Search Results: "spa"

31 July 2008

Jaldhar Vyas: Don't Copy That Colloquoy

It seems I have been wrong about the origins of the Seville Orange joke Rather than Algernon Sidney It would appear to have been quipped by an 18th century Anglo-Irish actor named James Quin as recounted in "Lives of the Players" by John Galt (not that John Galt but this one) in 1831.
Quin once, in the character of Cato, received a blow in his face by an orange thrown from the upper gallery; such a circumstance would have disconcerted many an actor possessed of less presence of mind, but instead of being disturbed, he wiped his face, and taking it up, observed, "It was not a Seville orange."
A proto-version of the joke does date back to Sidney's time. It was made by none less than William Shakespeare in "Much Ado About Nothing" Act II, Scene 1:
DON PEDRO: Why, how now, count! wherefore are you sad?
CLAUDIO: Not sad, my lord.
DON PEDRO: How then? Sick?
CLAUDIO: Neither, my lord.
BEATRICE: The count is neither sad, nor sick, nor merry, nor well; but civil count, civil as an orange, and something of that jealous complexion.
Note Don Pedro is from Aragon which is close enough to Seville for Elizabethan comedy purposes. But while 300+ years is impressive, this joke from Sumeria c. 19th-16th centuries BC is older by far:
Something which has never occurred since time immemorial: a young woman did not fart in her husband's lap.
See The world's ten oldest jokes

Jacobo Tarrío Barreiro: Translating debconf templates

You can approach debconf translation work in two ways: you can be active and seek out packages to translate and update, or you can be reactive and translate and update packages when someone requests it to be done. Usually, nobody takes a purely active or reactive stance; for example, lately I used to react to calls for translation updates, but when I had some spare time I would go translate a couple of new packages. When you work actively, the web page whose URL you need to know is http://www.debian.org/intl/l10n/po-debconf/. There you have links to all languages for which there are translations. Click on yours, and you’ll see a page listing the state of every source package’s debconf template translations for your language. First, you see the partially-translated packages, then the fully translated packages, and finally a list of packages which are not translated to your language. For each package in the first two sections you can download the .POT and .PO files; the names of the packages in the last section just link to a big webpage from which you can download every package’s .POT file. In the top part of the page you have links to other useful pages. An interesting one is the ranking page, which lists all the languages in order of completeness. For working reactively, you need to subscribe to the debian-i18n mailing list, because when there is a call for updates or for translations it is always sent to that mailing list. Also, if there already is a translation for your language, another email will be sent to the translation group’s mailing list, as well as to the file’s latest translator. Calls for translations include information on the deadline and the package maintainer’s preferred methods for submitting the translation. There may also be some notes from the package maintainer. Finally, the .POT file is attached to the call for translations sent to debian-i18n, while the old .PO file is attached to the call for translations sent to the group and the latest translator. Calls for translations can be sent by the package maintainer when the debconf templates have been modified and the translations need to be updated, but they can also be sent by other people for many other reasons. For example, for the last months there’s been a campaign to upload packages for which there were newer translations that hadn’t been uploaded yet, so NMUs for these packages (non-maintainer uploads) were announced, including a call for translations. Also, there was a campaign to review all packages’ debconf templates, make them more consistent, improve their grammar, etc., and a call for translations was issued for every package after the review.

Joerg Jaspert: Yet another Argentina post :)

And here, yet another Argentina post before I have to do some work again (like the Entrance Controller needs some love). This time with pictures! :) You can have pretty nice desserts in BA, as this picture with Mark on it proves. mhy_ice.jpg I think he will really love me for this post. Really. (It wasn’t actually his dessert :) ).
Anyways, this morning we took the opportunity walking over to see the Atlantic Ocean. Damn long way, proven by the next picture (the building marked with that arrow is our Hotel, us standing right beside the beach). dora.jpg Fun thing - Mark was walking outside with a T-Shirt only, while all those Argentinian people use winter clothes. Got him quite a bit of weird looks from all of them. :) Right now we are back, sitting in the first prepared hacklab. hacklab.jpg Yes, those grey things below the tables are for cabling, so there is a lot of power outlets, should be enough for everybody to get power, without doing long daisy chains. Comments: 1

30 July 2008

Matthew Garrett

The Linux Plumbers Call for Papers is open for another day or so. It's looking like we'll have an excellent spread of interesting power management topics, but if you've got anything interesting to say then throw it forward. We're looking for kernel issues that have an impact on userspace, userspace issues that need kernel support and anything else that involves the interesting interactions between the two.


Hats for everyone and cab it to the Gold Club

San Francisco has been somewhat hectic, but yesterday included a quick trip to the office to discuss community involvement in improving power management. Look forward to developments there. Independently, I now join Brian the guy who had been clean too long to get onto the drugs rehab program (hurrah voicemail) in being an ex-owner of my US phone number. Probably best to delete it if you have it.

In other news, Foxconn are sending me a board with the "controversial" AMI BIOS in order to figure out what's going on. Progress by this time next week, with luck.

