It’s nice to be able to count on friends across vendors. The two new Parted Team members, Joel Andres Granados Moreno and Bryn Reeves from Red Hat, has been working with me to solve the s390 error that was blocking Debian to move to latest parted release (1.8.8 up to now). They’ve had a hard time to identify the real problem and we helped each other for those past two weeks. That’s awesome to be able to share the work load and be able to get help to solve problems. Even more when this is done for a very important software like Parted. I do believe this is the way to go for Free Software projects… maybe others could learn from that? Cheers

A common rant against Launchpad is that it s closed: the code is proprietary, and Canonical doesn t give raw access to the data they collect via the interface. Anyway, other people have taken up this issue, and it s not the point of this post to do so. I ve heard two argument why Launchpad is closed: first, it s a test bed for a product, which Canonical hopes to market to commercial entities to manage their own release cycles. And second: it s purposely cross-project and tries to integrate and link between them. Thus, lots of instances of Launchpad would defeat the point. I ll address these points in turn, starting from the back: While I won t deny a pre-trend towards (back to) mainframe-like computing, with Google, Amazon, and others providing rent-a-computer-cycle services. In addition, environmental concerns cast clouds over the 400W heating appliance under your desk, which happens to run your word processor and browser when it doesn t lose track of its countless spare cycles. Yet, I maintain that centralised services, such as Launchpad are a thing of the past. If you ask me, Launchpad got it wrong, even though it s light years further than its predecessors. It features pleasant graphics and obviously has had lots of smart thinking and experience shoved into it, but it s still centralised. It might be a business case, but it s not what the world needs. We ve seen massive growth of decentralised approaches to classic services, from file sharing to version control, from number crunching to simple web browsing, and yet, there s Launchpad, single point of entry (and failure) to the world of data surrounding Free software (at least if you follow their vision). What we need is something as slick as Launchpad, and thousands of instances thereof, which all peer with each other, automatically. The information would automatically be mirrored wherever it s referenced, so the entire cloud would be highly-available and failure-proof. Obviously, this wouldn t render itself well to the (traditional) software business model Canonical seems to strive for, so they re unlikely to go down this route. But we could. It would be a non-competitor. Update: thanks for the copious feedback I ve received. Among them was a comment by [Elliot Murphy]](http://launchpad.net/~statik), who speaks of us and thus leads me to believe that he s part of the Launchpad team:

We re definitely listening, and we still have lots more improvements we want to make. Our goal is collaboration, not centralization: thats why we build bazaar, are working busily on doing two-way integration with other bug tracker systems, and are building the best API we can. Our goal in the team is to make it trivially easy for you to get all the data that you put into launchpad back out through the API, data portability is very important. There is no big evil business model, but it would be socially irresponsible if we did not work toward making launchpad self-sustaining. It has been a long road, but the launchpad team is steadily working toward a distributed model, one step at a time.

While it s definitely nice to hear that data portability is a concern to them, I don t see Debian using Launchpad without the ability to run it on our own servers. I m definitely curious to hear more about the distributed model the team is pursuing. I certainly don t have a problem with self-sustainability, but in the Free software world, I do wonder what that is supposed to achieve. Release early, release often, anyone? Update: Philip Newborough took up the issue and has received a number of noteworthy replies. It made me very happy that he sees my post as a rant about Launchpad which is not lambasting Canonical for their proprietary Launchpad software; I wasn t aiming for any lambasting. NP: Nine Inch Nails: Further Down the Spiral

When you're 5, you're living with your parents. If not, you're probably in an orphanage, waiting for adoptive parents. When you're 10, you're living with your parents. If you're not, something is very wrong. When you're 15, you're living with your parents—although you'd probably rather live elsewhere. When you're 20, you're most likely still living with your parents; but if you don't, that's nothing to be ashamed of. When you're 25, you've either moved out, are doing so, or are thinking about it. When you're 30 and you still live with your parents, you're pathetic. At least that's the way I look at it. As of today, I'm officially pathetic. Won't be for long, though—it's just taking slightly longer than initially expected to make the appartment habitable. Stuff left to do:

• Attach some plaster to one wall, closing the holes in it
• Paint that wall, and one other which had to be treated for water damage first
• Finish up the kitchen: attach doors, connect electricity, glue everything together, attach baseboards
• Close water pipe shafts again
• Actually move in

Except for the "connect electricity" bit and the final step, that should all be doable in about a day, if I hurry. It's about time.

