I recently mentioned that I would visiting some friends at mi2 in Zagreb and would be traveling around the Balkans a bit to give some talks and workshops. Here's what the current plan includes:

• Novi Sad (November 20, at 20:00): I'll be participating in a discussion of hacker culture at CK13.

• Novi Sad (November 21-22 16:00-21:00): There will be a System.hack() exhibition which I helped prepare some of the text for and which I'll be on-hand for. It will include a narrated history of hacking through six objects. The exhibition will be held in an room of the Mediteraneo Hotel in Novi Sad.

• Belgrade (November 23 20:00): Another discussion on hacker culture, this time at Rex.

• Belgrade (November 23-24 17:00-20:00): System.hack() will be exhibited again in a room of the Kasina Hotel.

• Ljubljana (November 26, Time TBD): I'll be giving a talk on free software project management at Kiberpipa/Cyberpipe

• Zagreb (November 29-December 1): I'll be participating the Open Translation Tools workshop organized by Aspiration.

• Zagreb (December 3): I'll giving a talk in the giving a talk in the g33koscope lecture series. The topic and time are still undecided.

If you're in Novi Sad, Belgrade, Ljubljana, or Zagreb and would like to meet up, please consider coming to the events and exhibitions. If you can, and especially if you can not but would like to meet up anyway, feel free to drop me an email and let's try to organize a meeting. Thanks go to Tomislav Medak and Marcell Mars who organized System.hack(), this whole tour, and who helped do the work to bring me over. I'm looking forward to the next couple weeks.

I just discovered the recently-opened Velouria Espresso in Jamaica Plain via this subscribers-only article in the Atlantic. Velouria marks the latest arrival in the single-origin coffee movement pioneered by George Howell. In a nutshell, the idea of single-origin coffee beans is that if beans are identified with a particular region (or even particular grower), the farmers will have more incentive to distinguish themselves. Ultimately, coffee beans will be known like fine wines, and the best growers will earn premium prices (thus bringing even more money to underdeveloped areas than coffee sold as fair-trade). Flatblack Coffee Company, near my office, operates under similar principles. More details in this episode of On Point with George Howell. Velouria distinguishes itself with its focus on brewed coffee rather than espresso (although they have plenty of that as well). The shop features the “Clover” coffee machine (”Bring out the subtle nuances of all of your coffees through complete, independent control of all of the important brew parameters: grind size, dose, water temperature, and contact time.”) I got a cappucino and a single-origin Kenyan coffee made with the Clover Machine. (Actually, two distinct single-origin Kenyan coffees, which Steve surreptitiously swapped on me while I wasn’t looking). They were all excellent. My cappucino started with a little foam heart in the crema: Amazingly, even when it was finished, the heart was still faintly visible: Steve enjoyed his espresso as well: Velouria has no website that I could find. it’s at 389 Centre Street, Jamaica Plain, MA 02131. Beware the Yelp page as it has inaccurate hours information — just call them at (617) 522-2400 if you’re wondering if they’re open. Now if we could only get a place like this in one of the vacant storefronts in Roslindale… Technorati Tags: Coffee, espresso, flatblack, single origin, velouria espresso, Boston

Share This

Three days ago I released KCheckGMail v0.5.7.3: nothing but a one-bug fix release.

---

I know it's a little late, I mean, three days ago!

Anyways, better blog about it now than not bloging about it ever.

This release was prepared by the new dev, Luis Pereira. It fixes an authentication problem in newer versions of gmail.
This time I also uploaded the md5 checksums signed with my key, for those who are interested in that stuff.

As usually, the new version can be downloaded from [url]http://kcheckgmail.sourceforge.net/download.html
Currently there are no packages neither for sarge nor etch, I'll build them as soon as I fix my wannaBuild.
And for unstable, I've already sent the new package to Anibal so I hope he'll have some time soon to review and upload the package before bugs about the new gmail version are filed in the BTS :)

Now that I'm finally writing a blog post, I think I'll also write something about what's up with me lately:

Some days ago I submitted my NM application :yes:

But besides that, I've been very busy lately because of school (exams, home work, etc), university (preparation courses, admission exams, etc), Real Life (tm), and because of some Debian-related work.