Pablo Lorenzzoni: DNS mess and what I think about DNSSEC

I am following closely this new DNS mess. In fact, there s nothing really new in that. DNS has been attacked lots of times over the years as a result of not being designed with security in mind from the ground up -, just this new one is a combination of known attacks against known security flaws. The quick fix is not a real fix, and just incorporate old ideas into the most used DNS software, strengthening it to face the attack. The details leaked, and there s already at least one public exploit (and who knows how many in the wild). The new buzzword is DNSSEC. I don t like DNSSEC. I never did. The first time I heard of it, around year 2001, it was a centralization of a decentralized database: A proposed company (called Network Solutions) would serve as a central authority, signing every root DNS entry. It was a joke! Come on! DNS is suppose to be decentralized! Having a central company anywhere is just a huge step back in decentralization (not to mention a huge step back in security). Time passed, and the DNSSEC specs evolved to a more decentralized way of thinking. The state it is now, and the implementations we saw so far are not good. No! I am not talking about security I am talking about the KISS principle: DNSSEC turns something really simple to deploy into a full-time job, with frequent key roll-overs and re-signing everytime you change the zone a huge mess! Yes, there are automated tools, but, come on! you still have to wait for TTL to expire before publishing this part or that part of the cryptographic machinery And, if we are talking about real security, are we going to build some automated tool fire-and-forget -style and not follow it? If we are not looking at it as it goes, and it fails, we could end up with a completely wrong set-up or (even worse) a non-validating zone. And I haven t yet mentioned the increase in payload I am not completely convinced that this alone would not lead to DoS attacks just by compromising the responsiveness of the servers (and DoS attacks are already available for quite some time maybe the DNSSEC-medicine is worse than the disease ). The root ( . ) servers are not even DNSSEC-aware, and there s a whole class of other stuff to work-around the fact that they may not be DNSSEC-aware for quite some time yet. There has to be a simpler way! I can imagine at least three ways to fix the problem until we can fix DNS in a KISS way And they re all KISS also: Maybe some of those three solutions are flawed Maybe none are flawed and can be deployed together Maybe I am wrong and DNSSEC is the only way to go But let s not panic, let s cool our minds and begin thinking it through. I still don t think DNSSEC is the holy grail Now I already spent more time than intended on this let me go back signing some zones ;-)

29 July 2008

Russell Coker: Variable Names

For a long time I have opposed single letter variable names. Often I see code which has a variable for a fixed purpose with a single letter name, EG “FILE *f;“, the problem with this is that unless you choose a letter such as ‘z‘ which has a high scrabble score (and probably no relation to what your program is doing) then it will occur in other variable names and in reserved words for the language in question. As a significant part of the time spent coding will involve reading code so even for programmers working on a project a useful amount of time can be saved by using variable names that can easily by found by a search program. Often it’s necessary to read source code to understand what a system does - so that is code reading without writing. With most editors and file viewing tools searching for a variable with a single character name in a function (or source file for a global variable) is going to be difficult. Automated searching is mostly useless, probably the best option is to have your editor highlight every instance and visually scan for the ones with are not surrounded by brackets, braces, parenthesis, spaces, commas, or whatever else is not acceptable in a variable name in the language in question. Of course if you have a syntax highlighting editor then it might parse enough of the language to avoid this. But the heavier editors are not always available. Often I edit code on the system where the crash occurs (it makes it easier to run a debugger). Installing one of the heavier editors is often not an option for such a task (the vim-full Debian/Lenny package for AMD64 has dependencies that involve 27M of packages files to download and would take 100M of disk space to install quite a lot to ask if you just want to edit a single source file). Incidentally I am interested in suggestions for the best combination of features and space in a vi clone (color syntax highlighting is a feature I desire). But even if you have a fancy editor, there is still the issue of using tools such as less and grep to find uses of variables. Of course for some uses (such as a loop counter) there is little benefit in using grep. Another issue to consider is the language. If you write in Perl then a search for \$i should work reasonably well. One of the greatest uses of single letter variable names is the ‘i‘ and ‘j‘ names for loop counters. In the early days of computing FORTRAN was the only compiled language suitable for scientific tasks and it had no explicit way of declaring variables, if a variable name started with i, j, k, l, m, or n then it was known to be an integer. So i became the commonly used name for a loop counter (the first short integer variable name). That habit has been passed on through the years so now many people who have never heard of FORTRAN use i as the name for a loop counter and j as the name for the inner loop in nested loops. [I couldn't find a good reference for FORTRAN history - I'll update this post if someone can find one.] But it seems to me that using idx, index, or even names such as item_count which might refer to the meaning of the program might be more efficient overall. Searching for instances of i in a program is going to be difficult at the best of times, even without having multiple loops (either in separate functions or in the same function) with the same variable name. So if there is to be a policy for variable names for counters, I think that it makes most sense to have multiple letters in all variable names to allow for easy grepping, and to have counter names which apply to what is being counted. Some effort to give different index names to different for/while loops would make sense too. Having two different for loops with a counter named index is going to make things more difficult for someone who reads the code. Of course there are situations where two loops should have the same variable, for example if one loop searches through an array to find a particular item and then the next loop goes backward through the array to perform some operation on all preceding items then it makes sense to use the same variable.

Adrian von Bidder: KDE 4.1

A while ago I decided that my desktop computer would be a test platform for a few things. So at the moment it's KDE 4.1 and OpenOffice.org 3.0 beta, both from Debian's experimental distribution. Which, on a system which originally was an installation of Debian etch, means that by now not much is left over from that etch system. Long live Debian's dependency handling, which so far has never really let me down! Conclusion: thankfully I have a laptop for actually doing stuff... I should probably add that this is not a rant. I'm running software that's explicitly labelled as experimental. So people should probably view this as a response to whoever (can't find it anymore, wasn't it on Planet?) recently stated that he'd switch to the Hurd since Debian has become boring. Or as a Thank You posting for those making Debian from a “you know it's been the stable version for the last year when it's entered Debian” type of distribution into a “get it on the day of release” distribution.

