Emotional support of others can take the form of surface-level consolation. But compassion means being willing to listen and feel, even when it's uncomfortable.
Ultimately, the driving force behind the power of positive thinking meme is the word power. But what about those whose bodies are not powerful? What about those who are vulnerable? What about those who are tired, isolated, and struggling? What about those who are ill? What about those who lack
I have often been dismissive or unhelpful when someone close to me was dealing with painful circumstances, having learned to accentuate the positive. In the more recent past, I have recognized these behavioral patterns as part of what some mental health professionals term, toxic positivity.
Toxic positivity is the overgeneralization of a happy, optimistic state resulting in the denial & invalidation of the authentic human emotional experience.
Last few debian-live images being tested for amd64. We have found a bug with the debian-live Gnome flavour. This specifically affects installs after booting from the live media and then installing to the machine using the Calamares installer found on the desktop. The bug was introduced as a fix for one issue that has produced further buggy behaviour as a result.
Fixes are known - we've had highvoltage come and debug them with us - but will not be put out with this release but will wait for the 10.6 release which will allow for a longer time for debugging overall.
You can still run from the live-media, you can still install with the standard Debian installers found in the menu of the live-media disk - this is _only_ a limited time issue with the Calamares installer. At this point in the release cycle, it's been judged better to release the images as they are - with known and documented issues - than to try and debug them in a hurry and risk damaging or delaying a stable point release.
The point release is happening today for Debian Buster 10.5. This is an important release because it incorporates all the recent security fixes from the latest GRUB / Secure Boot "Boothole" security problems.
Behind the scenes, there has been a lot of work to get this right: a release subject to an embargo to allow all the Linux releases to co-ordinate this as far as possible, lots of consistent effort, lots of cooperation - the very best of Free/Libre/Open Source working together.
Secure Boot shims are signed with a different key to go to upstream this time around: in due course, when revocation of old, insecure code happens to plug the security hole, older media may be deny-listed. All the updates for all the affected packages (listed in https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/ ) are included in this release.
This has been a major wake-up call: the work behind the scenes has meant that each affected Linux distribution will be in a much better position going forward and working together is always good.
Here s my (tenth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This was my 17th month of contributing to Debian.
I became a DM in late March last year and a DD last Christmas! \o/
Well, this month I didn t do a lot of Debian stuff, like I usually do, however, I did a lot of things related to Debian (indirectly via GSoC)!
Anyway, here are the following things I did this month:
Also, I log daily updates at gsocwithutkarsh2102.tk.
Whilst the daily updates are available at the above site^, I ll breakdown the important parts of the later half of the second month here:
Marc Andre, very kindly, helped in fixing the specs that were failing earlier this month. Well, the problem was with the specs, but I am still confused how so. Anyway..
Finished documentation of the second cop and marked the PR as ready to be reviewed.
David reviewed and suggested some really good changes and I fixed/tweaked that PR as per his suggestion to finally finish the last bits of the second cop, RelativeRequireToLib.
Merged the PR upon two approvals and released it as v0.2.0!
We had our next weekly meeting where we discussed the next steps and the things that are supposed to be done for the next set of cops.
Introduced rubocop-packaging to the outer world and requested other upstream projects to use it! It is being used by 13 other projects already!
Started to work on packaging-style-guide but I didn t push anything to the public repository yet.
Worked on refactoring the cops_documentation Rake task which was broken by the new auto-corrector API. Opened PR #7 for it. It ll be merged after the next RuboCop release as it uses CopsDocumentationGenerator class from the master branch.
Whilst working on autoprefixer-rails, I found something unusual. The second cop shouldn t really report offenses if the require_relative calls are from lib to lib itself. This is a false-positive. Opened issue #8 for the same.
Continuation of GSoC for other Ruby related stuff!
Whilst working on rubocop-packaging, I contributed to more Ruby projects, refactoring their library a little bit and mostly fixing RuboCop issues and fixing issues that the Packaging extension reports as offensive .
Following are the PRs that I raised:
Debian (E)LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group of volunteers and companies interested in making it a success.
And Debian Extended LTS (ELTS) is its sister project, extending support to the Jessie release (+2 years after LTS support).
This was my tenth month as a Debian LTS and my first as a Debian ELTS paid contributor.
I was assigned 25.25 hours for LTS and 13.25 hours for ELTS and worked on
the following things:
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I did the following things:
Released v0.2.0 of rubocop-packaging on RubyGems!
It s open-sourced and the repository is here.
Bug reports and pull requests are welcomed!
Released v0.1.0 of get_root on RubyGems!
It s open-sourced and the repository is here.
Wrote max-word-frequency, my Rails C1M2 programming assignment.
And made it pretty neater & cleaner!
Refactored my lts-dla and elts-ela scripts entirely and wrote them in Ruby so that there are no issues and no false-positives!
Check lts-dla here and elts-ela here.
And finally, built my first Rails (mini) web-application!
The repository is here. This was also a programming assignment (C1M3).
And furthermore, hosted it at Heroku.
Open Source:
Again, this contains all the things that I couldn t categorize earlier.
Opened several issues and PRs:
Issue #8273 against rubocop, reporting a false-positive auto-correct for Style/WhileUntilModifier.
Issue #615 against http reporting a weird behavior of a flaky test.
PR #3791 for rubygems/bundler to remove redundant bundler/setup require call from spec_helper generated by bundle gem.
Issue #3831 against rubygems, reporting a traceback of undefined method, rubyforge_project=.
Issue #238 against nheko asking for enhancement in showing the font name in the very font itself.
PR #2307 for puma to constrain rake-compiler to v0.9.4.
And finally, I joined the Cucumber organization! \o/
Thank you for sticking along for so long :)
Until next time. :wq for today.
Here is my monthly update covering what I have been doing in the free and open source software world during July 2020 (previous month):
Opened a pull request to make the build reproducible in PyERFA, a set of Python bindings for various astronomy-related utilities (#45), as well as one for PeachPy assembler to make the output of codecode/x86_64.py reproducible (#108).
As part of being on the board of directors of the Open Source Initiative and Software in the Public Interest I attended their respective monthly meetings and participated in various licensing and other discussions occurring on the internet, as well as the usual internal discussions regarding logistics and policy etc. This month, it was SPI's Annual General Meeting and the OSI has been running a number of remote strategy sessions for the board.
Updated travis.debian.net, my hosted service for projects that host their Debian packaging on GitHub, to use the Travis CI continuous integration platform) to fix a compatibility issue with the latest version of mk-build-deps. [...][...]
For Lintian, the static analysis tool for Debian packages:
Update the regular expression to search for all the released versions in a .changes file. [...]
Avoid false-positives when matching sensible-utils utilities such as i3-sensible-pager. (#966022)
Rename the send-patch tag to patch-not-forwarded-upstream. [...]
Drop reminders from 26 tags that false-positives should be reported to Lintian as this is implicit in all our tags. [...]
Reproducible Builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The project is proud to be a member project of the Software Freedom Conservancy. Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
This month, I:
Opened pull requests to make the build reproducible in pyerfa (#45) as well as one for PeachPy to make the output of codecode/x86_64.py reproducible (#108).