And I don't expect this to get any better soon (not before the end of the year), I'll be taking some other courses after school exams so I might be even more absent from my other projects (only some QA work on Debian seems to be easy lately).

I've been getting really interested in the new crop of Linux-based operating systems for mobile devices. I got a Nokia N800 earlier this year, which I've found really useful -- although a little frustrating, too. And I've been following the developments on OpenMoKo with great interest, too. So last Monday, when Google Android came out, I offered to give an experienced developer's opinion of the development kit for Network World. I spent most of the afternoon trying out the SDK, checking out the documentation, watching the presentation videos, and working on sample applications to get a feel for it. I'm pretty impressed with Android, and I think it's got a good shot to become the Open Source mobile application platform. I think that whoever wins in this space has the chance to shape how all mobile phone platforms work in the future, and to take a good chunk of the market. Opening up the phone platform to allow a real marketplace of third-party apps is, I believe, going to be a huge advantage for whoever can make it work. I think the main two contenders in the area are well ahead of Android so far, but they're really going to have to capitalize on that lead in the next 8-10 months before the first Android handsets are set to hit the market (late 2008 -- although we'll see about that schedule). And I'm not sure they've got the means and commitment to do it. Nokia has been screwing around with the N series of Internet tablets for a while. Which is great -- the operating system is clever, the GUI ("Hildon") GTK-based, and development in Python on the platform is a breeze. The basic tools -- media player, RSS reader (ingenious), Web browser, email, etc. -- work well. However, for unexplained reasons, Nokia hasn't put a damn phone into the thing. If there is a similar device that does everything that the N800 (or N810) does, plus has a phone in it, which one are people going to buy? It seems obvious to me. The other interesting OS is OpenMoKo, which I think is a great project with exactly the right goals. However, there's been some disappointment in the enthusiastic community around the OS as schedules have slipped and the developer preview devices shipped without a functioning dialer app. These two projects will have to fight uphill against the fear, uncertainty and doubt generated by the Android announcement and SDK release, even to stay in the game. And, to be fair, Google's announcement was masterful: classic vaporware -- for a product that won't be shipping for at least a year. But they got a pretty solid list of partners for the platform to sign on (albeit with only vague requirements for support). Best of all, they released a one-two punch of a bunch of developer information videos with tantalizing views of a nice-looking potential device, and a good SDK with tons of documentation and developer tools. It even includes an emulator that looks like a little phone. Awww! Android is slick, it's deep, and it's well-designed. The architecture is smart and sophisticated without being too clever for its own good. It's built on conservative -- maybe a little too conservative -- twin pillars: Java and Linux. For hardware providers, there's Linux's tried-and-true driver framework. For applications developers, way up at the top of the stack, there's good ol' boring Java, with new and smart APIs targeted specifically for mobile device apps, all on top of a new virtual machine called Dalvik that (supposedly) optimizes the hell out of Java bytecode. I was really impressed that the emulator emulates much more than just the Java APIs -- you can build ARM binaries in C that run on the thing. Very nice. Am I still going to get an OpenMoKo device? Maybe. But I'm going to continue playing around with the Android SDK, and looking for early developer versions of Android-supporting devices? Oh, yeah. Oh, and the article I did the research for is here; strangely it ended up on ComputerWorld rather than NetworkWorld. OK for me, though. tags: android google mobile linux article java

More about me and my cool life So, I talked yesterday (Journal/27 Brumaire CCXVI) about how much weight I've lost in the last few months, which has been great. Another thing that's been going on for me is that I've started using the Getting Things Done process for scheduling my tasks and my time. I've never been particularly good at managing my time, but at least I've always known that however late or irresponsible I might be, my brother Ted would always be later. But when I visited San Francisco in August, Ted was really doing great. Friends and family kept telling me how responsible and down-to-earth Ted seemed lately. And whenever he had an idea for something to do, he wrote it down in his little Sidekick device. Ted showed me how the GTD system worked for him, and so I went out and bought the book and started reading it. I have been doing GTD for a few months now, and I've found it really satisfying. I don't worry as much any more about little things that I should be doing -- they're all captured in my system. It's really gratifying. I don't know if I've been quite as successful as Ted in improving my personal productivity, but I do know that I'm feeling a lot better about things and about myself. Which is really all that matters. tags: gtd gettingthingsdone tedprodromou productivity