27 July 2008

Jeff Bailey: I'm off the drugs


drugs
Originally uploaded by jbailey
Well, tomorrow will be one week since my last of the prescription drugs, and the last Tylenol I had was on Tuesday. I think I'm finally free of these damned things.

It's worth noting that these bottles aren't all empty, but this doesn't include the ones given to me in the hospital, the various stomach things I had to take so that the steroids didn't hurt me, and the various bottles of Tylenol that I lost from being such a basket case (Everyone, especially Angie, has been so patient with me with the mood swings, the memory holes, etc. Thank-you so much!) Based on this, I'm assuming that the count probably evens out. I totalled the number of pills in these bottles: 1333.

I've heard that there's an org, "Doctors Without Borders" to which I can donate the ones that I will definitely not need again, like the steroids and such. I'll hunt them down soon.

Next update: Tuesday. I get to see the surgeon again and my movement restrictions are expected to be lifted. That means the only other visit is to the oncologist who *still* after 5 months can't manage to schedule an appointment with me. They're the ones who finally phoned a week ago to schedule one. I wanted to check with my surgeon on something, and when I went to phone them back, their call display number isn't valid. They were supposed to phone me back anyway, but I also asked my surgeon's practice coordinator to arrange it for me. Still nothing. *sigh* I'm going to take the opportunity at the hospital to go talk to them in person to see if I can get things moving. We're still at the stage where noone expects anything, but they want the tests to make sure that's actually the case.

Still, I'm excited to be this far. It's nice to finally feel like I'm thinking somewhat more clearly now.

Russell Coker: New Net Connections

On Thursday my new InterNode ADSL2+ service was connected [1]. I needed to get a connection with a larger download cap and a better upload speed because one of my clients wants me to transfer some significant amounts of data as well as hosting some Xen DomU’s for him. Strangely InterNode couldn’t offer a regular ADSL service but could offer Naked DSL (which means DSL without a phone service on the same pair of wires). So I now have Naked ADSL 2+[2] although unfortunately the line speed is reported as being 8263/814 Kbps - ADSL2 speed. For the moment this will do, but I’ll investigate the possibility of improving this eventually. Another strange thing about this is that Optus is the carrier for the ADSL line, Telstra is the monopoly telco with the vast majority of local-loop copper pairs so it’s surprising that I end up with Optus owning my copper - the wires in question were used by the previous owner of my house for a Telstra connection! On Friday I converted my network to using the new ADSL link and on Saturday I got my SE Linux Play Machine online again [3]. I could have managed the transition without ~20 hours of down-time for the Play Machine, but as I only get a few logins per day it didn’t seem to be worth the effort of rushing it. Also on Friday I got a new 3G modem from Three [4]. They advertise that the USB or PC-Card modem will cost $5 per month on a 24 month plan, but when I ordered it I discovered that as I have an existing mobile phone plan with them the $5 per month is waived. So all that I have to pay is $15 per month for a 1GB data allowance (which is about the best deal available). A client is paying for this so that I can provide remote support for his network. I had previously written about my search for an ideal mobile SSH client [5], I ended up getting an EeePC 701 which cost $300, an 8G SD card and 8G USB stick (for expanding the internal storage and for moving files around respectively) which cost $83, and now $15 per month over 24 months for net access. That gives a total of $743 for two years of mobile net access. This compares well to the $960 that an iPhone would cost over two years and provides a lot more utility (while admittedly not fitting into a pocket). Dave Hall [6] gave me a lot of great advice about selecting and using 3G modems. He recommended that I get the E220 modem as it’s easy to configure (mine was easy on Debian/Lenny but didn’t work with a Debian/Etch kernel as the necessary driver was not available). Three also sells another model the E169G which is apparently tricky to set up. There was one mistake made in the design of the E220, the cable is installed in such a way that the LED which indicates connection status is going to be face-down when connected to almost any laptop which has horizontally mounted USB ports (which includes all the thinner ones). Here is the PPP chatscript for use with an E220 modem (suggested file name /etc/chatscripts/three):

ABORT 'BUSY'
ABORT 'NO CARRIER'
ABORT 'ERROR'
'' AT
OK ATQ0V1E1S0=0&C1&D2+FCLASS=0
OK 'AT+COPS=0,0,"3TELSTRA",2'
OK AT+CGATT=1
OK AT+CGDCONT=1,"IP","3netaccess"
OK ATDT*99**3# Here is the ppp configuration file which references the above chatscript:
/dev/ttyUSB0
230400
noauth
defaultroute
usepeerdns connect "/usr/sbin/chat -v -f /etc/chatscripts/three"

26 July 2008

Matthew Garrett: Further Foxconn fun

Ryan kindly sent me a copy of the ACPI tables for his motherboard, so I've had the opportunity to look at them in a little more detail. There's nothing especially surprising. The first method of interest is OSFL, which I've annotated below:
   Method (OSFL, 0, NotSerialized)
     
        If (LNotEqual (OSVR, Ones))
         
            Return (OSVR)
         
This block simply skips the checks if they've already been evaluated and returns the cached value
        If (LEqual (PICM, Zero))
         
            Store (0xAC, DBG8)
         