In Debian:
Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
dh-fortran-mod: Please make the output reproducible. (#965255)
gem2deb: should not install mkmf.log files. (#964772)
nmap: Please make the obfuscated nmap_service.exe file reproducible. (#964369)
strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build. This month, I made sure that we did not install the internal handler documentation generated from Perl POD documents [...] and fixed a trivial typo [...].
diffoscope
Elsewhere in our tooling, I made the following changes to diffoscope, including preparing and uploading versions 150, 151, 152, 153 & 154 to Debian:
New features:
Add support for flash-optimised F2FS filesystems. (#207)
Don't require zipnote(1) to determine differences in a .zip file as we can use libarchive. [...]
Allow --profile as a synonym for --profile=-, ie. write profiling data to standard output. [...]
Increase the minimum length of the output of strings(1) to eight characters to avoid unnecessary diff noise. [...]
Drop some legacy argument styles: --exclude-directory-metadata and --no-exclude-directory-metadata have been replaced with --exclude-directory-metadata= yes,no . [...]
Bug fixes:
Pass the absolute path when extracting members from SquashFS images as we run the command with working directory in a temporary directory. (#189)
Correct adding a comment when we cannot extract a filesystem due to missing libguestfs module. [...]
Don't crash when listing entries in archives if they don't have a listed size such as hardlinks in ISO images. (#188)
Output improvements:
Strip off the file offset prefix from xxd(1) and show bytes in groups of 4. [...]
Don't emit javap not found in path if it is available in the path but it did not result in an actual difference. [...]
Fix ... not available in path messages when looking for Java decompilers that used the Python class name instead of the command. [...]
Logging improvements:
Add a bit more debugging info when launching libguestfs. [...]
Reduce the --debug log noise by truncating the has_some_content messages. [...]
Fix the compare_files log message when the file does not have a literal name. [...]
Codebase improvements:
Rewrite and rename exit_if_paths_do_not_exist to not check files multiple times. [...][...]
Add an add_comment helper method; don't mess with our internal list directly. [...]
Replace some simple usages of str.format with Python 'f-strings' [...] and make it easier to navigate to the main.py entry point [...].
In the RData comparator, always explicitly return None in the failure case as we return a non-None value in the success one. [...]
Tidy some imports [...][...][...] and don't alias a variable when we don't end up using. [...]
Clarify the use of a separate NullChanges quasi-file to represent missing data in the Debian package comparator [...] and clarify use of a 'null' diff in order to remember an exit code. [...]
Frontdesk duties, including responding to user/developer questions, reviewing packages, participating in mailing list discussions, offering comments on our survey and attended our IRC contributor meeting. I also made some changes to tools after the move from the Debian version supported [...].
Issued DLA 2273-1 for shiro, first to fix a path-traversal issue where a specially-crafted request could cause an authentication bypass (CVE-2020-1957) and then to fix an encoding issue introduced in the handling of the previous CVE-2020-1957 path-traversal issue which itself could have also caused an authentication bypass (CVE-2020-11989).
Issued DLA 2274-1 to fix a possible signature verification issue in the fwupd firmware update tool as the return value of gpgme_op_verify_result was not being checked.
Issued DLA 2299-1 and ELA 252-1 in order to prevent a privilege escalation vulnerability discovered in Net-SNMP, a set of tools for collecting and organising information about devices on computer networks.
Issued DLA 2300-1 as it was discovered that there was an issue where kdepim-runtime would default to using unencrypted POP3 communication despite the user interface indicating that encryption was in use.
You can find out more about the project via the following video:
So even after years and years of experience, core tools still find ways to
surprise me. Today I tried to do some timestamp comparisons with mawk
(vnl-filter, to be more precise), and ran into a detail of the language that
made it not work. Not a bug, I guess, since both mawk and gawk are affected.
I'll claim "language design flaw", however.
Let's say I'm processing data with unix timestamps in it (seconds since the
epoch). gawk and recent versions of mawk have strftime() for that:
$ date
Wed Jul 29 15:31:13 PDT 2020
$ date +"%s"
1596061880
$ date +"%s" mawk ' print strftime("%H",$1) '
15
And let's say I want to do something conditional on them. I want only data after
9:00 each day:
$ date +"%s" mawk 'strftime("%H",$1) >= 9 print "Yep. After 9:00" '
That's right. No output. But it is 15:31 now, and I confirmed above that
strftime() reports the right time, so it should know that it's after 9:00, but
it doesn't. What gives?
As we know, awk (and perl after it) treat numbers and strings containing numbers
similarly: 5+5 and ="5"+5= both work the same, which is really convenient.
This can only work if it can be inferred from context whether we want a number
or a string; it knows that addition takes two numbers, so it knows to convert
="5"= into a number in the example above.
But what if an operator is ambiguous? Then it picks a meaning based on some
internal logic that I don't want to be familiar with. And apparently awk
implements string comparisons with the same < and > operators, as numerical
comparisons, creating the ambiguity I hit today. strftime returns strings, and
you get silent, incorrect behavior that then demands debugging. How to fix? By
telling awk to treat the output of strftime() as a number:
$ date +"%s" mawk '0+strftime("%H",$1) >= 9 print "Yep. After 9:00" '
Yep. After 9:00
With the benefit of hindsight, they really should not have reused any operators
for both number and string operations. Then these ambiguities wouldn't occur,
and people wouldn't be grumbling into their blogs decades after these decisions
were made.
Review: The City in the Middle of the Night, by Charlie Jane Anders
Publisher:
Tor
Copyright:
February 2019
Printing:
February 2020
ISBN:
1-4668-7113-X
Format:
Kindle
Pages:
366
January is a tidally-locked planet divided between permanent night and
permanent day, an unfortunate destination for a colony starship. Now,
humans cling to a precarious existence along the terminator, huddling in
two wildly different cities and a handful of smaller settlements,
connected by a road through the treacherous cold.
The novel opens with Sophie, a shy university student from the dark side
of the city of Xiosphant. She has an overwhelming crush on Bianca, her
high-class, self-confident roommate and one of the few people in her life
to have ever treated her with compassion and attention. That crush, and
her almost non-existent self-esteem, lead her to take the blame for
Bianca's petty theft, resulting in what should have been a death sentence.
Sophie survives only because she makes first contact with a native
intelligent species of January, one that the humans have been hunting for
food and sport.
Sadly, I think this is enough Anders for me. I've now bounced off two of
her novels, both for structural reasons that I think go deeper than
execution and indicate a fundamental mismatch between what Anders wants to
do as an author and what I'm looking for as a reader.
I'll talk more about what this book is doing in a moment, but I have to
start with Bianca and Sophie. It's difficult for me to express how much I
loathed this relationship and how little I wanted to read about it. It
took me about five pages to peg Bianca as a malignant narcissist and
Sophie's all-consuming crush as dangerous codependency. It took the
entire book for Sophie to figure out how awful Bianca is to her, during
which Bianca goes through the entire abusive partner playbook of
gaslighting, trivializing, contingent affection, jealous rage, and
controlling behavior. And meanwhile Sophie goes back to her again, and
again, and again, and again. If I hadn't been reading this book on a
Kindle, I think it would have physically hit a wall after their
conversation in the junkyard.