Skating away Maj, Amita June and I went ice-skating today. It was AJ's first time out on the ice, and she really enjoyed it (most of the time). We had a couple of spills, mostly because it was really my first time skating with a 2-year-old, and partly because it was her first time skating with anyone. We went to the indoor rink near our old house on rue Cartier at the corner of Marie-Anne. Pretty soon we'll be able to go outside on the pond at Parc Lafontaine. Maj isn't really a big skating fan, but she seemed to have a good time this time around. Which made three of us. I think we've got the makings of a Sunday-afternoon family tradition. We'll see, at least. tags: iceskating amitajune maj

More one-liners

• I'm glad to see that the Mister Wong logo contest I talked about a while ago (Journal/21 Thermidor CCXV) has borne fruit. The top 12 logos look pretty good.
• Maj and I have been catching up on season 3 of Deadwood lately. Great show, nice to see that season three is as solid as previous ones.
• We've got RecentChangesCamp coming up in San Francisco in February 2008 (I think). Anyone interested should get involved at http://aboutus.org/RCC2008 .
• What's the best alternative to the Sitemaps protocol for people who are into RDF? I'm thinking you could just make a hugantic RSS 1.0 feed -- after all, it is the "RDF Site Summary" format. Best of all, most search engines consume RSS as a recommended feed format. I'm going to try it with Vinismo and let you all know. The downside: I'm not sure many processors will handle a 100,000-item RSS feed very well.
• Norman Mailer died just as I got around to reading the copy of ''Oswald's Tale'' I stole from the Driskill Hotel last year at South by Southwest. I can't help feeling responsible.

tags: 1l misterwong deadwood recentchangescamp rss1.0 rdf sitemaps

At this month’s meeting of the Linux Users of Victoria [1] I gave a talk titled Everyone Should Blog (unfortunately the title was missed in the meeting announcement). I’ve been meaning to write about this but was finally prodded into writing by a ProBlogger post about overcrowding in the blog market [2]. Darren (the ProBlogger) suggests that the blog space is overcrowded, blogs are being sold for unreasonably high prices, and a bust similar to the dot-com bust may occur. I agree that there is some over-commercialisation, and that for Darren’s core market (people who want to make money directly from blogging) this is a serious issue to consider. However I believe that there is a lot of scope for more blogs. Firstly all of the services in the social networking space seem to have some feature that resembles a blog in some way (the online diary if not the RSS feed part of the definition). I have previously blogged about some ideas for an open social networking system [3]. A reform of the social networking scene should have the possibility of adding even more users and having them all be bloggers. While not everyone is capable of writing a blog that is of interest to a large audience, everyone who is capable of writing is capable of writing (or contributing to) a blog that is of interest to some people. The next potential area for expansion is in sales/marketting blogs. An example of this is car sales, it seems that every web site run by a car manufacturer only has information on the current model and at best only has information on prices of second-hand cars. There is a real need for authoritative information on older cars, it helps customers and it helps the car companies. If Ford was to provide good information on the cars they manufactured a few years ago it would increase the chance that I would buy a second-hand Ford and if enough people made similar decisions then it would increase the prices of such cars (basic rules of supply and demand). Increasing the second-hand price increases the price that people are prepared to pay for new cars and also allows them to buy a new car sooner - both of which are benefits to the manufacturer. It wouldn’t be difficult to use a blog server for all the information on new cars, you could have a front page that lists the available marques and links to the posts announcing the latest models of those marques. With a small amount of work writing a theme you could have Wordpress giving an appearance that’s almost indistinguishable from any of the major car companies web sites - apart from the fact that every car’s technical data would have a permanent URL of the form www.carcompany.com.au/2007/MARQUE/CODE which would be obviously a permanent link (unlike the Java servlet and ASP URLs you currently see) and therefore would encourage deep links by enthusiasts. This would also give RSS feeds for free (I would be interested in adding RSS feeds for several of the Australian car companies to my Planet installation if possible). A final benefit is the issue of ethics. When car companies remove data about cars they sold the previous year you have to wonder whether they have unreasonable price increases or whether the new cars have some specs that are lesser than the current cars. The general trend is slow and steady increases in features and performance at each price point, the number of people who are more likely to buy from an ethical (trustworthy) company is probably greater than the number of people who will look for details to nit-pick (and such people will find out anyway). Another use for blogs is for public events. It’s not uncommon for people to want to get some background information on an event that they attended years ago. If all the information was archived in the blog of the organisation that hosted the event then it would be easy for everyone to access. This would give additional promotion opportunities for the hosting organisation at almost no cost. Anyone who is announcing a future event should have an RSS feed for new information related to it, then as information is released all the interested people can see it in their favourite feed reader. Many people refuse to subscribe to announcement lists due to fear of spam and the fact that it is often inconvenient or impossible to unsubscribe (sometimes a list server regards unsubscribe requests as spam). Corporations have many potential uses of blogs, Google announces news about all their products via blogs and Microsoft has a good recruiting blog. Smaller companies can still achieve some of the same benefits via blogging. Also it’s well known that a blog which provides useful information about products in a field (not just the products being sold) can really attract potential customers who then react to the adverts in the blog. The same technique can be used by job seekers. Blog well and mention that you are looking for work and you will get offers of interviews. There is also no shortage of political and lobbying blogs as well, they don’t tend to convince the opposition but they are good for converting people who are ambivalent about an issue. As the people who read blogs get older (and therefore richer and more influential) such blogs will become increasingly important. I think that I have demonstrated the potential for a significant number of new blogs, some of which would have large subscriber bases and a lot of influence (which means a lot of potential profit for the Problogger crowd). Have I missed any major areas for developing new blogs?