If the programmable interrupt controller has been set up in PIC mode rather than APIC mode, 0xAC is written to i/o port 0x80. This would then show up on a plug-in card if one were attached. Simply debug code
        Store (One, OSVR)
Set OSVR to 1, which in this case clearly means "Unknown OS"
        If (CondRefOf (_OSI, Local1))
This checks whether the OS supports the _OSI method. If it does, the following block is executed. If not, the older _OS method is used to detect the OS
         
            If (_OSI ("Windows 2000"))
             
                Store (0x04, OSVR)
             
Newer versions of Windows will also claim to support the interfaces defined in older versions, so this set of checks is done in release order
            If (_OSI ("Windows 2001"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP2"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2006"))
             
                Store (Zero, OSVR)
             
If we've got this far, OSVR is now set to 0. Linux will claim to support all of these interfaces, and so OSVR should be 0 on Linux systems. Note that there is no _OSI check for Linux - the 2.6.24 change to remove Linux from the set of claimed interfaces is therefore irrelevant
         
        Else
         
Linux supports _OSI, so we should never be here. But if we somehow are...
            If (MCTH (_OS, "Microsoft Windows NT"))
             
                Store (0x04, OSVR)
             
Linux has responded to _OS with "Microsoft Windows NT" since 2.6.9. MCTH is simply a string matching routine defined elsewhere in the DSDT. So, worst case here is that OSVR is 4
            Else
             
                If (MCTH (_OS, "Microsoft WindowsME: Millennium Edition"))
                 
                    Store (0x02, OSVR)
                 
                If (MCTH (_OS, "Linux"))
                 
                    Store (0x03, OSVR)
                 
..because this could never be true unless you're running 2.6.8.1 or earlier. But even so, getting here would still indicate failure - we've supported _OSI since before then, and so should never come anywhere near this code block.
             
         
        Return (OSVR)
     
In summary, we end up with the following values:
ValueOS
0Windows XP, 2003 or Vista. Linux (assuming absence of bugs)
1Unknown OS
2Windows ME
3A version of Linux that doesn't implement _OSI and is from before 2.6.9
4Windows NT 4 and 2000. A version of Linux that doesn't implement _OSI and is 2.6.9 or later (I don't believe any such version exists

Now, where is this used? The majority of the OSFL checks only check whether the return value is 1 or 2, which will only be true for an OS that (a) doesn't claim to be Windows or (b) is Windows ME. Linux doesn't fall into either of these categories, so we can ignore them. The first interesting hit we have is in the HPET code, where _STA will return 0xf (device present and working) if OSFL is 0 and 0xb (device present and working, but should not be shown in the UI) otherwise. This is just to keep the HPET from showing up in versions of Windows that don't know what it is. The only other interesting hit is the following code from the PCI bus initialisation pathway:
 
                               If (LEqual (OSFL (), Zero))
                                 
                                    Store (0x59, SMIC)
                                 
                                Else
                                 
                                    If (LEqual (OSFL (), 0x04))
                                     
                                        Store (0x5A, SMIC)
                                     
                                    Else
                                     
                                        Store (0x58, SMIC)
                                     
                                 
This writes different values to SMIC (which turns out to be i/o port 0xb2) depending on the OS. 0xb2 is the standard(ish) way to trigger a system management interrupt, which causes the CPU to execute some code from a memory region that can't be accessed by the OS. This isn't that unusual, but it's a little weird. In any case, note that there's no check for whether OSFL is 3 here (which would be true if the _OS call returned Linux), and so Linux is being treated identically to Windows ME and any unknown OS. In reality, Linux will be treated identically to either Vista or 2000. This block provides no evidence of conspiracy. Finally, the OS version flag is written to a region of memory before suspend and read back afterwards. Nothing appears to be done with this information - it's conceivable that the low-level resume code in the BIOS has conditionals based on this, but I suspect that it's just boilerplate code that's ignored.

To summarise:What's the problem, then? I've no idea. The only "significant" issue is that the OEMB table provided by the BIOS has an incorrect checksum. Given that the OEMB table is never used by Linux (it's a vendor extension of some kind, with the best hint I've been able to find being that it can be used to pass information from the BIOS to the OS - kind of like the rest of ACPI, then...), this is pretty unimportant. And given that the OEMB table isn't part of the ACPI spec, it's certainly entirely irrelevant when it comes to determining whether the system is ACPI compliant or not.

Are there ACPI issues with Ryan's system? It sounds like it. The "Error attaching device data" complaints indicate some kind of failure on the part of the kernel to work out how the devices correspond to the ACPI namespace, but I strongly suspect that this is a Linux bug. Failure to reboot after suspend? Could be anything (I'd need direct access to the hardware to figure it out properly), but again it's almost certainly a Linux bug. The standard way Linux reboots systems is to bang the keyboard controller, and it's conceivable that something we're doing on resume is leaving the keyboard controller in a slightly confused state. We're clearly doing something wrong there, given that my Dell comes up without a keyboard about one resume in twenty - I just haven't had time to look into it yet.

The only remaining thing is the mutex handwaving. I've got no clue what's going on there. Ryan's suggested change (from Acquire (MUTE, 0x03E8) to Acquire (MUTE, 0xFFFF)) simply means that the OS will wait forever until it acquires the mutex - in the past it would only wait a second. The reason the compiler generates a warning here is that the firmware never checks whether it acquired the mutex or not! Bumping the timeout to infinity obviously fixes this warning (there's no need to check the return code if you're happy to wait forever rather than failing), but the original code is merely stupid as opposed to a spec violation.