This is truly a matter of personal taste and preference. This is not an
unrealistic relationship; this dynamic happens in life all too often. I'm
sure there is someone for whom reading about Sophie's spectacularly poor
choices is affirming or cathartic. I've not personally experienced this
sort of relationship, which doubtless matters.
But having empathy for someone who is making awful and self-destructive
life decisions and trusting someone they should not be trusting and who is
awful to them in every way is difficult work. Sophie is the victim of
Bianca's abuse, but she does so many stupid and ill-conceived things in
support of this twisted relationship that I found it very difficult to not
get angry at her. Meanwhile, Anders writes Sophie as so clearly fragile
and uncertain and devoid of a support network that getting angry at her is
like kicking a puppy. The result for me was spending nearly an entire
book in a deeply unpleasant state of emotional dissonance. I may be
willing to go through that for a close friend, but in a work of fiction
it's draining and awful and entirely not fun.
The other viewpoint character had the opposite problem for me. Mouth
starts the book as a traveling smuggler, the sole survivor of a group of
religious travelers called the Citizens. She's practical, tough, and
guarded. Beneath that, I think the intent was to show her as struggling
to come to terms with the loss of her family and faith community. Her
first goal in the book is to recover a recording of Citizen sacred
scripture to preserve it and to reconnect with her past.
This sounds interesting on the surface, but none of it gelled. Mouth
never felt to me like someone from a faith community. She doesn't act on
Citizen beliefs to any meaningful extent, she rarely talks about them, and
when she does, her attitude is nostalgia without spirituality. When Mouth
isn't pursuing goals that turn out to be meaningless, she aimlessly
meanders through the story. Sophie at least has agency and makes some
important and meaningful decisions. Mouth is just there, even when Anders
does shattering things to her understanding of her past.
Between Sophie and Bianca putting my shoulders up around my ears within
the first few pages of the first chapter and failing to muster any
enthusiasm for Mouth, I said the eight deadly words ("I don't care what
happens to these people") about a hundred pages in and the book never
recovered.
There are parts of the world-building I did enjoy. The alien species that
Sophie bonds with is not stunningly original, but it's a good (and
detailed) take on one of the alternate cognitive and social models that
science fiction has dreamed up. I was comparing the strangeness and
dislocation unfavorably to China Mi ville's Embassytown while I was reading it, but in retrospect Anders's
treatment is more decolonialized. Xiosphant's turn to Circadianism as
their manifestation of order is a nicely understated touch, a believable
political overreaction to the lack of a day/night cycle. That touch is
significantly enhanced by Sophie's time working in a salon whose business
model is to help Xiosphant residents temporarily forget about time. And
what glimmers we got of politics on the colony ship and their echoing
influence on social and political structures were intriguing.
Even with the world-building, though, I want the author to be interested
in and willing to expand the same bits of world-building that I'm engaged
with. Anders didn't seem to be. The reader gets two contrasting cities
along a road, one authoritarian and one libertine, which makes concrete a
metaphor for single-axis political classification. But then Anders does
almost nothing with that setup; it's just the backdrop of petty warlord
politics, and none of the political activism of Bianca's student group
seems to have relevance or theoretical depth. It's a similar shallowness
as the religion of Mouth's Citizens: We get a few fragments of culture and
religion, but without narrative exploration and without engagement from
any of the characters. The way the crew of the Mothership was assembled
seems to have led to a factional and racial caste system based on city of
origin and technical expertise, but I couldn't tell you more than that
because few of the characters seem to care. And so on.
In short, the world-building that I wanted to add up to a coherent
universe that was meaningful to the characters and to the plot seemed to
be little more than window-dressing. Anders tosses in neat ideas, but
they don't add up to anything. They're just background scenery for Bianca
and Sophie's drama.
The one thing that The City in the Middle of the Night does well is
Sophie's nervous but excited embrace of the unknown. It was delightful to
see the places where a typical protagonist would have to overcome a horror
reaction or talk themselves through tradeoffs and where Sophie's reaction
was instead "yes, of course, let's try." It provided an emotional
strength to an extended first-contact exploration scene that made it
liberating and heart-warming without losing the alienness. During that
part of the book (in which, not coincidentally, Bianca does not appear), I
was able to let my guard down and like Sophie for the first time, and I
suspect that was intentional on Anders's part.
But, overall, I think the conflict between Anders's story-telling approach
and my preferences as a reader are mostly irreconcilable. She likes to
write about people who make bad decisions and compound their own problems.
In
one of the chapters of her non-fiction book about writing that's being
serialized on Tor.com she says "when we watch someone do something
unforgivable, we're primed to root for them as they search desperately for
an impossible forgiveness." This is absolutely not true for me; when I
watch a character do something unforgivable, I want to see repudiation
from the protagonists and ideally some clear consequences. When that
doesn't happen, I want to stop reading about them and find something more
enjoyable to do with my time. I certainly don't want to watch a viewpoint
character insist that the person who is doing unforgivable things is the
center of her life.
If your preferences on character and story arc are closer to Anders's than
mine, you may like this book. Certainly lots of people did; it was
nominated for multiple awards and won the Locus Award for Best Science
Fiction Novel. But despite the things it did well, I had a truly
miserable time reading it and am not anxious to repeat the experience.
Rating: 4 out of 10
First off - nothing I'm going to talk about in this post is novel or overly surprising, I just haven't found a clear writeup of it before. I'm not criticising any design decisions or claiming this is an important issue, just raising something that people might otherwise be unaware of.
With that out of the way: Automatic deduplication of data is a feature of modern filesystems like zfs and btrfs. It takes two forms - inline, where the filesystem detects that data being written to disk is identical to data that already exists on disk and simply references the existing copy rather than, and offline, where tooling retroactively identifies duplicated data and removes the duplicate copies (zfs supports inline deduplication, btrfs only currently supports offline). In a world where disks end up with multiple copies of cloud or container images, deduplication can free up significant amounts of disk space.
What's the security implication? The problem is that deduplication doesn't recognise ownership - if two users have copies of the same file, only one copy of the file will be stored[1]. So, if user a stores a file, the amount of free space will decrease. If user b stores another copy of the same file, the amount of free space will remain the same. If user b is able to check how much free space is available, user b can determine whether the file already exists.
This doesn't seem like a huge deal in most cases, but it is a violation of expected behaviour (if user b doesn't have permission to read user a's files, user b shouldn't be able to determine whether user a has a specific file). But we can come up with some convoluted cases where it becomes more relevant, such as law enforcement gaining unprivileged access to a system and then being able to demonstrate that a specific file already exists on that system. Perhaps more interestingly, it's been demonstrated that free space isn't the only sidechannel exposed by deduplication - deduplication has an impact on access timing, and can be used to infer the existence of data across virtual machine boundaries.
As I said, this is almost certainly not something that matters in most real world scenarios. But with so much discussion of CPU sidechannels over the past couple of years, it's interesting to think about what other features also end up leaking information in ways that may not be obvious.