• [1] http://www.luv.asn.au/


• [2] http://www.problogger.net/archives/2007/11/18/leveraging-the-power-of-blogs-in-an-overcrowded-market/


• [3] http://etbe.coker.com.au/2007/11/18/better-social-networking/

Share This

Yay, the club seems to be getting bigger and bigger. While I've been mostly away from this blog, Bubulle has joined the group. Also, the long-disappeared Evan promises to be back, and running as well. I didn't get to see him, but Gaby told me she saw Mauricio (making a IMHO very nice 0:51:33 time for 10Km) on last week's Nike race. Of course, I was also at the race, with a 1:07:36 total time. Not bad for such a strange period!

I just got an email from Udi Fuchs of UFRaw fame. The latest version of UFRaw, 0.13, supports the XICC specification so it can adjust the image for correct display on your monitor. Great, thanks Udi! NP: Milieu, Tape

Today, I found an interesting use of Google Maps:
Agrandir le plan That happens to be my running loop as of today, the longest ever. For Dirk Eddelbuettel: 16.87km, 1h41. I'm still far from your marathon performances..:-) Amazing how each and every small track in the fields is mentioned and, believe me, they have the *right* names. After all, I could use this to track down my running data. Only drawback: it takes about 15 minutes to draw such loop.

So it looks like I will have to use the other computer, and hope that Dell sorts things out quickly. I'm pretty disappointed, as I just purchased the machine (an Inspiron 1505 with Ubuntu) in July, and haven't really traveled with it much.

[440525.460000] ata2.00: configured for UDMA/33
[440525.460000] ata2: EH complete
[440942.908000] ata2.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x2 frozen
[440942.908000] ata2.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in
[440942.908000]          res 50/00:01:00:00:00/00:00:00:00:00/a0 Emask 0x2 (HSM violation)
[440942.908000] ata2: soft resetting port

It required fsck'ing, and that was pretty much all she wrote. The disk itself, according to smartctl:

Device: ATA      ST980813AS       Version: 3.AD
Serial number:             5NH0301G

It doesn't support SMART though, so I don't know if the recent fuss about Ubuntu and Laptop HD's has anything to do with it. I never ran it much without power in any case, so I doubt it. It's especially frustrating, because I was making good progress on the Android port for Hecl, and will in the best of cases have to get a new computer "broken in", even though I do have good backups. My fingers are crossed that the money I spent for extra coverage will be worth something and that Dell Austria will be able to resolve the problem in a hurry, without requiring that I send the machine to the US or anything else that takes a lot of time. Sigh:-(