Take home messages? There's no evidence whatsoever that the BIOS is deliberately targeting Linux. There's also no obvious spec violations, but some further investigation would be required to determine for sure whether the runtime errors are due to a Linux bug or a firmware bug. Ryan's modifications should result in precisely no reasonable functional change to the firmware (if it's ever hitting the mutex timeout, something has already gone horribly wrong), and if they do then it's because Linux isn't working as it's intended to. I can't find any way in which the code Foxconn are shipping is worse than any other typical vendor. This entire controversy is entirely unjustified.

Philipp Kern: Stable Point Release: Etch 4.0r4 (aka etchnhalf)

Another point release for Etch has been done; now it's the time for the CD team to roll out new images after the next mirror pulse. The official announcements (prepared by Alexander Reichle-Schmehl, thanks!) will follow shortly afterwards. FTP master of the day was Joerg Jaspert, who did his first point release since Woody, as he told us on IRC. We appreciate your work and you spending your time that shortly before going to Argentina. This point release includes the etchnhalf update introducing a new kernel image (based on 2.6.24) and some driver updates. Additionally the infamous openssl hole will be fixed for good, even for new installs. Again I want to present you a list of people who contributed to this release. It cannot be complete as I got the information out of the Changed-by fields of the uploads. From the Release Team we had dann frazier (who drove the important kernel part of etchnhalf), Luk Claes, Neil McGovern, Andreas Barth, Martin Zobel-Helas and me working on it. ;-)

25 July 2008

Jordi Mallach: Cinema de Barri in Benimaclet

Last summer we tried to organise a Cinema d'estiu movie projections in Benimaclet's Church Square, in an attempt to promote social activities in the street done by the neighbours, for the neighbours. The response was very positive, and the first two projections attracted many people, who would bring a chair and their dinner to the old town's square to watch a movie. Unfortunately, the authorities, who were completely out of the loop, weren't happy and on the 3rd week the Local police appeared and said that that kind of activities needed official permits, and disallowed the projection. For this year's summer, we decided we'd try to do the projections once again, and learned that only a legally-established organisation can do the paperwork to get an authorisation. In parallel, some neighbours of Benimaclet, who had liked last year's idea, were working on their own to repeat the experience, and somehow Clara was contacted by them, and we ended up collaborating. As these people are members of the Associaci de ve ns of Benimaclet, there were legally able to do the paperwork, and soon we agreed on the four movies for this year, to be played every Sunday of July at 22:00h. Our pick for Sunday 6th was Giuseppe Tornatore's Cinema Paradiso, followed on the 13th by Elling, a Norwegian comical drama by Petter N ss which I hadn't seen and I can totally recommend. Last week we saw Poniente, a Spanish film by Chus Guti rrez that focus on immigration issues in the South East of Spain, based on the racist happenings of El Ejido of 2000. Finally, next Sunday is the turn for some political action with V for Vendetta. A note for Benimaclet neighbours: if you don't come to see the movie, be aware that we plan to pump up the volume a lot for this one. You're definitely going to hear it from home. ;) We're very happy about the response of the neighbours this year. Not having done any effort to announce this around the city, except for a few posters around Benimaclet during the last week of June, people clearly remembered last year's experience and the pla a de Beni was full of chairs for all three weekends. It really helps to turn around during a projection and see so many people behind you participating in something you've invested some of your own time and money. It's probably too late now, but there's some talk of extending this to the Sundays in August, so we'll see. Also, we plan to do a picaeta for attendees as a small closing party for this year's cycle. See you on Sunday, and enjoy V!

Lior Kaplan: When LVM volume groups collide


I took my hard drive and connected it to another computer with Linux installed. Both HDs had a PV which contained a VG named “vg00″. This collistion was the first time I had encounterd this situation and had to solve it to get access to files on both VGs. During boot I noticed messages saying there two vg00 on the machine and one is taken precedence over the other. Example message:
[lvm] WARNING: Duplicate VG name vg00: Existing
K0qKAk-Ph5i-BcAX-y4yp-SPF3-TZgj-DufR3L (created here) takes precedence
over K0qKAk-Ph5i-BcAX-y4yp-SPF3-TZgj-DufR3L
The trivial solution is to rename the extra VG to something different and get the access I want to the files. But there are two problems:
  1. As the first vg00 has precedence, I can’t do actions on the second one. The LVM commands ignore the second one.
  2. I can’t act on the first VG as it’s active for most of the system’s file systems.
Trying vgrename command with the second VG UUID didn’t work. I had to deactivate the first VG first (luckily I have the root FS outside of LVM), rename it, and rename the second VG and then rename the first VG again. This resulted in having vg00 and vg01. And now I could activate them both and access the files. I hope to have the time to reproduce the problem on another distro to make sure that’s a general LVM2 problem. Having renmae by UUID would save time to fix the problem and help people who need to boot from CD just to get their VG deactivated (since root FS is on LVM).