Tonight, I converted the XML-Security-C package from Stanford's internal Subversion repository to Git and packaged 1.4.0, but unfortunately I can't upload yet because Xalan needs to be updated to build against the latest Xerces-C. (I'd NMU, but I should not be taking on more things right now.) This is the first of the three current Shibboleth packages, and I hope to tackle OpenSAML and Shibboleth SP tomorrow or Wednesday. An Alioth project for Shibboleth packaging now exists and the pkg-shibboleth-devel mailing list is being created. I've requested Git space on git.debian.org, and as soon as that's set up, I'll push the three existing repositories. Shibboleth 2.0 packaging will add at least three more packages (OpenSAML 2.0, Shibboleth SP 2.0, and another XML support library), possibly four if we have to package log4shib, but I still hope to use the standard log4cpp. And then there will be another couple of packages once the group packages the Shibboleth IdP and WAYF, which I hope someone with more Java experience can tackle. One of the main goals for getting this set up is so that people other than me can do more of the work so that I can work on other things. Like, for example, krb5 packaging. Bastian Blank started using the Kerberos server packages and posted a whole flurry of bugs, a couple of which are (somewhat arguably) RC, and I'm trying to absorb that and fix the ones I can ASAP. OpenLDAP is in desperate need of attention, but I don't feel as much responsibility for that. I said going in that I'd only have time to work on it in fits and starts, and just because no one else has any time to work on it either doesn't change that. However, I do need to find time to post an RFH, since it really needs an active maintainer, and I'll at least find time to upload the upcoming 2.4.9 release before lenny freezes more, since the current version has a ton of bugs. Frank Lichtenheld has been doing a lot of the work on Lintian lately, which is wonderful, but I still have at least 10 bugs and patches that I want to deal with as soon as possible for it and get another upload out. We're well over my magic threshold of 100 bugs, and a lot of the stuff that's in the BTS just needs to be reviewed and committed. And then there's Policy, which is just about ready for an upload, and where I owe several responses on bugs and discussion threads. It's in the best shape right now of the stuff on my hot list, but there really should be a new upload in May, and preferrably in the first half. The current goal is to get the two other RC bugs against the Shibboleth packages dealt with in the next couple of days, then do a krb5 upload before the end of the week, and then Policy and Lintian are back at the top of the list, insofar as work lets me concentrate on anything else. BTW, I have to say, the more I use Git, the more I'm becoming a convert. I still think I'd rather use quilt if I have complex merges. Ironic, given that that's supposed to be Git's strength, but I have fifteen years of experience merging patches and I really understand how quilt works. That may mean I'll change my mind when I become even more familiar with Git. But for the typical package with a small number of divergences from upstream, I'm getting the hang of managing those on branches and I think I like it. I've yet to see a good reason to use rebase instead of merge, though, at least as part of a Debian packaging workflow. So either I'm still not getting something, or many of the people using Git are way more obsessive than I am about their branch merge graphs (which is weird, because I tend to be remarkably obsessive about things like that). I suppose if I ever get to using git bisect, that may change my mind.