When advogato.org was still cool I signed up to it. It was an interesting research project in skill metrics (determining the rating of people’s coding skills by the votes of others and weighting the votes by the rating of each person), and it was nice to be rated Master soon after I joined. I still use it on occasion for the blog syndication feature (when I find a good blog on Advogato I add it to my Planet installation). When orkut.com was really cool (when every time I had dinner with a group of people someone would ask if they could be an “orkut friend”) I signed up to it. It was interesting for a while but then most people got bored with it. Now there is Facebook and MySpace for social networking for social purposes and LinkedIn.com for business related social networking. I periodically get invited to join those services but have not been interested in any other than LinkedIn. I can’t join LinkedIn because their mail server is regarded as a SPAM source by my mail server but their web server refuses to provide any information on why this is (the rejection was apparently long enough ago that it’s rolled off my logs). The problem with all these services is that I am expected to sign up with each of them and go to a moderate amount of effort in writing up all the data in the various web pages. Writing it is a pain, keeping it up to date is more pain, and dealing with spam in “scrap-book” entries in Orkut is still an annoyance which I don’t want to multiply by four! So far the only step I’ve seen towards addressing this issue is the XFN - XHTML Friends Network [1] project. But that seems to be of fairly limited scope (just referring to the friendship status of people in a <A HREF link). I believe that the requirements for social networking are:

1. Personal data about each person, some of which may only be available to friends or friends of friends.


2. The user owns their own data, has full control over where it’s sent and the ability to request people who receive it to keep some parts of it secret.


3. Ability to send email to friends of friends (determined by the wishes of each friend and FOAF).


4. Ability to get a list of friends of friends.


5. Incorporation of a standard format for CVs (for business social networking).

I think that the only way to go is to have a standard XML format for storing all personal data (including financial, career, and CV data) that can be used on any web site. Then someone who wants to be involved in social networking could create an XML file for a static web server (or multiple files with different content and password protected access), or they could have a server-side script generate an XML file on the fly with a set of data that is appropriate for the reader. The resulting social network would be entirely distributed and anyone could write software to join in. This covers item 1 and part of item 2. For sending email to friends of friends it would be good to avoid spam as much as possible. One way of doing would be requesting that friends publish a forwarding address on their own mail server in a manner similar to SRS [2]. SRS include the ability for such addresses to expire after a certain period of time (which would be convenient for this). In fact publishing SRS versions of friends email addresses would be a good option if you already use SPF [3] and SRS in your mail server. This covers item 3. The XML format could include information on how far the recipient could transfer it. For example if my server sent an XML file to a recruiting agency with my CV it could state that they could distribute it without restriction (so that they can give it to hiring managers) with the possibility of some fields being restricted (EG not tell the hiring manager what I used to get paid). For my mobile phone number I could send it to my friends with a request that they not send it on. This covers part of item 2. The URL for the friends file would of course be in the main XML file, and therefore you could have different friends lists published from different versions of your profile (EG the profile you send to recruiting agencies wouldn’t include drinking buddies etc). This completes the coverage of item 2. Then to have a friends list you have a single XML file on a web server that has the public parts of the XML files from all your friends. This means that getting a list of friends of friends would involve getting a single XML file for each friend (if you have 100 friends and each friend has 50 unique friends on average then you do 100 HTTP operations instead of 5,000). Minimising the number of web transfer operations is essential for performance and for reliability in the face of unreliable web servers (there is no chance of having 5,000 random web servers for individuals all up and accessible at the same time). This covers item 4. Item 5 is merely a nice thing to have which allows more easily replacing some of the recruiting infrastructure. As any such XML format will have several sections for arbitrary plain text (or maybe HTML) for describing various things the CV could of course be in HTML, but it would be good to have the data in XML. I posted this in the “blog” category because blogs are the only commonly used systems where end users do anything related to XML files (the RSS and ATOM feeds are XML). A blog server could easily be extended to do these social networking systems. As with a blog users could run their own social networking server (publishing their XML files) or they could use a service that is similar in concept to blogger which does it all for them (for the less technical users). Then an analogy to Planet, Technorati, etc in the blog space would be public aggregation services that compare people based on the number of friends they have etc, and attempts to map paths between people based on friends. This could also include GPG [4] data such that signing someone’s GPG key would cause your server to automatically list them in some friend category. The XML format should also have a field for a GPG signature (one option would be to use a GPG sub-key to sign the files and have the sub-key owned by the server). I don’t have any serious time to spend on implementing this at the moment. But if someone else starts coding such a project then I would certainly help test it, debug it, and contribute towards the XML design.