24 July 2008

Steve Kemp: I think I'll take this back

KVM Utility
Gunnar Wolf made an interesting post about KVM today which is timely. He points to a simple shell script for managing running instances of KVM which was a big improvement on mine - and so is worth a look if you're doing that stuff yourself. Once I find time I will document my reasons for changing from Xen to KVM, but barring a few irritations I'm liking it a lot.
Chronicle Theme Update
I made a new release of the chronicle blog compiler yesterday, mostly to update one of the themes. That was for purely selfish reasons as I've taken the time to update the antispam protection site I'm maintaining. There have been some nice changes to make it scale more and now it is time for me to make it look prettier. (A common theme - I'm very bad at doing website design.) So now the site blog matches the real site.
ObQuote: Resident Evil

Joey Hess: disturbing thought

So for those of you who arn't aware, as of yesterday, it's easy for any spotty teenager/script kiddie to make you see content you didn't expect to when you go to google or your bank, etc. Maybe you're lucky and someone has fixed the problem on your network. Most likely you're not so lucky. (Confidential to Anna, Maggie, Adrianne, Errol, Barbara, Mark: You're lucky! But only when you're at home.) At the moment, the idea that DNS can be trivially poisoned seems like a really serious problem. Will there come to be a point when we just regard this as "DNS spam", basically accepting that it's happening all the time, indeed that a given DNS query is as likely spoofed than good, and nothing can be trusted, or indeed, fixed? If you don't think this can happen to a internet techology, just look at the average inbox now, and compare it to the average inbox circa 1993. I can't claim to be an expert in this area, but based on what I'm reading, the current "fix" increases the time-to-exploit from 11 seconds to maybe 1 week. (BTW, is there a reason why DNS servers are caching in-baliwick responses.. would it work to entirely disable that caching? Any chance for a second round of more targeted fixes now that the cat is out of the bag?) Also, I get the impression DNSSEC will never be successfully deployed, barring a miracle. And we seem to have just run out of miracles.

Joey Hess: disturbing thought

So for those of you who arn't aware, as of yesterday, it's easy for any spotty teenager/script kiddie to make you see content you didn't expect to when you go to google or your bank, etc. Maybe you're lucky and someone has fixed the problem on your network. Most likely you're not so lucky. (Confidential to Anna, Maggie, Adrianne, Errol, Barbara, Mark: You're lucky! But only when you're at home.) At the moment, the idea that DNS can be trivially poisoned seems like a really serious problem. Will there come to be a point when we just regard this as "DNS spam", basically accepting that it's happening all the time, indeed that a given DNS query is as likely spoofed than good, and nothing can be trusted, or indeed, fixed? If you don't think this can happen to a internet techology, just look at the average inbox now, and compare it to the average inbox circa 1993. I can't claim to be an expert in this area, but based on what I'm reading, the current "fix" increases the time-to-exploit from 11 seconds to maybe 1 week. (BTW, is there a reason why DNS servers are caching in-baliwick responses.. would it work to entirely disable that caching? Any chance for a second round of more targeted fixes now that the cat is out of the bag?) Also, I get the impression DNSSEC will never be successfully deployed, barring a miracle. And we seem to have just run out of miracles.

David Moreno Garza: July 24th, 1958

Today, fifty years ago, my mother was born.

On July 24th, 1958, Vicenta Leyva gave birth to Olga Cristina Garza Leyva in the small town of Zumpango del R o (later renamed to Eduardo Neri), in the southern Mexican state of Guerrero. Her father Guillermo Garza, who is still alive, was a private pilot. Olga Cristina was named Cristina after the saint that is celebrated on the same day.

She was their third kid, a couple of years before V ctor and Guillermo were born and a couple of years after, Carlos was born, all of them being born on total different places on southern and central Mexico. The father, being a pilot, was absent from home for long periods, he even had "another family" somewhere in northern Mexico, supposedly in Sinaloa.

In the early 60s, the family moved to Mexico City where they were going to spend most of their life. They lived on a small apartment on Col. Moctezuma, which was (and still is) a working class neighborhood, just besides the Mexico City International Airport, on the eastern part of the city. Back in the days, it used to take quite some time to travel from there to any point of the city, like the downtown area or beyond.

All the kids spent most of their childhood there attending public schools. They weren't a wealthy family who couldn't even afford to buy and have meat on some days but only in special ocassions.

As the years passed and the kids became adults, Olga met David Moreno Rojas in the same neighborhood. He was enrolled at the National Autonomous University of Mexico, under Enterprises Administration in Ciudad Universitaria. He was also an avid f tbol player. He was named David after his father, David Moreno Gonz lez. They became boyfriend and girlfriend and got married when she was 20 and he was 24 years old on December 19th, 1978. They lived together for a few years in Col. Del Valle in central Mexico City.

Ten months later they were married, Lorena Moreno Garza, their first kid, was born on October 7th, 1979. S The family then moved to the suburb in Aragon, Estado de M xico. They had their second child on August 8th, 1984, named David Moreno Garza, becoming David III.

After the 1985 Mexico City massive earthquake, the family wanted to move outside the city and found relocation in Ciudad del Carmen, on the Mexican state of Campeche, located on the shore of the Gulf of Mexico, on 1988. They spent three or four years there and then moved to Celaya, Guanajuato where most of the father's family was located. They spent about five years there and then, for family reasons, they returned to Mexico City in 1995 to attend the family business.

Olga and her family had a good, loving family by then and had decided to not have any more kids. They had both of their children on private schools and taught them catholicism. On 1998, Vicenta passed away after a quick period of time because of liver cancer. This shocked most of the family.

