It finally happened. I installed Debian Etch on my last Woody box, a 400 MHz Pentium II with 576 MB RAM named gsa which is my home desktop since I bought it at LinuxTag 2003 in Karlsruhe. And no I didn’t do a dist-upgrade, neither direct no via Sarge. As already planned I removed some no more necessary operating systems from that box and installed Etch on the freed disk space. Woody is still installed on that box in parallel and was recognized perfectly by Etch’s installer. I took a few hours but also was big fun to go through Etch package list and to decide what to install. Overall the installation of 5 GB of software took about half a day. In general everything went fine, the only thing I’m yet missing is sound. Etch didn’t seem to recognize my soundcard at all although it’s a well-known brand and defacto standard for many other soundcards: a Creative Labs Soundblaster. Well, the 16-Bit ISA version, needing the full length of the slot. Worked fine under Woody. Well, I hope I’ll get it working again manually. What on the other hand is really nice with udev hell —eh— hal and all those new automatic bells and whistles: The desktop (well, at least GNOME Nautilus as well as XFCE, but probably also KDE) recognises when I insert a 3.5” floppy into the drive and shows me a nice floppy icon on the desktop. You think, that’s impossible? Floppy drives don’t inform the rest of the system when a floppy has been inserted without you polling the drive every few seconds? Well, USB floppy drives can. And they do. :-) I still need time to migrate all the old settings from Woody to Etch. I’ll probably stick with FVWM, but perhaps will use the GNOME enabled version. What’s already done is the migration from tcsh to zsh. On all new or dist-upgraded systems after Etch I’ve chosen zsh so with my last Woody installation retiring I’ve also fully migrated to zsh. So I’ve got now most of my active private boxes running Etch. Only the noone.org web and mail server “sym” (an amd64 box) as well as my 133 MHz ThinkPad “bijou” are still running Sarge, both with 2.6 kernels. So with switching to Etch on gsa, I also got no more Debian box running a 2.4 kernel. The only 2.4 kernel I run is on my FreeWRT WLAN router named pluriel, which runs 2.4.33.3. But I expect that 2.6.18 will be as stable and long lasting as the famous and rock-solid 2.4.18 from Woody. 18 seems to be Debian’s favourite kernel minor version recently. ;-)

Karl MacMillan writes an interesting review of a Sun article about SE Linux. Not only does he correct errors in the Sun article but he also summarises some of the features of SE Linux design and terminology that we use. If you are interested in computer security and want to learn some of the basic concepts then Karl's review is worth reading.

In about half an hour I'll leave for Chemnitz in order to attend the Chemnitzer Linux-Tage 2007. I am very much looking forward to going there. Ever since the LinuxTag left Karlsruhe, the CLT are my favourite Linux event within Germany. Because of this I registered even two talks this year, one in the beginners section and of course the inevitable social talk. ;-) They're both new, so this CLT will feature two premieres. Giving new talks basically means that anything is possible. Very high rock and roll factor! New talks always have the highest risc for "accidents" but also they're usually most fun, because there's still some room (or need) for improvisation left. This is probably also why I tend to lose interest in a talk once I've given it a few times. Though, the BOFH one is of course a golden oldie! PS: Tolimar is a copycat!

[UPDATE 2007-10-01 22:43: It appears that Erich wrote an expanded and better-translated post while I was at work]

Erich Schubert writes that

Nach aktuellen Pl nen der CSU w re der Vertrieb von Debian GNU/Linux illegal.

Auch zahlreiche andere Distributionen w hren wohl davon betroffen: Alle, die sogenannte "Killerspiele" vertreiben...

For non-German speakers, I provide the following approximate translation:

CSU wants to make Debian illegal

The current plans of the CSU [Christian Social Union] will make the distribution of Debian GNU/Linux illegal.

In addition, many other distributions will be affected: specifically, those that distribute so-called "killer games"...

For instance, Overkill (Debian also includes, e.g., Tremulous and OpenArena, which are based on the Quake3 engine and have 3d graphics...)

(hopefully I got the gist of Erich's post without mangling it too badly!)

What I don't know is how serious this is. The CDU (Christian Democratic Union) is IIRC the current ruling party in Germany; however, according to Wikipedia, the CSU is some sort of local affiliate in Bavaria. Does it have the clout to get this proposal made into law?

Nach aktuellen Plänen der CSU wäre der Vertrieb von Debian GNU/Linux illegal. Auch zahlreiche andere Distributionen währen wohl davon betroffen: Alle, die sogenannte "Killerspiele" vertreiben... z.B. Overkill (wobei Debian auch noch z.B. Tremulous und OpenArena enthält, die auf der Quake3 engine basieren und 3D Grafik haben...)

Ryzom is a Massive Multiplayer Online Role-Playing Game (MMORPG) developed by the French company Nevrax. It is based on the NeL game engine (also from Nevrax), which is GPL'd already. As "due to market conditions and other unforseen cirucumstances, a request to begin bankruptcy proceedings has been filed at the commerce tribunal", the Free Ryzom Campaign has formed with the aim to buy the source code and game data and release it under the GPL:

Help us make Ryzom a Free MMORPG! Donate now to help us purchase the source code, artwork and other game data associated with Ryzom, so we can breathe new life into it as an open, democratically run player project.