• [1] http://gmpg.org/xfn/and/


• [2] http://www.openspf.org/SRS


• [3] http://www.openspf.org/


• [4] http://www.gnupg.org/

Share This

Is it possible to secure Internet banking with SMS? As secure tokens are too expensive ($10 or more in bulk) and considered to be too difficult to use by many (most?) customers banks have sought out other options. One option that has been implemented by the National Australia Bank and will soon be available from the Commonwealth Bank is SMS authentication of transfers. The idea is that when you issue an online banking request you receive an SMS with a password and then have to enter that password to authenticate it. If you receive an unexpected password then you know you have been attacked. I wonder how much information is in the SMS, does it include the amount and where the money is to be transferred (in the case of a funds transfer - the operation most likely to be used by attackers)? If the full details are not included then an attacker could hijack an active session, get the user to enter the password, and then act as if the user entered the password incorrectly. The user would then request a new SMS and complete their desired transfer without realising that they just authorised a transfer to Russia… If the full details are recorded will the user look at them? Online banking fraud often involves transferring the funds to an idiot in the same country as the victim. Then the idiot sends the money to the attacker in some other manner which is more difficult to track. I wonder whether an attacker could divert the funds transfer to one of the idiots in question and have the victim not realise that the wrong account number was used. Another issue is that of SMS interception. Anyone who can hack the network of a phone company could steal money from any bank account in the country! For wealthy people there is also the possibility of stealing their mobile phone and making funds transfers before they report the theft. Another possibility is to register for a new phone company. Last time I changed phone companies it took about an hour for the new company to have the phone number and I don’t recall the phone company doing anything to verify that I owned the number in question. If an attacker had a credit card with the same name as the victim (names are not unique so this is not impossible or even inherently illegal) they could open a new phone service and steal the number. Someone who’s mobile phone stops working probably wouldn’t assume that it was part of a bank fraud scheme and act accordingly, in fact if they don’t use their mobile phone later it might be several days before someone contacts them in some other manner and mentions that they weren’t answering their mobile phone. A final possibility is the situation where a mobile phone is connected to a computer. Devices that combine mobile phone and PDA functionality are becoming common. A trojan horse program that offered to do something useful when a mobile phone was connected to the PC via a USB cable might fool some users. All that would be required is a few minutes of the phone being connected if the attacker already has the password for online banking. Maybe they could even make it appear that the bank was demanding that the phone be connected to the PC - that should fool users who don’t understand how SMS authentication works. It seems to me that SMS authentication is an improvement (it adds an external device which usually can’t be directly manipulated by the attacker) but is far from perfect security. I previously wrote about the bad idea that you can bank with an infected computer [1]. SMS authentication is a good step towards making things more difficult for attackers (which is always a good idea) but doesn’t really secure the system. Also it costs 5 cents for each SMS, I expect that the banks will want their customers to pay for this - I would rather pay for a $10 token up-front.

• [1] http://etbe.coker.com.au/2007/10/19/banking-with-an-infected-computer/

Share This

I just got an email from Udi Fuchs of UFRaw fame. The latest version of UFRaw, 0.13, supports the XICC specification so it can adjust the image for correct display on your monitor. Great, thanks Udi! NP: Milieu, Tape

From November 9 till November 15 I attended SAGE Days 6 in Bristol, UK. It was a conference and a coding sprint for the SAGE project, which wants to build something comparable to Mathematica, Maple, Matlab and Magma built only from open source components without reinventing the wheel. Sage also provides excellent novel implementations for many mathematical algorithms (not found in Mathematica/Maple etc.).

I was invited to give a talk about SymPy, which is a Python library for symbolic mathematics, that we are doing.