As the years passed, the family business was sold and Olga stopped working, as she used to in the business. But as she had always been very active, she started working as a seller for a fine jewelry firm where she keeps working currently. Her husband, after pursuing his dream of going back to school and studying Law, works as a private work-related issues lawyer.

Olga is the most loving, nursing, affective, meticulous, scrupulous person I've ever met and even though I have only met her for almost twenty-four of her fifty years now, I admire her and love her as much as I have no words to describe. She is the one that built my sensitive, loving side where my heart resides, and I thank God for giving me such a great life gift and having her at any time.

mama.jpg

Today, her husband is 54, her daughter is 28, her son is 23 and she is 50 now. This is also an special year because she and her husband will celebrate 30 years of their marriage.

mamaypapa.jpg
Felicidades, jefecita.

Russell Coker: SE Linux Policy Loading

One of the most significant tasks performed by a SE Linux system is loading the “policy“. The policy is the set of rules which determine what actions are permitted by each domain. When I first started using SE Linux (in 2001) the kernel knew where to find the policy file and would just read the data from disk as soon as it had mounted the root filesystem. Doing such things is generally considered to be a bad idea, but it was an acceptable mechanism for an early release. One issue is that the policy needs to be loaded very early in the system boot process, before anything significant happens. In the early days the design of SE Linux had no support for a process to change it’s security context other than by executing another process (similar to the way a non-root process in the Unix access control system can not change it’s UID, GID, or groups). Although later on support for this was added, it was only available as the request of the application (an external process could not change the context of an application without using ptrace - a concept that is too horrible to contemplate) and I am not aware of anyone actually using it. So it’s almost a requirement that there be no more than one active process in the system at the time that policy is loaded, therefore it must be init or something before init that loads the policy. When it was decided that a user-space program had to instruct the kernel to load the policy we had to determine which program should do it and when it should be done, with the constraint that it had to be done early. The most obvious solution to this problem was to load the policy in the initramfs (or initrd as it was known at the time). One problem with this is that the initramfs is limited in size by kernel compilation options and may need to be recompiled to fit a bigger policy. As an experiment to work around this limitation I had a small policy (which covered the domains for init and the scripts needed for the early stages for system boot) loaded in the initramfs and then later in the boot process (some time after the root filesystem was mounted read/write) the full policy was loaded. A more serious problem with including policy in the initramfs was that it required rebuilding the initramfs every time the policy changed in a significant way, of course scripts could not determine when a change was significant (neither could most users) so that required needless rebuilds (which wastes time). Even with a small policy for early booting loaded it was still sometimes necessary to change it and update the initramfs. I believe that as a general rule an initramfs should only be rebuilt when a new kernel is installed or when a radical change is made to the boot process (EG moving from single disk to software RAID, changing between AMD and Intel CPU architecture, changing SCSI controller, or anything else that would make the old initramfs not boot the machine). The initramfs that was used to boot my machine is known to actually work, the same can not be said for any new initramfs that I might generate. But the deciding factor for me was support of machines that did not use an initramfs or initrd (such as the Cobalt machines [1] I own). To solve these problems I first experimented with a wrapper for init. The idea was to divert the real init to another file name (or use the init= kernel command-line option) and then have the wrapper load the policy before running the real init. I never intended that to be a real solution, just to demonstrate a point. Once I had proven that it was possible to load the policy from user-space before running the real init program it was a small step to patch init to do this. One slightly tricky aspect of this was in getting the correct security context for init. The policy has always been written to allow a domain transition from kernel_t to init_t when a file of type init_exec_t is executed. The domain kernel_t is applied to all active processes (including kernel threads) at the time the policy is loaded. So init only has to re-exec itself to get the correct context. Fortunately init is designed to do this in the case of an upgrade so this was easy to manage. Since that time every implementation of SE Linux apart from some embedded systems has used init to load the policy. The latest trend in Linux distributions seems to be using upstart [2] as a replacement for the old SysV Init. The Fedora developers decided to make nash (a program that comes from the mkinitrd source tree in Fedora and is a utility program for a Red Hat based initramfs) load the SE Linux policy as it would apparently be painful to patch every init to load the policy. As far as I am aware there are only three different init programs in common use in Linux, the old SysV Init (which used to be used by everyone), Busybox (for rescuing broken systems and for embedded systems), and now Upstart (used by Ubuntu and Red Hat since Fedora 9). Embedded systems need to work differently to other systems in many ways (having the one Busybox program supply the equivalent to most coreutils in one binary is actually a small difference compared to the other things), and modifying the policy load process for embedded systems is trivial compared to all the other SE Linux work needed to get an embedded system working well. There are at least two commonly used initramfs systems (the Debian and Red Hat ones) and probably others. As one init system (SysV Init) already has SE Linux support it seems that only one needs to be patched to have complete coverage. I’ve just written a patch for Upstart (based on the version in Debian/Experimental) and sent it to an Ubuntu developer who’s interested in such things. I also volunteer to patch any other init system that is included in Debian (I am aware of minit and will patch it as soon as it’s description does not include “this package is experimental and not easy to install and use“). It seems to me that repeating the work which was done for SysV Init and upstart for any other init system will be little effort, at worst no greater than patching an initramfs systems (and I’ll do it). As the number of initramfs systems that would need to be patched would exceed the number of init systems it seems that less work is involved in patching the init systems. The amount of RAM required by the initramfs is in some situations a limitation on the use of a system, when I recently did some tests on swap performance by reducing the amount of RAM available to a Xen DomU [3] it was the initramfs that limited how small I could go. So adding extra code to the initramfs is not desired. While this will be a small amount of code in some situations (when I patched /sbin/init from Upstart it took an extra 64 bytes of disk space on AMD64), dragging in the libraries can take a moderate amount of space (the fact that an LVM or encrypted root filesystem causes SE Linux libraries to be included in the initramfs is something that I consider to be a bug and plan to fix). Finally not all boot loaders support an initrd or initramfs. I believe that any decision which prevents using such sweet hardware as Cobalt Qube and Raq machines from being used with SE Linux is a mistake. I have both Qube and Raq machines running fine with Debian SE Linux and plan to continue making sure that Debian will support SE Linux on such hardware (and anything with similar features and limitations).