(Edit to add: deduplication isn't enabled on zfs by default and is explicitly triggered on btrfs, so unless it's something you've enabled then this isn't something that affects you)
[1] Deduplication is usually done at the block level rather than the file level, but given zfs's support for variable sized blocks, identical files should be deduplicated even if they're smaller than the maximum record size
Teaching consent is ongoing, but it starts when children are very young. It involves both teaching children to pay attention to and respect others' consent (or lack thereof) and teaching children that they should expect their own bodies and their own space to be respected---even by their parents and other relatives. And if children of two or four can be expected to read the nonverbal cues and expressions of children not yet old enough to talk in order to assess whether there is consent, what excuse do full grown adults have?
Personal boundaries are guidelines, rules or limits that a person creates to identify reasonable, safe and permissible ways for other people to behave towards them and how they will respond when someone passes those limits.[1] They are built out of a mix of conclusions, beliefs, opinions, attitudes, past experiences and social learning.[2][3] This concept or life skill has been widely referenced in self-help books and used in the counseling profession since the mid-1980s.[4]
Marks and mark rings in GNU Emacs
I recently attempted to answer the question of whether
experienced Emacs users should consider partially or fully disabling Transient
Mark mode, which is (and should be) the default in modern GNU Emacs.
That blog post was meant to be as information-dense as I could make it, but
now I d like to describe the experience I have been having after switching to
my custom pseudo-Transient Mark mode, which is labelled mitigation #2 in my
older post.
In summary: I feel like I ve uncovered a whole editing paradigm lying just
beneath the surface of the editor I ve already been using for years. That is
cool and enjoyable in itself, but I think it s also helped me understand other
design decisions about the basics of the Emacs UI better than before in
particular, the ideas behind how Emacs chooses where to display buffers, which
were very frustrating to me in the past. I am now regularly using relatively
obscure commands like C-x 4 C-o. I see it! It all makes sense
now!
I would encourage everyone who has never used Emacs without Transient Mark
mode to try turning it off for a while, either fully or partially, just to see
what you can learn. It s fascinating how it can come to seem more convenient
and natural to pop the mark just to go back to the end of the current line
after fixing up something earlier in the line, even though doing so requires
pressing two modified keys instead of just C-e.
Eshell
I was amused to learn some years ago that someone was trying to make Emacs
work as an X11 window manager. I was amazed
and impressed to learn, more recently, that the project is still going and a
fair number of people are using it. Kudos! I suspect that the basic
motivation for such projects is that Emacs is a virtual Lisp machine, and it
has a certain way of managing visible windows, and people would like to be
able to bring both of those to their X11 window management.
However, I am beginning to suspect that the intrinsic properties of Emacs
buffers are tightly connected to the ways in which Emacs manages visible
windows, and the intrinsic properties of Emacs buffers are at least as
fundamental as its status as a virtual Lisp machine. Thus I am not convinced
by the idea of trying to use Emacs ways of handling visible windows to handle
windows which do not contain Emacs buffers. (but it s certainly nice to learn
it s working out for others)
The more general point is this. Emacs buffers are as fundamental to Emacs as
anything else is, so it seems unlikely to be particularly fruitful to move
something typically done outside of Emacs into Emacs, unless that activity
fits naturally into an Emacs buffer or buffers. Being suited to run on a
virtual Lisp machine is not enough.
What could be more suited to an Emacs buffer, however, than a typical Unix
command shell session? By this I mean things like running commands which
produce text output, and piping this output between commands and into and out
of files. Typically the commands one enters are sort of like tiny programs in
themselves, even if there are no pipes involved, because you have to spend
time determining just what options to pass to achieve what you want. It
is great to have all your input and output available as ordinary buffer text,
navigable just like all your other Emacs buffers.
Full screen text user interfaces, like top(1), are not the sort of thing I
have in mind here. These are suited to terminal emulators, and an Emacs
buffer makes a poor terminal emulator what you end up with is a sort of
terminal emulator emulator. Emacs buffers and terminal emulators are just
different things.
These sorts of thoughts lead one to Eshell, the Emacs Shell. Quoting from its
documentation:
The shell s role is to make [system] functionality accessible to the
user in an unformed state. Very roughly, it associates kernel
functionality with textual commands, allowing the user to interact
with the operating system via linguistic constructs. Process
invocation is perhaps the most significant form this takes, using
the kernel s fork' andexec functions.
Emacs is a user application, but it does make the
functionality of the kernel accessible through an interpreted
language namely, Lisp. For that reason, there is little
preventing Emacs from serving the same role as a modern shell. It
too can manipulate the kernel in an unpredetermined way to cause
system changes. All it s missing is the shell-ish linguistic
model.
Eshell has been working very well for me for the past month or so, for, at
least, Debian packaging work, which is very command shell-oriented (think
tools like dch(1)).
The other respects in which Eshell is tightly integrated with the rest of
Emacs are icing on the cake. In particular, Eshell can transparently operate
on remote hosts, using TRAMP. So when I need to execute commands on Debian s
ftp-master server to process package removal requests, I just cd
/ssh:fasolo: in Eshell. Emacs takes care of disconnecting and connecting to
the server when needed there is no need to maintain a fragile SSH
connection and a shell process (or anything else) running on the remote end.
Or I can cd /ssh:athena\ sudo:root@athena: to run commands as root on the
webserver hosting this blog, and, again, the text of the session survives on
my laptop, and may be continued at my leisure, no matter whether athena
reboots, or I shut my laptop and open it up again the next morning. And of
course you can easily edit files on the remote host.
By now everyone must have seen the versions of comedy shows with the laugh track edited out. The removal of the laughter doesn't just reveal the artificial nature of television and how it conscripts the viewer into laughing along; by subverting key conversational conventions, it reveals some of the myriad and subtle ways humans communicate with one another:
Although the show's conversation is ostensibly between two people, the viewer serves as a silent third actor through which they and therefore we are meant to laugh along with. Then, when this third character is forcibly muted, viewers not only have to endure the stilted gaps, they also sense an uncanny loss of familiarity by losing their 'own' part in the script.
A similar phenomenon can be seen in other art forms. In Garfield Minus Garfield, the forced negative spaces that these pauses introduce are discomfiting, almost to the level of performance art:
But when the technique is applied to other TV shows such as The Big Bang Theory, it is unsettling in entirely different ways, exposing the dysfunctional relationships and the adorkable mysogny at the heart of the show:
Once you start to look for it, the ur-elements of the audience, response and timing in the way we communicate are everywhere, from the gaps we leave so that others instinctively know when you have finished speaking, to the myriad of ways you can edit a film. These components are always present, it is only when one of them is taken away that they become more apparent. Today, the small delays added by videoconferencing adds an uncanny awkwardness to many of our everyday interactions too. It is said that "comedy is tragedy plus timing", so it is unsurprising that Zoom's undermining of timing leads, by this simple calculus of human interactions, to feelings of... tragedy.
Leaving aside the usual comments about Pavlovian conditioning and the shows that are the exceptions, complaints against canned laughter are the domain of the pub bore. I will therefore only add two brief remarks. First, rather than being cynically added to artificially inflate the lack of 'real' comedy, laugh tracks were initially added to replicate the live audience of existing shows. In other words, without a laugh track, these new shows might have ironically appeared almost as eerie as the fan edits cited above are today.