On their "get the facts" site (as if), Microsoft recently posted a set of screencast demonstrating how much "easier" it is to install Perl and PHP on IIS than it is on Linux. Being bored, I had a look at these screencasts. The first covered installing stuff on Windows; in a 5 minute screencast, they first explain how you install ActivePerl, and have it handle perl scripts for a webserver through a CGI interface. This involves way too many steps to remember for me (including clicking through a wizard, going to the IIS management interface and enabling it, creating a directory and enabling that in the IIS interface as a CGI location, and more). Next, they do the same for PHP. Since they install PHP as a CGI binary rather than an ISAPI module, the setup isn't as complex—they conveniently reused many of the settings they'd done for perl—but it still required quite some steps. After having watched this screencast, I was wondering how they'd make it look harder on a Linux system. My guess was that they'd use Slackware and would compile apache, perl, and php from scratch or some such. That didn't turn out to be the case, however. They used ubuntu. To make the process look complicated, they refrained from using synaptic, instead opening an (almost full-screen) shell window, in which they use apt-get to install the libapache2-mod-php5 package. They conveniently also first installed the wrong version of apache, so that it would do all kinds of magical and confusing things. Really, however, after having installed this package, everything works—and they show that. The perl step should have been ignored. After installing apache on Debian or any of its derivatives, such as Ubuntu, support for Perl CGI scripts has already been installed and configured. Configuring that requires exactly zero steps. However, they still install libapache2-mod-perl, just to make it look a bit more confusing. It's not a very bad idea to do this, actually; installing mod_perl makes serving Perl scripts go quite a bit faster. But if you just want to have apache serve perl through CGI scripts, as they'd done on the IIS setup, all you need to do is install ubuntu, and make sure there's an apache installed. Period. But that's not all. They cheat. The installation of the perl and php modules on ubuntu includes the process of downloading the binaries and their dependencies; on the Windows screencast, the downloads have already been performed, and are placed on the desktop. This nicely avoids showing how you need to go to the ActivePerl and PHP websites, track down installers, download them, wait for your download to complete, and then manually start the installation process. To make things even more laughable, they install Perl and PHP as CGI handlers on Windows, but perform an installation of the same software through apache's C API. In other words, they told you how to install a fast and useful Linux system, and how to install a slow and less useful Windows installation (since a PHP setup that uses CGI will not support sessions or persistent database connections, amongst other things). And even with all that cheating and blundering, the Windows screencast still takes 5 minutes, as compared to the four for Ubuntu. I think Mahatma Gandhi forgot one line in his famous quote. It should have this:

Then they make complete and utter fools of themselves in a vain attempt to still look relevant

... right before the "then you win".

Physio:
I got to do cardio last Friday! Yay! For the first time it feels like I'm doing *real* exercise. 5 minutes on the elliptical and 10 on the bike. I've also gone from the yellow theraband to the red one on all my exercises. I've got another month at three times a week, and still every visit I'm coming away so much improved. The physio also mentioned that she's been going easy on me because until 8 weeks past the surgery, things aren't healed up enough to do real work. Well, we just passed 8 weeks, so I think tomorrow we'll be doing some actual weight training. We'll see how we go.

Techy stuff:
I'm hunting for something interesting to hack on. I've been digging a bit through the SoC lists, and I think I'm either going to just do a bunch of grunt janitor work on gcc, some hacking on eglibc to see if I can help make it small enough to seriously compete with uclibc, or I also emailed one of the Python folks who said that they were looking for an XMPP server written in Python 3.0. I got a cryptic reply of "Keep pinging me, I'll get some time eventually". So that might be a doomed project with people who don't actually care about the result. Too bad, I thought it might be a fun way to learn what's new in Py3k.

Other:
I've started going through and pruning back my friends list on Facebook. At first I friended pretty much anyone I'd ever met. I've come to use it to see how the people I care about in life are doing through their status updates, so I'm getting rid of people who's statuses I just don't care about. It seems kindof mean, but oh well. I'd really like the list to be made of people who, if they posted "I'm having a crappy day", I'd phone them up to chat with them and hear how things are going.

Leif's still cute. Angie's still sexy. Home life in that sense is pretty much the same as usual. We don't have people visiting us every weekend, but I'm well enough and we've gotten used to the shifted work loads that we're generally managing now. What we desperately need is a Roomba that will shampoo the carpets for around Leif's highchair. Ugh.

The local used bookstore actually has French kids books. Apparently the Barnes&Noble in Palo Alto also has a French section. So, we'll hopefully be able to teach Leif at least a little bit of French while we're on the opposite side of the continent. Yay!