They've even set up a Social Contract (modeled after the Debian Social Contract) which states among other things that "Ryzom and all materials produced by the Free Ryzom Project will become and remain 100% Free Software". If you want to support the project, you can make a donation pledge (used to convince the official presiding over the liquidation process). No real donations are possible at the moment. More info/material on the game:

• A presentation, which explains the game, factions, items, ecosystem etc.
• The Ryzom Wikipedia article
• A whole bunch of Ryzom trailer videos at YouTube [1]
• The project FAQ
• Current plan and status
• A Digg article about Ryzom

I'm looking forward to the day where I can apt-get install ryzom and play a fully free MMORG... [1] I recommend using the Mozilla/Firefox/Iceweasel VideoDownloader extension to download the videos and watch them with mplayer. (via Karl-Tux-Stadt)

I was very happily surprised today. Some weeks ago, walking in downtown Mexico City, I found the Interactive Economy Museum (Museo Interactivo de Econom a - MIDE, for which I had seen some posters at my workplace (of course, as some of you know, I work at UNAM's Institute for Economics Research (Instituto de Investigaciones Econ micas)). MIDE is one Mexico's youngest museums (opened about two months ago), and it is... Frankly impressive and well done.
When I first heard about an interactive economy museum, I could only think about entering a room with buttons that would cause economic or politic crisis in different Asian or African countries, so we could watch the outcome. Of course, it was not so (or at least, I hope so - I pressed quite a number of buttons!) The museum is multimedia rich, and will attract children (I'd suggest going with 10 year old kids and older) and grown-ups. It is quite well balanced, having many things that are just fun to do (i.e. for the scarcity topic, recording a video saying what do you want but don't have so other people see you, and see other people's videos, or "designing" -of course, quite simplisticly, but still- your own banknote, with your own photo), that give you a better insight of the full economic process (how money changes hands: A story told by six different animations, each explaining a different part of the process, about the relations between a family, the bank, the factory owner and the supermarket; a stock exchange simulator; comparisons between different indicators on the living standards over the world).
But even more than the exhibit itself, just being at the Bethlehemit ex-convent and ex-hospital is very well worth a visit. Even if the XVIII-century building endured very rough times and got severely deteriorated, it has been completely rescued - and unlike most colonial palaces we have, it was rescued mixing modern elements with the old architecture with a very good balance and taste.
...Very well worth a visit. Really. If you happen to be in the Mexico City center, go to Tacuba street, just by Metro Allende, in front of Caf Tacuba. Oh, and don't go without having lunch first: We entered at 2PM, and had to fast-track over half of the museum because we were too hungry to pay attention. Of course, we plan to return with the family, so it's not lost. Besides, maybe next time I'll have time for a nice chat with Adam Smith and Karl Marx, who are seen walking around the museum. I talked a bit with one of the Bethlehemit monks.
Who runs the museum? It is never obvious, and I want to know. The building was, accodring to their web site, acquired in 1989 and remodeled since then by the Bank of Mexico, which would make perfect sense. Besides, it's quite clear that the Bank helped for some of the exhibits, such as the numismatics collection or the banknote printing technology room.

A few months ago I finished Play Money by Julian Dibbel and like his My Tiny Life before it, the writing style is simple yet sumptuous, or I guess just simply sumptuous. Like the travel writings that pre-figured anthropological writing, Dibbel takes us to a far-away exotic land (but only a click or two away) that are populated by a motley crew of wizard (or is lizard)? slayers, gold-diggers, money-makers, and virtual-world-builders. For many, these MMOGsare no strange-lands but are becoming weaved firmly and intimately into the fabric of everyday life, whether as entertainment, sociality, and or for a cadre of folks, as a source of income generation. I think the book has gotten enough coverage that I don’t need to rehearse its content in any detail but the basic story is that Julian embarks on a real world quest in the virtual land of quests to try to make enough money (to be specific make a little more than his monthly salary as a freelance writer) from trading and selling a slew of virtual objects and gold. In taking us along, he gives a compelling entry into the imaginative and morally complex world of these games. And better is that whether you know nothing about them or are a seasoned player, the book has much to offer. One of the reasons I respect Julian Dibbel is because he takes his sweeeet time to churn out a book-length manuscript. In a day and age when there is so much pressure to release quick and often, especially when writing about anything in the so-called virtual plane of existence, he waited nearly 8 years from the publication of his last book on gaming, My Tiny Life before publishing on a considerably higher-tech phenomenon. Following him on his most recent adventure, you learn that he threw himself into a variety of gaming environments persistently and consistently and did at least 3 years of research and writing (at one point in the book he confesses how excruciating writing for him, which is hard to believe as the words slip so nicely off the paper but whatever the extent of his writing angst is, he clearly spends a lot of care in crafting his sentences). And I am starting to think that if more people followed this ethic of long-term immersion, coupled with slow-brewed productive sparsity, we would get higher quality products (Yes, kinda like the Debian release cyclce). Like any good ethnographer, he gives an intimate portrait of life in these worlds of copious play where various types of real world economies have mushroomed apace with new technological developments. That is, he gives us a taste of what it is like, as he cleverly puts it to own unreality. Couched within tales of gaming gone real world economic, are hearty reflections on the place of play in social and economic life, the close resemblance and conceptual affinity between computers and games (and not just computer games, and here he does a fantastic job at explaining the Turing Test), self-doubts about writing in general and in particular about this topic, commodity fetishism, and the changing nature of capitalism in a world of ever-greater abstractions. All of this makes for an enjoyable read that if used in the classroom (which like A Tiny Life, I am sure will become standard for courses on Virtual Worlds) allows you to bring in some good supplemental material whether Edward Castranova’s Synthetic Worlds, Greg Lastowka and Dan Hunter’s The Laws of Virtual Worlds and or older heavy-hitters like Max Weber and Karl Marx. The only topic I think I would have liked to seen included is that of capitalist finance, because there are, I think, some real affinities, phenomenologically and conceptually, between finance capitalism and gaming the virtual game. Otherwise some of my favorite sections were on hackers and the object of the computer, but of course, I am biased that way. So here I leave you with a tasty morsel of something that was sumptuous to ingest: It is this endlessly repeatable collusion of freedom and determinism-the warp and woof of fixed rules and free play, of running code and variable input that sets both games and computers apart, together from the larger universe of information technologies they inhabit…. But only games share the universal machine’s game’s thoroughgoing commitment to the principle of recursion: the chained repetition of simple operations, each building on both the input of the moment and the outcomes of preceding steps. And only games, therefore, come close to capturing that precise mi of unpredictability and inevitability that makes the computer such a powerful simulator of our lived experience of the world. p. 104

