the directory listing when I change directory to a new one. As one grows old, memorizing the directory contents for dozens of machines all the time taxes the gray cells a bit. So, I figure, why not let the command prompt handle all that? Having the current working dir always visible cuts down a heck of a lot on the pwd commands, and so all that s left is to insist that the command prompt thingy always run ls after a change directory. Simple enough. Saves on typing. And time. And this is not just some crazy talk. I want help with noticing whether the previous command exited with an error status (useful for commands that normally do not create an output). If I am logged in to a machine on battery power, I want to know that. I also like visual cues to the amount of power remaining (good for my laptop on the long flights). I don t want to have to know f the machine uses APM or ACPI, I just want my prompt color to change as the power fades. I want my command prompt to let me know if I am in a directory which is under version control, and if so, what branch I am on. (I occasionally have to come in contact with arch, bzr, git, subversion, svk, and mercurial). If I am in a version controlled project, where I am relative to the root of the checked out tree is often more important than the absolute path, so I want to see relative paths, not absolute paths. I want to know if there are uncommitted files in the working directory. Visually. I want to be reminded if I am in the middle of an ongoing 
 rebase -i .
This is not asking for too much, is it? Command Prompt So, here is a screen-shot of this in action: I start from my home directory, go to a directory not under version control, go to a project under git, then a different project with uncommitted files, and then finally to a subversion checkout. All with an angry fruit salad of colors warrantied to make Martin Krafft want to claw his eyes out biggrin.png . If you use zsh, then just grab hold of this, and then do: 
 autoload -U promptinit
 promptinit
 prompt manoj
This might be a bit of a hit on slow machines, but even my laptop is a core 2 duo, so I do not find it noticeable. Oh, and if you liked this article, you might also like Theming Emacs, and Theming XTerms.
Categorized under:

Edd Dumbill: Secure LDAP replication

Ever the sucker for punishment, I decided to pick three difficult things and stick them all together: LDAP, SSL and replication. Here's how to make it go on Debian and Ubuntu. The problem You want LDAP replication to happen over the internet, and you want it to happen securely. The caveat I'm not going to tell you how to set up your LDAP from scratch here: I'm assuming you've reached a solution you're happy with and want to replicate it. The solution We're going to set up a replicating slave LDAP server, which communicates with the master over the internet via an SSL-protected connection. Enabling replication First up, the master LDAP server needs to be configured to permit replication.  The key lines to add to your slapd.conf include: 
moduleload syncprov
index entryCSN,entryUUID eq
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 200
These load up the synchronization module, add indices which make sync go faster, and enable sync. For more detail see the OpenLDAP site. Next you need to add a replicator user to your LDAP database, give your replicator user access to passwords as well as general read access. To create the replicator user, I made this simple LDIF file and fed it to ldapadd. 
dn: cn=replicator,dc=mydomain,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: replicator
description: LDAP replicator
userPassword: TOPSEKRIT
Once this user is in your LDAP database, you should give it read access to passwords (I assume you've already given read access to authenticated users.) I have this in my slapd.conf: 
access to attrs=userPassword,sambaNTPassword,sambaLMPassword
...
   by dn="cn=replicator,dc=mydomain,dc=com" read
To check that this works, try using ldapsearch to check that the passwords are returned: 
ldapsearch -x -D cn=replicator,dc=mydomain,dc=com \
  -W   grep -i password
Enter the replicator password when prompted, and you should see the encrypted passwords from your LDAP database. Securing access Now you've got replication enabled on the master, you will want to ensure it is available on the internet only via TLS or SSL. Here's what I added to slapd.conf to enable this: 
TLSCertificateFile      /etc/ssl/certs/ldapserver_crt.pem
TLSCertificateKeyFile   /etc/ssl/private/ldapserver_key.pem
TLSCACertificateFile    /etc/ssl/certs/myCA.pem
TLSVerifyClient         demand
As you will guess from the configuration, the first two lines set the SSL key and certificate the master uses (see "A little twist" below for an important note on key permissions.) The third line tells slapd where to find my site-local certificate authority (CA), and the fourth line says slapd must require any connecting client to have a valid SSL certificate signed by the site-local CA. This is important, as it provides a second layer of access control: a replicating client must connect using a certificate you signed, plus the replicator password. Before this enables TLS access, we must tell slapd which network interfaces to listen on. To do this, edit the SLAPD_SERVICES variable in /etc/default/slapd. Here's my configuration: 
SLAPD_SERVICES="ldap://127.0.0.1/ ldap://192.168.0.1/ ldaps:///"
This enables regular LDAP on the loopback and intranet network interfaces, and LDAP/SSL on all interfaces, including the public internet. So, with slapd restarted we are at this situation: connections are now possible from the internet, as long as they are made over SSL with a certificate signed by our site-local CA. (In fact, you can make much finer-grained access restrictions in your configuration than I have done. Using LDAPS rather than TLS over regular LDAP is a rather broad precaution. As explained on the OpenLDAP site, the ssf= parameter can be used to require a certain level of secure connectivity on a per-user or client basis.) Setting up the replicating server
Your slave server should have the same configuration as the master, except you can leave out the bits enabling replication. Firstly, you'll need add to slapd.conf the replication configuration: 
syncrepl rid=123
        provider=ldaps://ldapmaster.mydomain.com/
        type=refreshAndPersist
        searchbase="dc=mydomain,dc=com"
        filter="(objectClass=*)"
        scope=sub
        attrs="*"
        schemachecking=off
        bindmethod=simple
        binddn="cn=replicator,dc=mydomain,dc=com"
        credentials=TOPSEKRIT
Most of this I took as boilerplate from the OpenLDAP documentation. Items to note include: And here's the /etc/default/slapd configuration: 
SLAPD_SERVICES="ldap://127.0.0.1/"
The slave slapd exists only in this case to serve the local machine. Finally, there's the tricky bit! You need to configure slapd to connect to the master server using a certificate. I'll assume you've created and signed a key and certificate pair for your slave server (see my post Low-tech SSL certificate maintenance for more on this.) Awkwardly, the TLS configuration in slapd.conf is for the server only. Replication works as a client, and thus needs separate configuration. Furthermore, you cannot configure this globally on your machine, as the SSL certificate is a per-user only parameter (see man ldap.conf for more information on this.) Instead, we must set it in slapd's environment. Add these two lines to the end of /etc/default/slapd: 
export LDAPTLS_CERT=/etc/ssl/certs/slapd.crt
export LDAPTLS_KEY=/etc/ssl/private/slapd.key
This file is sourced as a shell script by slapd's init script. Amend the path to your certificate and keys as required. Use /etc/init.d/slapd restart and you should be good to go. Finally, we want the slave server to be certain it's talking to the real master. So we also configure client connections to verify the SSL certificate of the peer, in ldap.conf again: 
TLS_CACERT      /etc/ssl/certs/myCA.crt
TLS_REQCERT     demand
A little twist One gotcha to notice with both client and server is that slapd runs as the openldap user by default on Debian. Also by default SSL keys are readable only by the ssl-cert group. You'll need add the openldap user to this group, otherwise it won't be able to access /etc/ssl/private. Related articles on this site: Join the conversation about this post

19 June 2008

Raphael Geissert: Re: Ubuntu divergence

Lucas Nussbaum recently posted some graphics showing the number of packages that are grabbed from Debian and kept untouched, modified, out of sync, etc, etc.

But, "statistics are tricky":

$ wget http://patches.ubuntu.com/p/php5/php5_5.2.6-1ubuntu3.patch
--2008-06-19 22:25:03-- http://patches.ubuntu.com/p/php5/php5_5.2.6-1ubuntu3.patch
Resolving patches.ubuntu.com... 91.189.90.149
Connecting to patches.ubuntu.com 91.189.90.149 :80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 441869 (432K) [text/plain]
Saving to: php5_5.2.6-1ubuntu3.patch'

100%[======================================================================>] 441,869 62.3K/s in 7.3s

2008-06-19 22:25:11 (59.4 KB/s) - php5_5.2.6-1ubuntu3.patch' saved [441869/441869]



$ lsdiff -i '*out' php5_5.2.6-1ubuntu3.patch wc -l
44


I believe people familiar with test suites know what that means...

Update: it means that the test suite files (outputs, expected results, and so on) are on the .diff.gz, thus contaminating it

Oh, and:


$ out=$(mktemp); filterdiff -i '*tests*' php5_5.2.6-1ubuntu3.patch > $out
$ du -h php5_5.2.6-1ubuntu3.patch $out
436K php5_5.2.6-1ubuntu3.patch
372K /tmp/tmp.eAxRv20298

...what a waste of space

Next.

Previous.