JROBI, a chess blogger, on energy policy:

A large study in Europe concluded that it takes more gas and oil to produce a bottle of bio-fuel than it does to produce a bottle of gas. What does this mean? It means that Bio-Fuel is more damaging to the environment in the long run, and on top of that it is driving up the cost of basic food supplies. Millions and millions around the world in a number of countries are unable to afford the rising food costs for basic staples like Corn, and for what? If Bio-Fuel is not better for the environment, why are politicians and environmentalists getting behind this growing industry? I think it’s because it seems to be the “trendy” thing to do, and we all know what happens when the media promotes a new trend. We get tons of media coverage telling us why it’s a good thing, and hardly any coverage of the negative impacts. Already people from the Bio-Fuel industry are getting on television shouting out that there are many factors contributing to rising food prices, trying to deflect the fact that their destruction of food to fuel vehicles is the main culprit.

Actually, I suspect the emphasis on biofuels in the USA and Europe has to do with the fact that it’s the only alternative to fossil-based motor fuels proven to be sustainable and scalable:

The success of FFFVs, together with the mandatory use of E25 blend of gasoline throughout the country, allowed Brazil to get more than 40% of its automobile fuels from sugar cane-based ethanol in 2007.

I see no link to the European study in question, but previous studies have suffered from various faults; for example, the assumption that trucks transporting fuel cannot themselves shift to biofuels. I’m sure better analysis of the study is on its way. But that’s not the most interesting thing, to me. More interesting: my general impression that a lot of the climate-change hysteria is just that. If we hear what science seems to be telling us about the environment, and we think that something needs to be done, then we should do things that will actually work. One thing that really works is conservation: use less of the bad stuff we’re using. But we’ve done quite a bit on that front, only to hear that much, much more is required to make a difference. I’m not sure there’s much, much more benefit for us to realize in conservation, at least in the short term. So, to make a real difference, we have to make more radical changes. Can we change our motor fuel? Sure; starting with something that pollutes less, and that even absorbs some of that same pollutant in its production, sounds like a winner. JROBI, again:

It makes no sense whatsoever to create Bio-Fuel when there are much better options on the table - for instance Hydrogen vehicles. When was the last time you heard someone on the news talk about Hydrogen initiatives?

I hear it every so often. But most talk, today, focuses on the very real problems with hydrogen as a motor fuel. There are many; just look at the discussions of hydrogen fuel tank technology for a sample. But one of the biggest problems is that of developing an infrastructure for delivering fuel to the customer. No one talks about the problems of setting up an ethanol infrastructure. We already have it. Brazil has demonstrated that the current gasoline infrastructure can easily be adapted to deliver ethanol instead, and that there is a viable migration plan for gradually moving people off fossil fuels. Now, this isn’t to say that the world of ethanol is hunky-dory. It’s arguable that, while ethanol may be sustainable, the corn-based system the USA has adopted isn’t. Some people are talking about sensible tweaks that may solve the food problems while continuing to support biofuels–removing our silly tariff on Brazilian ethanol, for example, or developing alternative feedstocks for ethanol production. The problem is that hysteria seems to be breeding hysteria. Global warming is so severe, we are told, that we need solutions, and we need them immediately. So we develop solutions we can use immediately. But no! These solutions cost; we need something else, and we need it immediately, and we need it cost-free. Practically, this kind of insistence on perfection–that we deploy solutions with no drawbacks, only benefits–has the effect of dampening our enthusiasm for environmental solutions. We tried, our leaders will tell us, but nothing was good enough, so we gave up. And so, rather than do something that helps, or even something that lays the foundation for helping, we continue our use of fossil fuels. Perhaps ethanol is the wrong solution. But if it is, we should resign ourselves to the inevitability of the future, as foretold by science, or fervently hope that the global warming deniers are right, because other solutions will arrive too late to do much good.