I m running a computer club at the school in Ghana where am volunteering as a Free Software advocate at the moment (as you probably know already). At first I tried to spread a little bit of general hacker attitude by introducing an internal wiki and blog, and by explaining what Free Software is. Then some students indicated interest in a programming course, so I held python lessons in the club (Sessions 3, 4, 5, 6, 7, 8, 9 and 10). Unfortunately, interest was declining over time, and while the first lessons had over ten participants (not to speak of the 20 at the very first one), it soon fell to around four. There was also some fluctuation, students leaving, others joining (and then of course lacking the lessions from the earlier sessions).So today, with four students who only recently joined, I started something new: I introduced the game infon, by fellow entropianian Florian 'dividuum' Wesch. It is a networked battle area where bugs compete over food and fight each other. Suitable for the computer club makes it the fact that the bugs are not directly controlled, but the players write their intelligence (using the simple language lua) and only upload code to the server. They can even do this while the game is running and it was a very fun game to play at GPN5 in Karlsruhe. You can read my infon-tutorial, and it s mostly non-SOSHGIC specific.I got them far enough to type the code that I presented as an example, to get it running, and to extend it slightly. I am only hoping that they will dig in a little bit deeper until next week. I think that you can only be successful in learning programing or similar things if you spend some time doing it besides the classes, and I did not see that happening when I was doing python. Maybe I was going too fast or the text-only way of doing it was discouraging, but I did expect them to starting having their own ideas at least after we were programming a simple text-based maze in the club.