23 July 2008

Pablo Lorenzzoni: The new Brazilian Internet surveillance

Here I am writing today to tell something that might not be known outside Brazil at least, I haven t read much in English about it the attempt to turn the Internet into a government surveillance device. This story goes back to 2006 (and even back), when we first successfully blocked the approval of a bill that would, in effect, turn the Brazilian Internet into a giant Big Brother. This bill was introduced by Senator Eduardo Azeredo as a replacement to a series of other similar bills that were attempted before and was followed by a strong resistance by civil organizations, one of those being ASL, of which I am proud of being one of the founders. By that time we ended having it postponed for more debate. It happened that the bill made a come back last weeks, and was pushed into approval by a subcommittee of the Senate (one that was suppose to deal with the constitutionality of bills) and now is heading to the Chamber of Deputies for appreciation. Apart from the first debates back in 2006, nothing happened between then and the approval. The bill have changed a little bit, but not much as to change its effects. In Brazil, we have two legislative houses, Federal Senate and Chamber of Deputies. If a Law Project is proposed by one, is revised by the other. So we have already lost 50% of the fight. Ronaldo Lemos, professor of Funda o Get lio Vargas (think about a Brazilian version of Harvard Law School ) have already stated how dangerous such a Law can be, once approved. In his own words: The wording of the law is too broad, and can be applied in several cases. The interpretation of what is a crime or not will be done by a criminal judge, who is used to deal with homicides and not with technology . Since its approval in Senate, several people have been putting together a resistance. Central to it is a Petition, hosted at Petition Online, that already holds 64-thousand signatures. One of the writers of that petition, Andr Lemos, a university professor and researcher, have said that the regular user will have the feeling of being watched, and not knowing if what he s doing in legal or not: For instance, if I disseminate a virus without knowing, will I be arrested? Can I exchange my files in P2P networks (my pictures, my musics, my text files) without asking for permission? How will the ISPs interpretate these exchanges? Can I copy a part of a text from a blog and paste it into mine? This law creates a feeling of insecurity and generalized fear . FGV s Center for Society and Technology have published an analysis of the Law Project, and have spotted a lot of problems in it. For instance: Thinking of how I can help, after sending an email to every Deputy whose email address I was able to get, I decided to translate the law into English (I also uploaded a version with indentation, since it s pretty hard to understand the whole law without it, if you re not used to), so the World can be made aware of what s going on in Brazil. I also just sent an email with it to EFF, asking for their help. Not that I think they can do much, but they surely will know one or two strings to pull in order to put more pressure on the Brazilian government. I also hope that, once this post reaches Planet Debian, even more people become aware of the issue. In a sense, this is an appeal for all the Freedom Culture lovers out there to take any actions they can to help us prevent this Law Project to become a Law. (In time, I d like to thank Alexandre Oliva, who revised the translation). Update (2008-07-23 11:50): Steve Langasek also revised the translation of the Law Project and I ve made a cherry-pick merge , which resulted in the version currently linked in the text above. Older version of the plain and the indented documents are still available. Thanks Steve!

MJ Ray: LugRadio Live Event Review, Part Web2.0


LUGRadioLive 2008 by sheilaellen (cc-by-2.0) One aspect I didn’t mention in the LugRadio Live Event Review was how old-fashioned it seemed in some ways. I guess I’ve got used to seeing conferences experimenting with various web2.0 toys like live-blogging, feedback walls and so on, or the excellent live video streaming of DebConfs, but it was a bit of a surprise to find myself the only person in the audience who connected to the IRC channel from the event. One possible reason for that was that the wireless network was a bit difficult, or at least that was what I was told. I felt quite smug with my 3G smartphone IRC client (which I’ll blog about later) until Rufus Pollock mentioned the 800+ patents involved in 3G. Damn - I guess I hate freedom. In one way, I guess it’s appropriate if the network wasn’t up to the task. Broken networks were a regular feature of early ALUG meetings, as the end of this email hints. Web2.0 was there a little bit. There was a facebook page (which I accidentally spammed while travelling to the event), flickr:lugradiolive and a twitter link of #lugradiolive - but how does that work? There’s no user called lugradiolive and you can’t have usernames containing # Update: twitter:#lugradiolive (thanks to Dave Briggs for the explanation in a comment). Anyway, seeing as there will be another LUG Radio Live, maybe we can arrange something more interactive but free-software-friendly for 2009? More reviews I’ve read: davee: Lugradio-in makes me feel good , Peter Cannon: The party’s over for LugRadio Live and No’: Lugradio Undead - but why aren’t more people writing about this event? There seemed to be enough there. Or are they out there but I’m just not seeing them?

Next.

Previous.