For the past couple of days, one of my e-mail addresses has been some spammer's choice for forged From: lines in their spew. So, as invalid addresses aren't high on a spammer's list of priorities, I get all the bounces. The fact that MTAs, in this day and age, don't have SMTP session recipient validation is unpleasant. However, with ISPs requiring all outgoing e-mail to go through their own servers, I can kinda see where that can break down. I still don't like it, but I'll live with it. In amongst all the bounces, though, there's a lot of other, really obnoxious, crap. So far, I've had five "please click this link / reply to this e-mail so it'll go through" (AKA "please filter my spam for me")[1]. I've also had a large number of e-mails saying that my e-mail was blocked or unwanted or whatever, from spam filtering programs themselves. What I haven't got any of, as far as I can determine, is any e-mail from enraged recipients saying "stop sending me this crap!" or anything of that nature. The only conclusion I can reasonably draw from this data is that users know that source addresses are forged and there's no point replying to them, but the people whose job it is to write, maintain, and run spam software don't. That's downright embarrassing. Not a single user was dumb enough to assume that I really sent the e-mail, but IT "professionals" who deal with spam for a living are. If you are in any way involved in the production, sale, or use of an anti-spam product that hasn't realised that the from addresses of spams are universally forged, please shoot yourself in the head. Really. I'm sick to death of people who should know better doing the most stunningly stupid things regardless. If you don't know that your software is spamming the rest of the world, then you're still on the hook. What other dumb shit is your system doing that you know nothing about? On the other hand, if you do know that your spam filter is contributing to the noise, you're even worse -- no spam has a real source address. If your software or system spews crap because some clueless manager told you to do it, then you need to grow some courage and ponder on the words of Napoleon:

A commander-in-chief cannot take as an excuse for his mistakes in warfare an order given by his sovereign or his minister, when the person giving the order is absent from the field of operations and is imperfectly aware or wholly unaware of the latest state of affairs. It follows that any commander-in-chief who undertakes to carry out a plan which he considers defective is at fault; he must put forward his reasons, insist on the plan being changed, and finally tender his resignation rather than be the instrument of his army's downfall.

In other words, if you did it and you know you shouldn't have, it's still your fault, regardless of why you did it. Take some responsibility for your actions, for fucks sake.

---

[1. Every single one of which I was more than happy to confirm -- if you want other people to do a job for you, you have to deal with the fact that some of them might not do it in quite the way you expect. I encourage anyone else who thinks that an anti-spam system that requires the rest of the world to filter your inbox is stupid (even disregarding the likely problems of infinite loops if everyone had a challenge-response inbox) to do the same.

People rarely ask me about my amazing ability to remove fruitfly ovaries in under 10 seconds. "This skill makes me strangely attracted to you" they then inevitably fail to add, thus giving the lie to claims that a PhD in biology is a great way to impress women. In order to avoid future social embarrassment I have therefore decided to provide a step-by-step guide to removing ovaries from any fruitflies you may have to hand.

• Feed your fruitflies. Fruitflies like yeast, so give them a pile to munch on. A well-fed fruitfly is a happy fruitfly.
• A happy fruitfly is a fertile fruitfly, and has bigger ovaries. Since fruitflies are small, this makes your job easier.
• Knock your fruitflies out with carbon dioxide. When doing this, ensure that you don't knock yourself out with carbon dioxide.
• Separate your fruitflies into male and female flies. Female flies have larger abdomens and striped posteriors - male ones are thinner and have solid black markings.
• Dispose of the males. They don't have ovaries. Local laws may make it awkward for you to release animals from laboratory environments, so dump them into a bottle of ethanol. They'll probably die happy, to the extent that fruitflies can really be happy.
• Etherise the female flies. When identifying ether, try not to do so by smelling it.
• Once the female flies are thoroughly dead, transfer one to a small watchglass containing a quantity of phosphate buffered saline with a small quantity of detergent in it. Place this under a low magnification microscope.
• Grip the neck of the fly with a set of needle-nosed tweezers. Grip the very rear of the fly with another set of needle-nosed tweezers.
• Slowly move the tweezers apart. If you are lucky, the abdomen will split and you'll start pulling out internal organs. If you're unlucky, the head will come off. In this case you should move the first set of tweezers further down the body and try again.
• Continue pulling out internal organs until you find two objects that look like bunches of bananas. These are the ovaries, with each "banana" being an egg chamber containing an egg and associated support cells.
• (If your fruitfly contains no ovaries, it's not a female. Try again)
• Carefully separate the ovaries from the other chunks of tissue that are stuck to them, and transfer the ovaries to a tube containing phosphate buffered saline.
• Repeat until you run out of flies. Note that towards the end, it will become tempting to just tear the flies into small pieces rather than removing their ovaries. Bear in mind that the aim is to obtain fruitfly ovaries, not to kill flies. There are much easier ways of doing the latter.
• Dispose of the remaining bits of flies in accordance with any relevant legislation. Do not throw remaining bits of flies at coworkers.
• Fix the ovaries in formaldehyde and suspend in methanol. Freeze at -20 C.