The BarCamp Zurich 2006 is over. On the way there I thought about what I would do during time slots with no interesting talks. But when I tried to make up my personal schedule, I noticed that I rather would have the opposite problem: Too many interesting talks at the same time… Well, to many interesting talks at all, although I only went to tech talks and left out the biz talks. I first went to the Podcasting & Co. talk by Timo Hetzel, since I never heard or made a podcast, but was curious about podcasts in general. Besides statistics and rankings he spoke about where people listen to podcast (most listeners seem to do that during commuting), what people like in podcasts, why companies podcast, etc. And that a very big share of all podcast listeners use iTunes as podcast client and except juice (never heard of it before) all other podcast clients seem to be irrelevant. My conclusion: I haven’t missed anything not having listened to or made podcasts neither do I need to listen or make podcasts in the future. They’re irrelevant. To me. :-) Then I had to choose between the talks AJAX@localhost (PDF) by Harry Fuecks and Realtime Collaborative Text Editing and SubEthaEdit by the Coding Monkeys. I heard about realtime collaborative editing once know that it’s a challenging task for the developer. I also know what AJAX is (and that I would only use or recommend it for bells and whistles, but not for content in general), but “AJAX@localhost” sounded like writing normal applications using AJAX. It sounded interesting and evil at the same time. I had to go there! ;-) Others had similar expectations after reading the talk’s title, so I was quite surprised that it was about something completely different, namely about debugging AJAX on the localhost but under conditions usually only appearing if you’re running AJAX application not from localhost but from somewhere on the net: You may have different lags with every request, so some requests may reach the server before others, which may screw up the whole AJAX application, if the developers didn’t think about it and only tested it on localhost. (Hence the talk’s title…) My conlusion: I will use and recommend AJAX even more seldom, since there seem to be even more design misconceptions than I thought before. But I’ll once have a look at the Webtuesday meeting, he mentioned. For the third time-slot, I didn’t need long to decide where to go: I already knew a little bit about Microformats and I wanted to know more. Tag Trade also sounded interesting, but the second part of the talk’s title, Paid Learning sounded like business and so I had no scruples to cold-shoulder that talk. I probably didn’t learn anything really new in the microformats talk, but my knowledge about microformats is now more concrete, and after talking with Cédric Hüsler later during a break, I would even trust myself to start and define a new microformat. Then I went to the HG Caféteria together with Gürkan and two German guys. While waiting in the queue, we were talking about our jobs and our favourite Linux distributions. I got some rhubarb pie and a rum truffles, assuming that the Caféteria uses no alcohol in their products like all other SV restaurant I know. But this one seemed to have quite a lot of alcohol, since it felt like my breath was burning… Well, this resulted in my second SV feedback form submission… Next I went to Alex Schröder’s talk about multilingual websites, Oddmuse and the Emacs Wiki, although also the talk A-Life about simulating evolution sounded promising. Alex asked the listeners about their experiences with multilingual websites and showed what Oddmuse offers as partial solution to the general multilingualism problems. But regarding the comments from the auditorium, there probably won’t be a perfect solution until computers can translate perfectly… The next talk I visited was Gabor’s talk about his master thesis Organizing E-Mail which resulted in a soon to be released Mozilla Thunderbird extension called BuzzTrack. From the other concepts he showed, I found Microsoft’s SNARF (Social Network and Relationship Finder) and IBM’s Thread Arcs most interesting as well as the fact that there is no e-mail client seems to have a majority at all. Directly after Gabor I had my own talk about Understanding Shell Quoting, so I also couldn’t go to Adrian Heydecker’s talk about Learning with Hypertext and Search Engines. I had only about three and a half listeners of whom several to my surprise where here because they didn’t know what “shell quoting” is. I really didn’t expect that. But that seems to be one of the differences between a BarCamp and a Linux Conferences: People come here to see something new, something they haven’t heard about before. On Linux events most people come, because they already heard about some special topic and want to know more or learn something about it. On Linux event my shell talks usually were attracting many visitors while at a BarCamp, talks presenting an idea, a concept or a tool seem to much more interesting for the attendees. So for the next BarCamp I perhaps exhume my Website Meta Language talk which never seemed to hit the nerve of Linux event attendees, since it tried to “sell” a different concept of generating website than most were used to. At least one listener excepted the talk to be named “shell escaping”, but IMHO escaping is only one quoting technic and it’s not only used for quoting. But perhaps I should take the word “escaping” in the title though for the next time. Happily most of the listeners seem to have learned something new from the talk and Silvan Gebhardt was really happy about his new knowledge about ssh ~ escapes, although I mainly talked about how to quote them than how to use them. :-) During the last slot I visited the session about the upcoming BarCamp Alsace 2 and the yet to be planned BarCamp Rhine, a BarCamp to be held on a ship traveling from Basel in Switzerland down the Rhine, stopping in Strasbourg, Karlsruhe, Rhein-Main-Area and perhaps even Cologne and Amsterdam. Contrary to my initial thoughts, the day was over very fast and I had no single boring minute during the BarCamp. Wow! After we’ve been kicked out of the building by ETH janitors, we joined again at the Bar N-68. On the way there I met Urban M ller who attended BarCamp Zurich, too. We talked quite a lot and it was very interesting to see behind the scenes of e.g. map.search.ch. Later I joined the French speaking table, talking with Gregoire Japiot from WineCamp France and Alex Schröder. Around 9pm I left the N-68 as one of the last BarCampers, tired but with new knowledge, new ideas, new acquaintances and a new hobby: BarCamping. What a luck that BarCamps aren’t that often, otherwise I couldn’t afford this new hobby. ;-) As a relaxing end I met with Alex Schröder and Christophe Ducamp on Sunday morning for brunch in the restaurant Gloria in the Industriequartier. When we were leaving the Gloria I noticed their book board with a lots of BookCrossing books and I took “The Da Vinci Code” with me, since I saw the movie and people were telling me that the book is much better. I’ll see…

After two years of using lkwiki, an old kwiki version that was extended to support full LaTeX documents to be managed and to store it's information in subversion, it is time for a rewrite. This week, I built the basic working foundation, in time for the new term at my University in Karlsruhe, but hopefully also for other people to use. So hereby, I announce:Latexki consists of two parts: The latexki binary, written in Haskell, is called by subversion after a commit and generates the static wiki pages (both text and LaTeX-based). It only updates what's needed (since running latex is expensive), but tracks dependencies like \input in LaTeX. The other, actually optional, part is a CGI script written in python which provides simple write-access to the subversion repository and which should handle conflicts with the same grace as subversion itself.Some, especially the planet.debian.org readers, will now immediatelly say that this is the same idea as Joey's ikiwiki and that I should just have extended his software. Now, I had the idea independently (after all, lkwiki works like this for two years now), and while ikiwiki is more a general purpose wiki, I wanted to create a tool specifically tailored for the collaborative management of LaTeX documents, the text pages are just side-play. Also, I wanted to to my own thing to use the subversion bindings to access the repository directly, without the need of a working copy, for the edits. It turned out that with pysvn, this is not possible, but at least I don't have to call the svn binary and using temporary directories for the working directory should be a clean solution.While the code is basically working, it still needs some testing. I'm also very eager to hear comments about the code itself, especially from a security point of view, but also from a "how to this nicer in haskell" point of view. You can find the code on the wiki itself, as all non-wiki, non-latex files are just wrapped in <pre> and put on their own page. Also, the TODO list is long. Patches are welcome, and if you want to use the software yourself, I'll help with any deployment problems.To the lkwiki users: I plan to switch the lkwiki repository to latexki before the semester starts. Some files will have to be renamed, and some detail code to be written. Feel free to test the latexki code to make sure we don't have problems then.