Secondly, although laugh tracks are described as "false", this is not entirely correct. After all, someone did actually laugh, even if it was for an entirey different joke. In his Simulacra and Simulation, cultural theorist Jean Baudrillard might have poetically identified canned laughter as a "reflection of a profound reality", rather than an outright falsehood. One day, when this laughter becomes entirely algorithmically generated, Baudrillard would describe it as "an order of sorcery", placing it metaphysically on the same level as the entirely pumpkin-free Pumpkin Spiced Latte.
For a variety of reasons I recently decided to try interacting with various social media platforms in new ways. One way of loosening my addiction to this pornography of the amygdala was to hide the number of replies, 'likes' and related numbers:
The effect of installing this extension was immediate. I caught my eyes darting to where the numbers had been and realised I had been subconsciously looking for the input and perhaps even the outright validation of the masses. To be sure, these numbers can be relevant and sometimes useful, but they do implicitly involve delegating part of your responsibility of thinking for yourself to the vox populi, or the Greek chorus of the 21st century.
Like many of you reading this, I am sure I told myself that the number of 'likes' has no bearing on whether I should agree with something, but hiding the numbers reveals much of this might have been a convenient fiction; as an entire century of discoveries in behavioural economics has demonstrated, all the pleasingly-satisfying arguments for rational free-market economics stand no chance against our inherent buggy mammalian brains.
Tying a few things together, when attempting to doomscroll through social media without these numbers, I realised that social media without the scorecard of engagement is almost exactly like watching these shows without the laugh track.
Without the number of 'retweets', the lazy prompts to remind you exactly when, how and for how much to respond are removed, and replaced with the same stilted silences of those edited scenes from Friends. At times, the existential loneliness of Garfield Minus Garfield creeps in too, and there is more than enough of the dysfunctional, validation-seeking and parasocial 'conversations' of The Big Bang Theory. Most of all, the whole exercise permits a certain level of detached, critical analysis, allowing one to observe that the platforms often feel like a pre-written script with your 'friends' cast as actors, all perpetuated on the heady fumes of rows INSERT-ed into a database on the other side of the world.
I'm not quite sure how this will affect my usage of the platforms, and any time spent away from these sites may mean fewer online connections at a time when we all need them the most. But as the Karal Marling, professor at the University of Minnesota wrote about artificial audiences: "Let me be the laugh track."
And we're getting a lot closer. Last edits to the wiki for the testing page. Tests marked as passed. There are a bunch of architectures where the media images are still to be built and the source media will still need to be written as well.
It's been a really good (and fairly long day). I'm very glad indeed that I'm not staying up until the bitter end. It's always fun - I'm also very glad that, as it panned out, we didn't end up also doing the next Buster point release this weekend - it would have been a massive workload.
So Stretch passes to LTS, Jessie has passed to ELTS - and we go onwards and upwards to the next point release - and then, in due course, to Bullseye when it's ready (probably the first quarter of next year?).
As ever, thanks due to all involved - the folks behind the scenes who maintain cdimage.debian.org, to Sledge, RattusRattus, Isy and schweer. Done for about a fortnight or so until the next Buster release.
A new version of drat arrived on CRAN today. This is a follow-up release to 0.1.7 from a week ago. It contains a quick follow-up by Felix Ernst to correct on of the tests which misbehaved under the old release of R still being tested at CRAN.
drat stands for drat R Archive Template, and helps with easy-to-create and easy-to-use repositories for R packages. Since its inception in early 2015 it has found reasonably widespread adoption among R users because repositories with marked releases is the better way to distribute code.
As your mother told you: Friends don t let friends install random git commit snapshots. Rolled-up releases it is. drat is easy to use, documented by five vignettes and just works.
The NEWS file summarises the release as follows:
Changes in drat version 0.1.8 (2020-07-18)
The archive pruning test code was corrected for r-oldrel (Felix Ernst in #105 fixing #104).
Armadillo is a powerful and expressive C++ template library for linear algebra aiming towards a good balance between speed and ease of use with a syntax deliberately close to a Matlab. RcppArmadillo integrates this library with the R environment and language and is widely used by (currently) 757 other packages on CRAN.
Conrad just released a new minor upstream version 9.900.2 of Armadillo which we packaged and tested as usual first as a release candidate build and then as the release. As usual, logs from reverse-depends runs are in the rcpp-logs repo.
All changes in the new release are noted below.
Changes in RcppArmadillo version 0.9.900.2.0 (2020-07-17)
Upgraded to Armadillo release 9.900.2 (Nocturnal Misbehaviour)
In sort(), fixes for inconsistencies between checks applied to matrix and vector expressions
In sort(), remove unnecessary copying when applied in-place to vectors function when applied in-place to vectors
Right on the heels of the news of 2000 CRAN packages using Rcpp (and also hitting 12.5 of CRAN package, or one in eight), we are happy to announce release 1.0.5 of Rcpp. Since the ten-year anniversary and the 1.0.0 release release in November 2018, we have been sticking to a four-month release cycle. The last release has, however, left us with a particularly bad taste due to some rather peculiar interactions with a very small (but ever so vocal) portion of the user base. So going forward, we will change two things. First off, we reiterate that we have already made rolling releases. Each minor snapshot of the main git branch gets a point releases. Between release 1.0.4 and this 1.0.5 release, there were in fact twelve of those. Each and every one of these was made available via the drat repo, and we will continue to do so going forward. Releases to CRAN, however, are real work. If they then end up with as much nonsense as the last release 1.0.4, we think it is appropriate to slow things down some more so we intend to now switch to a six-months cycle. As mentioned, interim releases are always just one install.packages() call with a properly set repos argument away.
Rcpp has become the most popular way of enhancing R with C or C++ code. As of today, 2002 packages on CRAN depend on Rcpp for making analytical code go faster and further, along with 203 in BioConductor. And per the (partial) logs of CRAN downloads, we are running steady at around one millions downloads per month.
This release features again a number of different pull requests by different contributors covering the full range of API improvements, attributes enhancements, changes to Sugar and helper functions, extended documentation as well as continuous integration deplayment. See the list below for details.
Changes in Rcpp patch release version 1.0.5 (2020-07-01)
Changes in Rcpp API:
The exception handler code in #1043 was updated to ensure proper include behavior (Kevin in #1047 fixing #1046).
A missing Rcpp_list6 definition was added to support R 3.3.* builds (Davis Vaughan in #1049 fixing #1048).
Missing Rcpp_list 2,3,4,5 definition were added to the Rcpp namespace (Dirk in #1054 fixing #1053).
A further updated corrected the header include and provided a missing else branch (Mattias Ellert in #1055).
Two more assignments are protected with Rcpp::Shield (Dirk in #1059).
One call to abs is now properly namespaced with std:: (Uwe Korn in #1069).
String object memory preservation was corrected/simplified (Kevin in #1082).
Changes in Rcpp Attributes:
Empty strings are not passed to R CMD SHLIB which was seen with R 4.0.0 on Windows (Kevin in #1062 fixing #1061).
The short_file_name() helper function is safer with respect to temporaries (Kevin in #1067 fixing #1066, and #1071 fixing #1070).
Changes in Rcpp Sugar:
Two sample() objects are now standard vectors and not R_alloc created (Dirk in #1075 fixing #1074).