See? It's all very easy.

(Note: This protocol involves chemicals known by the state of California to cause cancer, birth defects and general fucked-upness. Do not ingest methanol unless you want to demonstrate competitive inhibition in the form of a bottle of vodka. Value of fruitfly ovaries may go up as well as down. Do not taunt fruitfly ovaries)

This Thursday, we did the largest part of the final phase of Stanford's Kerberos v5 migration. Our account services database system has now moved from Solaris to Debian, from Oracle to MySQL, and from Kerberos v4 to Kerberos v5. This has a lot to do with why I've been exhausted this week (I've worked over 50 hours and will probably do some more work this weekend). We're at the very end of a project that's been ten years in the making. Stanford first deployed Kerberos v4 in 1992 using the Transarc AFS kaserver as the KDC, with the full intention that it would be temporary until we moved to some Kerberos v5 implementation, probably Transarc DFS. Sixteen years later, we're finally turning off the OpenAFS kaservers and going to Kerberos v5 exclusively on May 15th. Various people at Stanford have been working on this project fairly continuously since the late 1990s, particularly Booker Bense and Roland Schemers (Roland has now moved on to other things). I started taking responsibility for it about five years ago and it became my major project three years ago when we finally got funding to finish it. It's the biggest project of my career to date. When we finally got funding and I was able to start working on it for a substantial percentage of my time, I went into the project with the intention to solve the large problem and do it right whenever possible. That meant trying to enhance the software where it was deficient rather than working around it, solving the large problem, and trying to improve the world and not just Stanford. Stanford University has been extremely supportive of that goal, and as a result, what's come out of the last three years is a bit staggering to look back on. I was feeling rather down earlier tonight, mostly because I'm exhausted. It's been a very intense past six months, a very tiring week, and I've not had the energy and attention for other things that are important to me. But I started thinking about everything that we've been able to do as part of this project and realizing just how big this is and managed to cheer myself up a lot. Five years from now, ten years from now, thirty years from now, this is still something that I'm going to be proud of. That's a great feeling. I was going to write up more specific details of how to tackle a project like this and do it right, listing some of the concrete results as examples, but yeah. Exhausted and low energy. Maybe I'll just do it over the next two weeks as a lead-up to May 15th. Immediately after that I'm going to the AFS and Kerberos Best Practices Workshop in part to talk about many of the things that we've written. And then, for the first time in three years, all of my major projects will be cleared and I'll have several months to catch up on everything else, recover, and gather my thoughts before deciding what the next big project will be.

Lets go on your nerves again with a ftpmaster post about work I’ve done in the recent past.