IBM has a nice article called UNIX productivity tips. The article mentions this one-liner, which shows the shell commands you use most often:

$ history awk ' print $2 ' awk 'BEGIN  FS=" "   print $1 ' sort uniq -c sort -rn head -10
    471 sl
    222 cd
    217 csl
    155 vi
    140 ..
    112 ls
    106 cls
     70 rm
     64 mv
     58 xpdf

Gee, I didn't know I'm that boring... Note how I mistype "ls" way more often than I type it correctly. Luckily my .bashrc fixes this for me :) Update 2006-09-25: When I posted this, I didn't intend to start a meme, but it seems I did: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. (via Lifehacker)

Recently in my (physical) mailbox: SELinux by Example by Frank Mayer, Karl MacMillan, David Caplan. The most recent and up-to-date book about SELinux I know about, written by some of the most involved and knowledgeable people in the field. From what I've read until know it seems to be a really in-depth and easy to understand introduction, and what's more important, it covers the practical aspects of how you use, configure, and administer SELinux in real deployed systems. This should make an interesting read...

So after a week of post-graduation stress I am back at the computer working for Debian and for my Summer of Code participation. Two weeks ago I had to prepare myself for two oral examinations, which took place on Monday and Tuesday last week. On Tuesday I received my transcript, and all people celebrated this hilariously. The parties continued until Friday when we earned the final certificate. I completed my Abitur with a grade of 1.2 (with 1.0 being the best grade). I think that I am satisfied with this result. Next in line is the move to Karlsruhe to enroll for the CS department at the University of Karlsruhe.

Dear German part of the Debian Lazyweb, I want to study Computer Sciences beginning with the winter semester this year. But where should I do that? I live in Southern Germany, near Strasbourg. So my primary choice was Freiburg. I went there to check it out, but all they had to offer to interested pupils was a two hours lecture about programming sets in Java. Hey, every other computing faculty says that it's not that important to know specific programming languages. Additionally I would rather put an accent on functional programming languages than on traditional ones. So Freiburg is most likely not my choice. Another question which was rised when I was there was the comparision of Bachelor and Master to the old-school diploma. I guess on most universities WS 2006 is the last chance to enter this course. What's better and why? I guess that's highly subjective, but well, I guess those who currently study CS will most probably have an opinion about that. Karlsruhe still offers the diploma. Although commuting to Freiburg is even easier, it wouldn't be hard for Karlsruhe neither (at least for the first semester or so). I don't know if Strasbourg would be an option. I guess the lectures there are in French and although I knew a fair bit of it, most got lost in the last three years. So not a primary choice, neither. But why should I be restricted to the South in my choice. What about Aachen? Well, it would be hard to find a flat from here, but I wouldn't have a problem to go that far away from home. Any comments? (Of course you could reply in German.)

Karl Fogel's Producing open source software: how to run a successful free software project covers many of the important aspects of free software projects, and concentrates on the parts that are different from, say, traditional in-house development projects. The book covers technical aspects like mailing lists, bug trackers, version control systems, and other infrastructure necessary for a project to survive. It also covers more social aspects, such as how to deal with flames, forking, or how to employ developers for free software projects. The book is written well, and is a light, fairly quick read. Those of us who have participated in free software for a long time can find the book as a nice summary of things that have been learned over the years. Those newer to free software development may find many new things to learn. Most of us will find something to think about. Despite the level of detail Fogel gets into, the book obviously only scratches the surface. Free software development is such a vast new territory that it is not realistic for one book to cover all of it. For example, this book does not cover conferences and other face-to-face meetings, which are important for keeping the community of free software developers alive. With the caveat that it doesn't make further volumes on this topic unnecessary, Fogel's book really is worth the time it takes to read it. Recommended.

Warning: Very long post ahead. You have been warned! What? Tor is a Free Software project (revised BSD license), developed by Roger Dingledine and Nick Mathewson, which creates an infrastructure for anonymous TCP communication. From the project website:

Tor is a toolset for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, IRC, SSH, and other applications that use the TCP protocol. Tor also provides a platform on which software developers can build new applications with built-in anonymity, safety, and privacy features. Tor aims to defend against traffic analysis, a form of network surveillance that threatens personal anonymity and privacy, confidential business activities and relationships, and state security. Communications are bounced around a distributed network of servers called onion routers, protecting you from websites that build profiles of your interests, local eavesdroppers that read your data or learn what sites you visit, and even the onion routers themselves.