Changes in Rcpp support functions:
Rcpp.package.skeleton() adjusts for a (documented) change in R 4.0.0 (Dirk in #1088 fixing #1087).
Changes in Rcpp Documentation:
The pdf file of the earlier introduction is again typeset with bibliographic information (Dirk).
A new vignette describing how to package C++ libraries has been added (Dirk in #1078 fixing #1077).
Changes in Rcpp Deployment:
Travis CI unit tests now run a matrix over the versions of R also tested at CRAN (rel/dev/oldrel/oldoldrel), and coverage runs in parallel for a net speed-up (Dirk in #1056 and #1057).
The exceptions test is now partially skipped on Solaris as it already is on Windows (Dirk in #1065).
The default CI runner was upgraded to R 4.0.0 (Dirk).
The CI matrix spans R 3.5, 3.6, r-release and r-devel (Dirk).
In the wake of the Blink, which left a giant crater where S o Paulo was,
Dietz signed up for the military. To be a hero. To satisfy an oath of
vengeance. To kill aliens.
Corporations have consumed the governments that used to run Earth and have
divided the world between them. Dietz's family, before the Blink, were
ghouls in Tene-Silva territory, non-citizens who scavenged a precarious
life on the margins. Citizenship is a reward for loyalty and a mechanism
of control. The only people who don't fit into the corporate framework
are the Martians, former colonists who went dark for ten years and
re-emerged as a splinter group offering to use their superior technology
to repair environmental damage to the northern hemisphere caused by
corporate wars. When the Blink happens, apparently done with technology
far beyond what the corporations have, corporate war with the Martians is
the unsurprising result.
Long-time SF readers will immediately recognize The Light Brigade
as a response to Starship Troopers with
far more cynical world-building. For the first few chapters, the
parallelism is very strong, down to the destruction of a large South
American city (S o Paulo instead of Buenos Aires), a naive military
volunteer, and horrific basic training. But, rather than dropships, the
soldiers in Dietz's world are sent into battle via, essentially,
Star Trek transporters. These still very experimental transporters
send Dietz to a different mission than the one in the briefing.
Advance warning that I'm going to talk about what's happening with Dietz's
drops below. It's a spoiler, but you would find out not far into the book
and I don't think it ruins anything important. (On the contrary, it may
give you an incentive to stick through the slow and unappealing first few
chapters.)
I had so many suspension of disbelief problems with this book. So
many.
This starts with the technology. The core piece of world-building is
Star Trek transporters, so fine, we're not talking about hard
physics. Every SF story gets one or two free bits of impossible
technology, and Hurley does a good job showing the transporters through a
jaundiced military eye. But, late in the book, this technology devolves
into one of my least-favorite bits of SF hand-waving that, for me,
destroyed that gritty edge.
Technology problems go beyond the transporters. One of the bits of horror
in basic training is, essentially, torture simulators, whose goal is
apparently to teach soldiers to dissociate (not that the book calls it
that). One problem is that I never understood why a military would want
to teach dissociation to so many people, but a deeper problem is that the
mechanics of this simulation made no sense. Dietz's training in this
simulator is a significant ongoing plot point, and it kept feeling like it
was cribbed from The Matrix rather than something translatable into
how computers work.
Technology was the more minor suspension of disbelief problem, though.
The larger problem was the political and social world-building.
Hurley constructs a grim, totalitarian future, which is a fine
world-building choice although I think it robs some nuance from the story
she is telling about how militaries lie to soldiers. But the totalitarian
model she uses is one of near-total information control. People believe
what the corporations tell them to believe, or at least are indifferent to
it. Huge world events (with major plot significance) are distorted or
outright lies, and those lies are apparently believed by everyone. The
skepticism that exists is limited to grumbling about leadership competence
and cynicism about motives, not disagreement with the provided history.
This is critical to the story; it's a driver behind Dietz's character
growth and is required to set up the story's conclusion.
This is a model of totalitarianism that's familiar from Orwell's
Nineteen Eighty-Four. The problem: The Internet broke this model.
You now need North Korean levels of isolation to pull off total message
control, which is incompatible with the social structure or technology
level that Hurley shows.
You may be objecting that the modern world is full of people who believe
outrageous propaganda against all evidence. But the world-building
problem is not that some people believe the corporate propaganda. It's
that everyone does. Modern totalitarians have stopped trying to
achieve uniformity (because it stopped working) and instead make the
disagreement part of the appeal. You no longer get half a country to
believe a lie by ensuring they never hear the truth. Instead, you equate
belief in the lie with loyalty to a social or political group, and belief
in the truth with affiliation with some enemy. This goes hand in hand
with "flooding the zone" with disinformation and fakes and wild stories
until people's belief in the accessibility of objective truth is worn down
and all facts become ideological statements. This does work, all too
well, but it relies on more information, not less. (See Zeynep Tufekci's
excellent Twitter and Tear Gas if you're
unfamiliar with this analysis.) In that world, Dietz would have heard the
official history, the true history, and all sorts of wild alternative
histories, making correct belief a matter of political loyalty. There is
no sign of that.
Hurley does gesture towards some technology to try to explain this
surprising corporate effectiveness. All the soldiers have implants, and
military censors can supposedly listen in at any time. But, in the story,
this censorship is primarily aimed at grumbling and local disloyalty.
There is no sign that it's being used to keep knowledge of significant
facts from spreading, nor is there any sign of the same control among the
general population. It's stated in the story that the censors can't even
keep up with soldiers; one would have to get unlucky to be caught. And
yet the corporation maintains preternatural information control.
The place this bugged me the most is around knowledge of the current date.
For reasons that will be obvious in a moment, Dietz has reasons to badly
want to know what month and year it is and is unable to find this
information anywhere. This appears to be intentional; Tene-Silva has a
good (albeit not that urgent) reason to keep soldiers from knowing the
date. But I don't think Hurley realizes just how hard that is.
Take a look around the computer you're using to read this and think about
how many places the date shows up. Apart from the ubiquitous clock and
calendar app, there are dates on every file, dates on every news story,
dates on search results, dates in instant messages, dates on email
messages and voice mail... they're everywhere. And it's not just the
computer. The soldiers can easily smuggle prohibited outside goods into
the base; knowledge of the date would be much easier. And even if Dietz
doesn't want to ask anyone, there are opportunities to go off base during
missions. Somehow every newspaper and every news bulletin has its dates
suppressed? It's not credible, and it threw me straight out of the story.
These world-building problems are unfortunate, since at the heart of
The Light Brigade is a (spoiler alert) well-constructed time travel
story that I would have otherwise enjoyed. Dietz is being tossed around
in time with each jump. And, unlike some of these stories, Hurley does
not take the escape hatch of alternate worlds or possible futures. There
is a single coherent timeline that Dietz and the reader experience in one
order and the rest of the world experiences in a different order.
The construction of this timeline is incredibly well-done. Time can only
disconnect at jump and return points, and Hurley maintains tight control
over the number of unresolved connections. At every point in the story, I
could list all of the unresolved discontinuities and enjoy their
complexity and implications without feeling overwhelmed by them. Dietz
gains some foreknowledge, but in a way that's wildly erratic and hard to
piece together fast enough for a single soldier to do anything about the
plot. The world spins out of control with foreshadowing of grimmer and
grimmer events, and then Hurley pulls it back together in a thoroughly
satisfying interweaving of long-anticipated scenes and major surprises.