• The already mentioned move of britney. And it seems that this did help, so something that should have been done way earlier already… Oh well.
• Enabled a few triggers for the qa user on merkel. While I already mentioned them in my first post, there is a third one now. The qa user now gets notified at the beginning of the dinstall run, so the pages can show why packages might not be visible in the archive and in incoming right now.
• Split up the insanely huge mbox files we had as the ftpmaster mail archive. They got that big because the monthly cronjob rotating them got disabled when the ftp-master archive went away from raff, and noone bothered to reenable that job. Done now, so we are back to a manageable size. (Even if 90% of the content is spam, no matter how much greylisting and blacklists are activated :( ).
• Just committed a largish change thats nothing more than a cleanup. Someone in the past did love to not care about tab versus spaces for the indentation, so dak code ended up with a mess of tab/space mix for indentation. Which is not nice, one style is way better. Fixed that with the help of reindent.py, which one can find in Pythons examples.
• Got the code on security.debian.org to use the latest dak revision from ftpmaster. It was a few commits behind, but worse - it did have one dak tool changed in a way that it only worked on security, no longer on ftpmaster. Also some files that clearly have been copied by scp -r or rsync, but not using the VCS that should be used for it. Args. Brrrr. The “fix” was a simple check if that value the code wants to use from the config file actually exists, instead of blindly assuming it will always be there.
• Generally looked around on security.debian.org, to get more familiar with the setup there, so I can work on a request I got from some members of the security teams: Run a queue daemon that manages the upload of the packages from the security archive to the normal archive (so they end up in proposed-updates). Currently it is done with some lftp calls within the script that does the security install, and that seems to break every now and then. Which means security uploads to proposed-updates randomly go MIA. Using a queue daemon and then only locally copy files into its dir should make that way more reliable.
• Used a tool from Dato and enabled bzr commit mails for the ftpmaster dak tree, they are now going to the dak list.
• Modified the cronjobs that are expected to have output to log that into files in a new logdir. Also modified the cron.daily AKA dinstall cronjob to be more verbose about the actions done. The directory is synced to merkel too (log/cron in the ftp.debian.org tree), so every DD who wants to can look at them now.
• I also merged a small patch from Thomas, fixing/unifying some wording in reject messages.

Comments: 3

I started reading planet debian a few years ago when it became obvious for me that it was an important communication channel for the Debian community, but never managed to start my own blog. I think it is time to do it. After reading Ganneff's experiences with Movable Type, I finally installed it on my webserver.

Now, let's see how often I'll update it.

Tonight I'm going to enjoy a nice long sleep after attending The Beltane Fire Festival yesterday evening. I did manage to sort out an SSL certificate yesterday, before I went out. A lengthier process than expected because the SSL-registrar was annoying and mailed the admin address listed in whois for my domain; rather than an address upon the domain itself. I guess they can't be blamed for that, and the registrar did forward on the request when begged, so it wasn't the end of the world. For reference I used godaddy.com; who sold me a 3 year SSL certificate for about £25. Today I've been mostly catatonic because I had only two hours sleep last night. But one good piece of news was receiving a (postal) mail from Runa in response to the letter I had sent her some time ago. ObQuote: 300

Meet the Italian income agency The Italian income agency decided to publish online all the income levels for each and every single citizen and company in the country. I did not manage to see the actual data, because the entire income agency website was swamped with request and timing out all the time. You should have heard the comments of my accountant, who every day needs to access other parts of the website for work. That service is supposed to have been taken offline now, after the Italian privacy watchdog issued a polite What The Fuck! Why Didn't You Tell Us Anything About This? sort of note. The minister defended himself by saying "I can't see what is the problem, it's the same in all the world: if you want proof just watch any American TV series". What a wise man. I should watch some of The Greatest American Hero again. Since I could not see the actual data, I could not verify if what people were saying was actually true, that is that income information were published together with the full home address, providing a nice shopping list for house robbers, kidnappers and the other kind of professionals that would politely wait next to your door for you to come home late in the night. But fear not, the website was protected from bots: it used a captcha. Not only that: in order to comply with standard accessibility rules, the website used a perfectly accessible captcha: You can't get more accessible than that: the captcha is displayed in plain text, so any accessibility technology will be able to read it. Plus, anyone can easily copy and paste it into the text box. And if someone needs to do it often, it's even trivial to write a script that does it for you! But it's unfair to say that it was just plain text: it was cleverly encrypted:

<div class="educaptcha"><label for="educaptcha">I<!-- id9113507 -->nser<span>ire </span><span>nel c</span><span>ampo</span> di <!-- id5058508 -->v<span>erific</span><span>a suc</span><!-- id2643358 -->ces<span>sivo i</span><!-- id2500023 -->l valore <span>695</span><span>8571</span>4<!-- id3588853 -->:</label>
<input id="educaptcha" type="text" name="ucaptcha" value="" maxlength="10" size="20" /></div>

For your convenience, here is the version cracked with a malicious :%s/<[^>]\+>//g in vim. If you do not speak Italian, you can still look for this phrase in the screenshot above:

Inserire nel campo di verifica successivo il valore 69585714:

The meaning is of course:

Insert the value 69585714 in the following verification field:

It's been a fun day for Italians online.