Here are my notes from each day:

Saturday: one, two
Sunday: one, two
Monday, Tuesday, Wednesday: one

Impressions

Very positive. I started SymPy two years ago, because I wanted to play with symbolic mathematics in Python, see for example my presentation I gave at this conference for details. SAGE at that time was just able to do some mathematics things, but it was very weak in calculus, which is the SymPy's main domain. This has changed last half a year, when SAGE people managed to wrap Maxima in Python (which I thought to be completely impossible), so I started to follow SAGE development more closely. After the SD6, I must say I became very excited about the project.

One problem with mailinglists, IRC and other online interaction is that it's very difficult for me to get an impression about the people and the project. Being able to meet the developers and discuss with them face to face gives me the impression very quickly and very accurately.

By far the biggest guarantee, why it is worthy for me to contribute to SAGE, is the project leader, William Stein. He is very rational and pragmatic (I like these two properties) and after many discussions with him, I came to realize that he has basically identical views on the important things as I do and were I on his place, I would do the same decisions as he did and does. That's very nice, because I can concentrate my energy on things that I like to improve and don't have to worry about other things, because I know he will do it right.

The other SAGE developers are experts and with similar attitude as William has. It's enthusiastic to be among people who make things happen. For example one of the authors of Cython, Robert, implemented during SD6 a very nice HTML output, that shows Cython code, with colors according to how many Python API calls are called on that particular line, and by clicking that line it shows the corresponding C code.

SAGE project has a high aim and it stricly goes for it, without looking too much to the right or left, and that's how it should be. And it does produce a lot of very useful and high quality stuff along the way, for example Cython (probably the best wrapper for C/C++ things now, only pypy could possibly beat it, but that's still more a research project) or the SAGE notebook, which looks like a Mathematica notebook, but better and in a browser (together with a revision history, sharing, SSL encryption, etc.).

The only little problem is that currently SAGE developers are all mathematicians and as is well-known, mathematicians looks at mathematic from a very different prospective than physicists. :) And so I need calculus, advanced calculus and only when this is working, and working well, I can build on it some more advanced features. SAGE currently goes a little the other way - it has a lot of advanced features, from number theory, modular forms, elliptic curves, etc., but the basic calculus still needs a lot of improvements. SAGE wraps Maxima, because Maxima is quite fast, very well tested, so it works well. It's difficult to extend and written in LISP and that's very bad. That's where SymPy could help - it's in Python, very easy to extend, but currently slower than Maxima (rewriting parts of SymPy using Cython, or even C directly, will make it faster, hopefully as fast as Maxima or faster).

It's not yet in Debian, but SAGE people are working on it. It's not an easy task unfortunately.

Conclusion

SAGE is a very promising young project and I think it will succeed to provide an open source alternative to Maple, Matlab, Mathematica and Magma.

Many thanks to everyone who sent in their thoughts on my post about vi and CTRL-[. Here's a quick summary of the comments I received on my blog and by IRC/email:

• The vast majority of the people who commented use the Esc key.
• Very few people use CTRL-[ (4 out of ~70).
• Many people use keyboard layouts where CTRL-[ is difficult to type (French, German, Finnish, Swedish, Spanish, ...)
• A few people have moved Esc elsewhere, such as the Caps Lock key (and here's how to do it, thanks Mark).
• A better alternative is to use CTRL-C, which works on all keyboard layouts. It doesn't do the exact same thing as Esc/CTRL-[ because it doesn't check for abbreviations; dato notes in a comment that this can be remedied in Vim with inoremap <C-c> <Esc><Esc>.
• Some people use the Esc key because it's hard to miss, being physically apart from other keys. Some people, on the other hand, complain that Esc is error-prone on laptops because it's too close to F1, or just awkwardly placed.
• Everybody helix! (not to be confused with the helix wind turbine)

As a closing note, a followup question from reader Laurent C.: :wq, :x or ZZ? :)

As many of you probably know, the vi editor has two main modes, and switching back to command mode requires sending the Escape character. This can be achieved either by using the Esc key (the top left key on most keyboards) or by using CTRL-[. The latter has the advantage that the [ key is much closer to the home row than the Esc key, and is thus faster to type. Despite that, pretty much all the vi users I know still use Esc, and I wonder why. I've heard that on some keyboard layouts (like the French azerty), CTRL-[ is actually impossible to type, but in my experience many Free Software people (like me) use the US layout even though it's not their local layout.