Tor also allows you to set up and/or use a so-called Tor hidden service, i.e., a server which offers some service (a website, ssh access, or similar) without revealing its IP to its users. Why? Why would you want to use Tor? Well, because you probably don't want anybody (neither state agencies, nor companies, nor "hackers", nor any other individuals or groups) to be able to record, analyze, and (ab)use information about your web browsing habits, or any other communication habits. For instance, you don't want Google to have a complete search-profile of you, which — even worse — might some day get in the hands of other parties. In the days of massive data retention you don't want all your electronic traces to be recorded, stored for ages, analyzed, and data-mined for dubious reasons and with even more dubious results and false conclusions drawn which might negatively affect you. If you're a human rights activist in China, you want anonymous communication. If you're a whistleblower, you want anonymous communication. The list is endless. For securing your communications, so that nobody is able to sniff your emails, your chat messages, your passwords, your private documents and conversations, you use encryption. For communicating anonymously you can use Tor. Combine both, and you have secure and anonymous communication. In case you're wondering whether criminals might abuse Tor, read the Tor Abuse FAQ. Short answer: yes, but if you're willing to break the law, you already have anonymity (open access points, stolen/prepaid mobile phones, etc.). You don't need Tor to do bad things if you're a criminal. If you're one of those horrible "oh, but I don't have anything to hide" guys, consider this: Say you have a drug/alcohol problem and want to visit an anti-drugs/anti-alcohol website or forum for help. Would you want the whole world, your neighbors, your co-workers, your boss, to know that, or would you rather want to keep that a secret? Say you have AIDS and want to get information on the web? Or, to make the example even more dramatic: Would you want some random guys to be able to watch you while you fuck your wife? No? So you have something to hide after all, right? My point is: Everyone has something to hide, even more, it is a basic human right to have the ability to hide something. It's called privacy. How? Tor implements a form of onion routing to, basically, push encrypted data through multiple Tor nodes (servers), before it reaches the final destination (e.g. a website). The result is that neither the website owner, nor a local eavesdropper, nor any single Tor server knows who requested that specific website, hence you are communicating anonymously. For more technical details, read the Tor overview and the Tor documentation pages. In order to use Tor, you have to install and run a local Tor client/daemon (this is not necessarily a Tor server!). On Debian, type apt-get install tor, on other systems you can get the respective binary packages or download the sources and compile Tor yourself. Usually Tor is used together with Privoxy, a configurable HTTP proxy which sanitizes your web-browsing experience by removing nasty banner ads, pop-ups, JavaScript, webbugs, cookies etc. etc. So: apt-get install privoxy. After installing and starting Tor and Privoxy, you can now configure your webbrowser to use Privoxy as an HTTP proxy (see below), and Privoxy will in turn use Tor to anonymize your communication if you add "forward-socks4a / localhost:9050 ." to your /etc/privoxy/config. Anonymizing various applications Most (but not all) of the following information is also covered in the very useful Torify HOWTO in the Tor wiki (I will add the missing information there, ASAP). As I'm pretty paranoid, I have checked every single of these configurations with Ethereal to ensure that the traffic is really anonymized. However, if you are paranoid, you shouldn't trust me, but rather test this stuff for yourself! Warning: DNS Leaks:
The biggest problem with many applications is that they leak DNS requests. That is, although they use Tor to anonymize the traffic, they first send a DNS request untorified in order to get the IP address of the target system. Then they communicate "anonymously" with that target. The problem: any eavesdropper with more than three brain cells can conclude what website you visited, if they see that you send a DNS request for rsf.org, followed by some "anonymous" Tor traffic. The solution: use Tor together with Privoxy, that prevents DNS leaks. Many non-HTTP-based applications are usually torified using a small tool called torify (e.g. by typing torify fetchmail), but often this approach has DNS leaking problems, see below.

• Webbrowser: Firefox, Mozilla, Galeon, Konqueror, ...:
  Most browsers can be torified by using Privoxy as an HTTP(S) proxy, i.e. using 127.0.0.1 as proxy host and 8118 as proxy port.
  For example, to torify Firefox go to Edit -> Preferences -> General -> Connection Settings -> Manual proxy configuration and configure:
  HTTP Proxy: 127.0.0.1 port 8118
SSL Proxy: 127.0.0.1 port 8118
FTP Proxy: 127.0.0.1 port 8118
SOCKS v5

  For Konqueror, go to Settings -> Configure Konqueror -> Proxy -> Manually Specify the proxy settings -> Setup and configure:
  HTTP Proxy: 127.0.0.1 port 8118
HTTPS Proxy: 127.0.0.1 port 8118
FTP Proxy: 127.0.0.1 port 8118

  Warning: Although Privoxy doesn't support FTP, you should configure the browser to use Tor + Privoxy for FTP. By doing that, you get an error message when you try to access ftp:// URLs, but at least you don't send untorified traffic without noticing.
  Warning: Firefox's "Live Bookmarks" (RSS feeds) are a problem if you switch from a torified to an untorified state sometimes (by switching or enabling/disabling the proxy). Firefox periodically requests all the feeds you're subscribed to. If you turn off Tor + Privoxy usage, they will be requested non-anonymously, and you won't even notice it! Solution: remove all "Live Bookmarks", or never switch to untorified browsing.
• HTTP-based tools: lynx, links, w3m, wget, curl, ...:
  Most other HTTP tools, such as wget, can be torified by setting the respective values for the http_proxy and HTTP_PROXY environment variables. Applications which don't honor http_proxy probably have a configuration option to set the HTTP proxy.
  Add this to your ~/.bashrc or similar config-file:
  http_proxy=http://127.0.0.1:8118/
HTTP_PROXY=$http_proxy
export http_proxy HTTP_PROXY