I'm not usually a fan of time travel stories, but this is one of the best
I've read. It also has a satisfying emotional conclusion (albeit marred
for me by some unbelievable mystical technobabble), which is impressive
given how awful and nasty Hurley makes this world. Dietz is a great
first-person narrator, believably naive and cynical by turns, and piecing
together the story structure alongside the protagonist built my emotional
attachment to Dietz's character arc. Hurley writes the emotional dynamics
of soldiers thoughtfully and well: shit-talking, fights, sudden moments of
connection, shared cynicism over degenerating conditions, and the
underlying growth of squad loyalty that takes over other motivations and
becomes the reason to keep on fighting.
Hurley also pulled off a neat homage to (and improvement on)
Starship Troopers that caught me entirely by surprise and that I've
hopefully not spoiled.
This is a solid science fiction novel if you can handle the
world-building. I couldn't, but I understand why it was nominated for the
Hugo and Clarke awards. Recommended if you're less picky about
technological and social believability than I am, although content warning
for a lot of bloody violence and death (including against children) and a
horrifically depressing world.
Rating: 6 out of 10
I was wondering: What happens if I have a Haskell module with Template Haskell that embeds some information from the environment (time, environment variables). Will such a module be reliable recompiled? And what if it gets recompiled, but the source code produced by Template Haskell is actually unchanged (e.g., because the environment variable has not changed), will all depending modules be recompiled (which would be bad)?
Here is a quick experiment, using GHC-8.8:
/tmp/th-recom-test $ cat Foo.hs
-# LANGUAGE TemplateHaskell #-
-# OPTIONS_GHC -fforce-recomp #-
module Foo where
import Language.Haskell.TH
import Language.Haskell.TH.Syntax
import System.Process
theMinute :: String
theMinute = $(runIO (readProcess "date" ["+%M"] "") >>= stringE)
[jojo@kirk:2] Mi, der 01.07.2020 um 17:18 Uhr
/tmp/th-recom-test $ cat Main.hs
import Foo
main = putStrLn theMinute
Note that I had to set -# OPTIONS_GHC -fforce-recomp #- by default, GHC will not recompile a module, even if it uses Template Haskell and runIO. If you are reading from a file you can use addDependentFile to tell the compiler about that depenency, but that does not help with reading from the environment.
So here is the test, and we get the desired behaviour: The Foo module is recompiled every time, but unless the minute has changed (see my prompt), Main is not recomipled:
/tmp/th-recom-test $ ghc --make -O2 Main.hs -o test
[1 of 2] Compiling Foo ( Foo.hs, Foo.o )
[2 of 2] Compiling Main ( Main.hs, Main.o )
Linking test ...
[jojo@kirk:2] Mi, der 01.07.2020 um 17:20 Uhr
/tmp/th-recom-test $ ghc --make -O2 Main.hs -o test
[1 of 2] Compiling Foo ( Foo.hs, Foo.o )
Linking test ...
[jojo@kirk:2] Mi, der 01.07.2020 um 17:20 Uhr
/tmp/th-recom-test $ ghc --make -O2 Main.hs -o test
[1 of 2] Compiling Foo ( Foo.hs, Foo.o )
[2 of 2] Compiling Main ( Main.hs, Main.o ) [Foo changed]
Linking test ...
So all well!
Update: It seems that while this works with ghc --make, the -fforce-recomp does not cause cabal build to rebuild the module. That s unfortunate.
Here s my (ninth) monthly update about the activities I ve done in the F/L/OSS world.
Debian
This was my 16th month of contributing to Debian.
I became a DM in late March last year and a DD last Christmas! \o/
This month was a little intense. I did a lot of different kinds of things in Debian this month. Whilst most of my time went on doing security stuff, I also sponsored a bunch of packages.
Here are the following things I did this month:
Uploads and bug fixes:
rails (2:5.2.4.3+dfsg-1) - fix a bunch of CVEs in Sid and Bullseye.
Sponsored ruby-ast for Abraham, libexif for Hugh, djangorestframework-gis and karlseguin-ccache for Nilesh, and twig-extensions, twig-i18n-extension, and mariadb-mysql-kbs for William.
GSoC Phase 1, Part 2!
Last month, I got selected as a Google Summer of Code student for Debian again! \o/
I am working on the Upstream-Downstream Cooperation in Ruby project.
The first half of the first month is blogged here, titled, GSoC Phase 1.
Also, I log daily updates at gsocwithutkarsh2102.tk.
Whilst the daily updates are available at the above site^, I ll breakdown the important parts of the later half of the first month here:
Spread the word/usage about this tool/library via adding them in the official RuboCop docs.
We had our third weekly meeting where we discussed the next steps and the things that are supposed to be done for the next set of cops.
Wrote more tests so as to cover different aspects of the GemspecGit cop.
Opened PR #4 for the next Cop, RequireRelativeToLib.
Introduced rubocop-packaging to the outer world and requested other upstream projects to use it! It is being used by 6 other projects already
Had our fourth weekly meeting where we pair-programmed (and I sucked :P) and figured out a way to make the second cop work.
Found a bug, reported at issue #5 and raised PR #6 to fix it.
And finally, people loved the library/tool (and it s outcome):
(for those who don t know, @bbatsov is the author of RuboCop, @lienvdsteen is an amazing fullstack engineer at GitLab, and @pboling is the author of some awesome Ruby tools and libraries!)
Continuation of GSoC for other Ruby related stuff!
Whilst I have already mentioned it multiple times but it s still not enough to stress how amazing Antonio Terceiro and David Rodr guez are!
They re more than just mentors to me!
Well, only they know how much I trouble them with different things, which are not only related to my GSoC project but also extends to the projects they maintain! :P
David maintains rubygems and bundler and Antonio maintains debci.
So on days when I decide to hack on rubygems or debci, only I know how kind and nice David and Anotonio are to me!
They very patiently walk me through with whatever I am stuck on, no matter what and no matter when.
Thus, with them around, I contributed to these two projects and more, with regards to working on rubocop-packaging.
Following are a few things that I raised:
Debian LTS
Debian Long Term Support (LTS) is a project to extend the lifetime of all Debian stable releases
to (at least) 5 years. Debian LTS is not handled by the Debian security team, but by a separate group
of volunteers and companies interested in making it a success.
This was my ninth month as a Debian LTS paid contributor. I was assigned 30.00 hours and worked on
the following things:
Uploaded a fix for CVE-2020-11082, for ruby-kaminari.
This upload was for Sid and Bullseye and this CVE was fixed in version 1.0.1-6.
Uploaded a fix for CVE-2020-10663, for ruby-json, ruby2.1, and ruby2.5.
These uploads were for Stretch and Buster and were fixed in the version 2.3.3-1+deb9u8, 2.1.0+dfsg-2+deb10u1, 2.3.3-1+deb9u8, and 2.5.5-3+deb10u2.
Other(s)
Sometimes it gets hard to categorize work/things into a particular category.