So if you have a few seconds, I'd appreciate your feedback (via a comment on this post, or an email). You have the following options:

• #1: vi (or a derivative like vim) is my main editor, and I use CTRL-[.
• #2: vi (or a derivative like vim) is my main editor but I use the Esc key even though CTRL-[ is easy to type on my layout.
• #3: vi (or a derivative like vim) is my main editor but CTRL-[ is too hard to type on my layout.
• #4: I use another editor as my main editor.
• #5: I have no idea what you're talking about, but I wish to state that I will vote for helix in the 2008 DPL elections.

Thanks!

Today, when walking through some Wammu/Gammu bugs, I came to conclusion that the spam changed some people to behave insane. The email field in bug tracker is there to allow developer to contact you, for example when he makes a fix for issue you reported and wants you to test it. Entering addresses as ones at TrashMail which will vanish soon (the bug I'm talking about is two days old, what I feel is good enough reaction time from my side), will not help anybody. Thank you firebird76 (whatever your real name is) for realizing how people are stupid. PS: I use Mantis bug tracker, which I believe does not expose email addresses to anyone besides privileged users.

Recently spent three days playing poker, watching movies and drinking beer (we call that military service in Switzerland.) Layer Cake: Fun, somewhere in the vicinity of Betelgeuse^W Pulp Fiction or Lock, Stock and Two Smoking Barrels (Hmm. Why am I not surprised that Matthew Vaughn was also involved in the latter? I need to pay more attention to the names of directors and producers.) Also watched Meaning of Life one more time, no comment needed, I guess. Started watching Man on Fire (2004, by Tony Scott) but went to bed before the action really started, so I can't comment on it. Discussed modern (fast-paced, nervous etc.) moviemaking which reminded me that I should mention (Russian Ark) as a counter-example: the whole movie is one single 90 min long steadicam shot.

SE Linux has a utility named restorecon to set (or reset) the security context. This is useful for many reasons, corrupted filesystems, users removing files or changing the context in inappropriate ways, and for re-creating files from tar files or backup programs that don’t restore SE Linux contexts. It can also be used to report the files that have different contexts to that which would be set by restorecon to verify the contexts of files. Restorecon determines the context from two sources of data, one is the policy that came with the system (including any policy modules from other sources which were loaded) and the other is the local file contexts that were created by semanage. It’s a pity that there doesn’t seem to be an equivalent program for Unix permissions. rpm has a -V option to verify the files from a package and dpkg doesn’t seem to have an option to perform a similar operation (/var/lib/dpkg/info/* doesn’t seem to have the necessary data). But even on an RPM based system this isn’t possible because there is no way to add local files into the list. I would like to be able to specify that an RPM system should have root:root as the owner and permission mode 0755 for all files matching /usr/local/bin/* and use a single command to check the RPM database as well as this extra data for the permissions of all files. Does anyone know of any work in this area? I’m going to file Debian and Fedora bug reports about this, but I would appreciate any comments first. Update: Here is an example of how this feature works in rpm:
# rpm -Vv nash
…….. /sbin/nash
…….. d /usr/share/man/man8/nash.8.gz
# chmod 700 /sbin/nash
# rpm -Vv nash
.M…… /sbin/nash
…….. d /usr/share/man/man8/nash.8.gz The “M” character indicates that the permission mode of the file does not match the RPM. There is no way to automatically correct it (AFAIK) but at least we know that something changed. With Debian AFAIK it’s only possible to verify file checksums not the permission.

Share This

Today I have been to the "Bourne Ultimatum". I bought myself the first and second part on DVD just recently to remind myself of what was going on, I even planed to watch it with some dear friends but all I received were meaningless promises, and before it stops screening I went on my own—just to stumble upon an old friend in the cinema who was going to watch the movie himself with his brother. Anyway, I was really looking forward to this part, given that I really enjoyed the former two parts—and I wasn't disappointed at all. It is a really worthy final part of this trilogy. Julia Stiles had a bit bigger part in this one which was an added enjoyable addition, and the scenes in Madrid were really quite thrilling. All thumbs up!