  Warning: links is a notable exception here. It does not honor the http_proxy environment variable! However, you can add http_proxy 127.0.0.1:8118 to your /etc/links.cfg and/or to your ~/.links/links.cfg. Or go to Setup -> Network Options and do the same there. Or use the -http-proxy 127.0.0.1:8118 command line option.
• Instant Messaging: Gaim:
  Go to Preferences -> Network -> Proxy and configure this:
  Proxy type: Socks 5
Host: 127.0.0.1
Port: 9050

  Gaim doesn't seem to leak DNS requests.
• Debian: Apt:
  Setting http_proxy is enough, as apt-get honors the http_proxy environment variable. But you can also add this line to your /etc/apt/apt-conf:
  Acquire::http::Proxy "http://127.0.0.1:8118/";

  apt-get doesn't seem to leak DNS requests.
  Warning: This will only work for deb/deb-src lines in /etc/apt/sources.list which use HTTP, because Privoxy does not support FTP.
• RSS-Reader: Akregator:
  Which RSS feeds you are reading tells quite a lot about you, and it's probably an information some people or organizations would be very interested in, I imagine. So anonymizing your feed-reader is quite important, IMHO. Akregator (a KDE RSS-reader application) uses Konqueror internally, so if you have set Konqueror to use Tor + Privoxy as HTTP-proxy, Akregator is safe, too.
  Akregator doesn't seem to leak DNS requests.
• Podcast Client: iPodder/Juice:
  Got to File -> Preferences -> Network settings and configure this:
  Use a proxy server: enable
Address: http://127.0.0.1
Port: 8118

  iPodder/Juice doesn't seem to leak DNS requests.
• Secure login: ssh:
  In order to torify all your ssh communications (ssh, slogin, sftp, etc.), edit your /etc/ssh/ssh_config and/or ~/.ssh/config and add:
  Host *
ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050

  This requires socat, so: apt-get install socat.
  ssh doesn't seem to leak DNS requests.
  Warning: Simply using torify ssh does not suffice, it leaks DNS requests!
• Email: fetchmail:
  Properly torifying fetchmail is pretty ugly. Basically, torify fetchmail should be enough (one would think), but that leaks DNS requests! All tips offered in the Torify HOWTO suffer from this problem. The ideal solution would be to use tor-resolve (a small utility which resolves DNS requests via the Tor network, and hence anonymously) before fetching the emails, but I haven't found a good and simple solution for that. What I do right now is to hardcode IP addresses in my ~/.fetchmailrc config-file and then use torify fetchmail, which doesn't leak DNS requests. However, it leads to some ugly "fetchmail: Server CommonName mismatch: foo.bar.com != xxx.xxx.xxx.xxx" warnings.
  I always start fetchmail manually, often by clicking an icon in my IceWM toolbar. So I use the following line in my ~/.icewm/toolbar config-file:
  prog Fetchmail fetchmail xterm -e torify fetchmail

  Sometimes I invoke fetchmail from the command-line, too, so I have this alias in my ~/.bashrc:
  alias fetchmail='torify fetchmail'
Warning: Just for the record: torify fetchmail alone (i.e. used with hostnames in ~/.fetchmailrc) does not suffice, it leaks DNS requests!
• IRC: XChat:
  Go to Settings-> Preferences -> Network -> Network setup -> Proxy server and configure:
  Hostname: 127.0.0.1
Port: 9050
Type: Socks5

  Then make sure you check the "Use a proxy server" checkbox in the preferences dialog of the IRC server you want to use.
  XChat doesn't leak DNS requests.

You might also want to check out toraliases, a small shell script you can source from your ~/.bashrc file. It defines some functions and aliases which transparently direct the traffic of some (but not all!) programs through Tor. Applications which cannot easily be torified Anything not using TCP usually cannot be torified, as Tor only works for TCP.

• Non-TCP traffic from tools like ping, host, dig, nslookup, nmap, traceroute and lots more: as Tor only supports TCP, you're out of luck. However, you can safely use web-frontends such as dnsstuff.com over Tor + Privoxy (if they don't block Tor users, that is).
• whois: Although torify whois google.com leaks the DNS request for the whois-server (in this case whois.crsnic.net), it doesn't seem to leak the host you wanted to lookup. Can somebody confirm this? The safer method is to use a web-frontend, though.
• FTP: Although torify ncftp works, it leaks DNS requests! I haven't yet found a way to fix this (help is appreciated!). I also tried a few other FTP clients, without luck.
• GnuPG: Using gpg anonymously should work by using a proper http_proxy environment variable and by using a hidden Tor server as keyserver.
  Add this to your ~/.gnupg/gpg.conf:
  keyserver x-hkp://yod73zr3y6wnm2sw.onion
keyserver-options honor-http-proxy broken-http-proxy

  This works in theory. However, I noticed a problem: while gpg --recv-keys seems to work fine, gpg --refresh-keys leaks DNS requests! It seems GnuPG hard-codes the keyserver to keyserver.pgp.com in that case and leaks the DNS request for this domain name.
• Sending email (SMTP): Not sure how to do this with Tor. Many Tor nodes block SMTP per default. A better solution is probably Mixmaster/Mixminion.
• CVS, svn, Bittorrent/Azureus (untested HOWTO), usenet clients (pan, slrn), xmms: TODO. Haven't checked, yet.