That s why I am writing all of those things inside this category.
This includes two sub-categories and they are as follows.
Personal:
This month I did the following things:
Wrote and published v0.1.0 of rubocop-packaging on RubyGems!
It s open-sourced and the repository is here.
Bug reports and pull requests are welcomed!
Integrated a tiny (yet a powerful) hack to align images in markdown for my blog.
Commit here.
Here is my monthly update covering what I have been doing in the free software world during June 2020 (previous month):
Opened two pull requests against the Ghostwriter distraction-free Markdown editor to:
Persist whether "focus mode" is enabled across between sessions. (#522)
Correct the ordering of the MarkdownAST::toString() debugging output. (#520)
Will McGugan's "Rich" is a Python library to output formatted text, tables, syntax etc. to the terminal. I filed a pull request in order to allow for easy enabling and disabling of displaying the file path in Rich's logging handler. (#115)
As part of my duties of being on the board of directors of the Open Source Initiative and Software in the Public Interest I attended their respective monthly meetings and participated in various licensing and other discussions occurring on the internet, as well as the usual internal discussions regarding logistics and policy etc.
Filed a pull request against the PyQtGraph Scientific Graphics and graphical user interface library to make the documentation build reproducibly. (#1265)
Reviewed and merged a large number of changes by Pavel Dolecek to my Strava Enhancement Suite, a Chrome extension to improve the user experience on the Strava athletic tracker.
For Lintian, the static analysis tool for Debian packages:
Don't emit breakout-link for architecture-independent .jar files under /usr/lib. (#963939)
Correct a reference to override_dh_ in the long description of the excessive-debhelper-overrides tag. [...]
Update data/fields/perl-provides for Perl 5.030003. [...]
Check for execute_after and execute_before spelling mistakes just like override_*. [...]
Reproducible Builds
One of the original promises of open source software is that distributed peer review and transparency of process results in enhanced end-user security. However, whilst anyone may inspect the source code of free and open source software for malicious flaws, almost all software today is distributed as pre-compiled binaries. This allows nefarious third-parties to compromise systems by injecting malicious code into ostensibly secure software during the various compilation and distribution processes.
The motivation behind the Reproducible Builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.
The project is proud to be a member project of the Software Freedom Conservancy. Conservancy acts as a corporate umbrella allowing projects to operate as non-profit initiatives without managing their own corporate structure. If you like the work of the Conservancy or the Reproducible Builds project, please consider becoming an official supporter.
This month, I:
Filed a pull request against the PyQtGraph to make the documentation build reproducibly. (#1265)
Addressed a regression in the octave-queueing package in the handling of absolute paths in Texinfo files. (#962187)
Submitted the following patches to fix reproducibility-related toolchain issues within Debian:
critcl: Please make the teapot.txt files reproducible. (#963600)
sasmodels: Regression in debian/patches/reproducible-c-models.patch. (#962050)
Contributed to a discussion regarding improving the reproducibility of packages that use the CMake build system. [...]
Added to a conversation regarding the nondeterministic execution of order of Debian maintainer scripts that results in the arbitrary allocation of UNIX group IDs referencing the Tails operating system. [...]
Replace obscure references to "WF" with "Wagner-Fischer" for clarity. [...]
Use a semantic AbstractMissingType type instead of remembering to check for both types of "missing" files. [...]
Add a comment regarding potential security issue in the .changes, .dsc and .buildinfo comparators. [...]
Drop a large number of unused imports. [...][...][...][...][...]
Make many code sections more Pythonic. [...][...][...][...]
Prevent some variable aliasing issues. [...][...][...]
Use some tactical f-strings to tidy up code [...][...] and remove explicit u"unicode" strings [...].
Refactor a large number of routines for clarity. [...][...][...][...]
trydiffoscope is the web-based version of diffoscope. This month, I specified a location for the celerybeat scheduler to ensure that the clean/tidy tasks are actually called which had caused an accidental resource exhaustion. (#12)
Frontdesk duties, including responding to user/developer questions, reviewing others' packages, participating in mailing list discussions as well as attending our contributor meeting.
Issued DLA 2233-1 to fix two issues in the Django web development framework in order to fix a potential data leakage via malformed memcached keys (CVE-2020-13254) and to prevent a cross-site scripting attack in the Django administration system (CVE-2020-13596). This was followed by DLA 2233-2 to address a regression as well as uploads to Debian stretch (1.10.7-2+deb9u9) and buster (1.11.29-1~deb10u1). (More info)
Issued DLA 2239-1 for a security module for using the TACACS+ authentication service to prevent an issue where shared secrets such as private server keys were being added in plaintext to various logs.
Issued DLA 2244-1 to address an escaping issue in PHPMailer, an email generation utility class for the PHP programming language.
Issued DLA 2252-1 for the ngircd IRC server as it was discovered that there was an out-of-bounds access vulnerability in the server-to-server protocol.
Issued DLA 2253-1 to resolve a vulnerability in the Lynis a security auditing tool because a shared secret could be obtained by simple observation of the process list when a data upload is being performed.
You can find out more about the project via the following video:
Uploads
The twelveth release of littler as a CRAN package is now available, following in the fourteen-ish year history as a package started by Jeff in 2006, and joined by me a few weeks later.
littler is the first command-line interface for R as it predates Rscript. It allows for piping as well for shebang scripting via #!, uses command-line arguments more consistently and still starts faster. It also always loaded the methods package which Rscript only started to do in recent years.
littler lives on Linux and Unix, has its difficulties on macOS due to yet-another-braindeadedness there (who ever thought case-insensitive filesystems as a default where a good idea?) and simply does not exist on Windows (yet the build system could be extended see RInside for an existence proof, and volunteers are welcome!). See the FAQ vignette on how to add it to your PATH.
A few examples are highlighted at the Github repo, as well as in the examples vignette.
This release mostly responds to the recent docopt release 0.7.0 which brought a breaking change for quoted arguments. In short, it is for the better because an option --as-cran is now available parsed as opt$as_cran which is easier than the earlier form where we needed to back-tick protect as-cran containing an underscore. We also added a new portmanteau-ish option to roxy.r.
The NEWS file entry is below.
Changes in littler version 0.3.11 (2020-06-26)
Changes in examples
Scripts check.r and rcc.r updated to reflect updated docopt 0.7.0 behaviour of quoted arguments
The roxy.r script has a new ease-of-use option -f --full regrouping two other options.
In May, I got selected as a 
Here is my monthly update covering what I have been doing in the free and open source software world during July 2020 (
First off - nothing I'm going to talk about in this post is novel or overly surprising, I just haven't found a clear writeup of it before. I'm not criticising any design decisions or claiming this is an important issue, just raising something that people might otherwise be unaware of.
Marks and mark rings in GNU Emacs
I 
A new version of 
Right on the heels of the news of 
I was wondering: What happens if I have a Haskell module with Template Haskell that embeds some information from the environment (time, environment variables). Will such a module be reliable recompiled? And what if it gets recompiled, but the source code produced by Template Haskell is actually unchanged (e.g., because the environment variable has not changed), will all depending modules be recompiled (which would be bad)?
Here is a quick experiment, using GHC-8.8:
The twelveth release of