Pitfalls to be aware of

• Rule #1: Don't spoil your anonymity by being stupid!
• IRC: Don't use nicks which hint at you, such as your real name, real-life nickname, acronyms which are known to "belong" to you or identify you. Don't use things like DCC which might reveal your real IP or real information about you. Disable all possibly "leaky" features/commands such as CTCP, VERSION requests, automatically accepting files from other IRC users, etc. etc.
• Don't accidentally access Tor hidden server URLs in an untorified browser. For example, if you would try to access the fictitious hidden server abc1234.onion, this request would travel over the net unencrypted and untorified. An eavesdropper could sniff that, enable Tor on his computer, go to abc1234.onion, and would know what you wanted to look at.
• Double-check that all applications you use don't leak DNS requests.
• Do not only configure your ~/.foobarrc config-files but also the config-files in /etc. Otherwise you might eventually use wget, ssh, lynx or other tools as root (instead of your normal, non-privileged user account) resulting in untorified traffic!
• Disable all "check for updates automatically", "notify upon new release" and similar "phoning home" features in all your applications. Most such features are probably not Tor-safe, i.e. will send/receive untorified traffic. Some candidates are Firefox, Adobe Acrobat reader, Gaim, and others.
• Never, never, think that Tor encrypts your traffic! It does not! The person who runs a Tor exit node can easily sniff all plain-text traffic! Tor only anonymizes your traffic, but it can still be sniffed plain-text at the beginning and at the end of the onion route! So don't do any HTTP-auth, or plain-text password sending for e.g. POP3, telnet, and so on. Always use encryption in addition to Tor!
• In general, spread only a minimum of information. Disable referrer sending (e.g. using Privoxy), disable cookies, kill webbugs (Privoxy), and so on.
• Watch your language, especially in public forums or IRC. A linguist can probably easily figure out which country/region you're from if you speak/write broken English or use certain idioms or false friends. This might or might not be a problem for you, but it's something you should bear in mind.
• If you're extra paranoid, you could set up your firewall to block all outgoing DNS traffic and force all applications to use Tor to resolve names. You could probably also block all outgoing non-Tor traffic...
• Another good idea is probably carrying an Anonym.OS LiveCD with you, so you can have a (more) anonymous communication wherever you go.

More information More information is available in the Tor documentation, the Tor wiki, and especially in the Tor FAQ. In addition, there's an IRC channel on Freenode (#tor), some slides and a video (torrent) about Tor you might find interesting. If you would like to help, you can run a Tor server, donate some money, or volunteer to do other things (code, debug, document, translate, and more). That's it for now. I'm very grateful for comments and suggestions, especially for hints on how to anonymize more applications. Also, if you notice any dumb mistakes I made, please leave a comment. Update 2006-03-07: Fixed typos, added link to the toraliases project (thanks Benjamin Schieder).

Finally, all the [1 mpeg2 videos from Erkelenz] fit on a single single-sided dvd! Once the DVD is actually done, I'll inform you here (and on the debian-edu mailninglist).

No news on the fosdem videos yet. Currently I'm looking for a DV cam to borrow, so I can copy the tapes to hard drive... nonetheless I expect the encoded videos to be online before the DPL voting period starts...

Oh, FOSDEM was a lot of fun, many thanks to everybody who contributed to it :-) My own report is somewhat pending - damn work and additionally I catched a little cold also.

Joey Schulze informed me today about an english version of his [2 debian security paper] from [3 Linuxtag 2005].

The RFC in my blog for a better licence for video works was answered with two suggestions: MJ Ray suggested a specially reworded [4 Creative Commons licence], while some folks from the #debian.de channels were in favor of the [5 artistic licence]. I'm somewhat in favor of the artistic licence, too, as I think it's easier to understand than a special edition of a CC licence.

Another suggestion was not to embed the name of the licence in the video files, but the URL for the licence choosen. Beginning with the FOSDEM videos I'll do that.

[1 http://meetings-archive.debian.net/pub/debian-meetings/2006/debian-edu-erkelenz/mpeg/] [2 http://www.infodrom.org/~joey/Vortraege/2005-06-23/] [3 http://meetings-archive.debian.net/pub/debian-meetings/2005/linuxtag-karlsruhe/debianday/] [4 http://creativecommons.org/licenses/by/2.5/scotland/]

Philipp, Joeys "slides" are published on meetings-archive.debian.net and I now have informed Wolfgang that he can update his page. Unfortunatly Joey's paper is written in german...

Also the round of introductions from the QA meeting in Darmstadt is now online (because of rsync-times you'll only be able to see it in three hours). I did not publish it earlier, because someone said something which should remain private. Instead of saying this in advance, so that the recording could have been stopped, this remark was made after saying these things, and therefore required post-processing.

Then it took me three months until I finally looked at that video to edit it. What I saw made me speechless (and smile), the video was already edited! But as nobody told me that, I didn't know :-) Or maybe I was told this when leaving Darmstadt, but it didn't reach my memory...

Now, about four weeks later, I got over my embarrassment not looking at it earlier...

Martin, I recall that Joey already did a diagram for the stable security updates, shown at LinuxTag 2005 in Karlsruhe. Funnily enough, Joey did not publish his slides. (He is almost the only one who didn’t, looking at the list of speakers of the two Debian Days.) Oh well... And guess what his own publication on his site lacks... The “Security Processing” part is just empty. Disclaimer: This is not intended to offend Joey in any way.