These last two weeks most of my time has been sucked into getting Python 2.5 as default into testing. That’s done now. I made use of the block uploads thingie ftpmaster implemented for the release team to use. Basically, if your package could disrupt an “almost there” transition, the upload will be rejected. The blocks were in place for 5 days, which I think it’s acceptable. As long as we don’t end blocking stuff for very long, I think we should be fine. See the end of this post for more about this. Though it was quite a bit of work, I’m very glad I took care it myself, since now I really feel I’m 100% back to Debian, after the time I spent off for health reasons. Update: Oh, and I forgot to say: having control over britney has really really helped. Thanks a lot Joerg for that.

---

Dudesconf Tomorrow I’m leaving to Coru a for Dudesconf, which is a kind of Debconf-ES. I’m giving an introductory talk to Git, a semi-lighting talk about grep-dctrl (30 min.), and (gasp) a talk about Debian packaging with a VCS. We may have a Debian Quiz as well. I’m so looking forward to it, since many people who’ll attend are amongst my most loved ones, and I already missed last year’s since I wasn’t fully recovered yet. See you there!

---

Minirok and Sevilla One of the reasons I wasn’t fully back to release management during the past 5 months or so is because I spent as much time as I had doing development for Minirok. I don’t think I mentioned here before, but I was participating in a Free Software Contest for college students organized by the University of Sevilla, Spain. Such effort finally paid off, since Minirok was elected as one of the finalists. This means next week I’ll go to Sevilla, to make a presentation of the project, and who knows what more. ;-) I’m very excited.

---

Finally, more on blocking uploads This Python 2.5 transition was the first time the block uploads feature was used, and there were a couple bumps along the way. In particular, a couple packages were blocked, when they shouldn’t have been (libqt4-ruby and evolution-sharp), and one needed package was not blocked, though Rene Engelhard thankfully spotted it very quickly (mono). The problem is it’s not completely straightforward to generate a list of all the stuff that could possibly affect the transition. What I did was to make a run of britney on an arch that had all the needed bits in place, and block all the packages that migrated together as a result of the hint. This fails in two ways:

• it can include stuff that is not needed for the transition, namely unrelated packages that happen to become candidates for testing by one of the their dependencies having migrated as part of the hint. This is what happened with libqt4-ruby and evolution-sharp.
• it can miss stuff that is needed, like packages that can migrate by themselves, so the main run prior to the hint migrates them, and hence do not show up as part of the hint, but that some package of the transition depend on. This is what happened with mono.

The second problem, though, can be fixed by parsing the excuses list and blocking stuff that some bits of the transition depends on. Easy enough. Yet, there are more cases when things can go wrong, for example a shlibs-bumping upload of a package (say, sqlite3) linked against by some package still needing a couple of builds (say, qt4-x11). For that, blocking uploads is not an option, since that’d be an insane amounts of packages that, furthermore, can be uploaded if they don’t bump shlibs, so I guess we’ll have to ask in the next release update that shlibs-bumping uploads are coordinated in -release too, at least when close to finishing a transition.

A few weeks ago, NYU hosted an interesting event about the future of the Internet, appropriately tittled The Futures of the Internet, the video of which is now available here. One of the panelists was Jonathan Zittrain (who recently wrote an important new book bearing the same name as the event) and during the talk he provided a few ideas about how geeks and developers can help secure the Future of the Internet. While I agree with a lot in fact most of his assessments about the state and fate of the Internet as he lays out in his book and his talks, his characterization of geek/hacker/developer politics is not one of them. Basically, one of Zittrain’s claims is that developers are not doing enough to save the Future of the Internet and it is their rampant, Atlas-like libertarianism, which is, in part, to blame (first made 37:20 minutes into the video for those who want to listen to the actual comments). They have little-to-no political consciousness, are too cool to care about the fine print and they don’t care about the broader politics of the the Internet because they assume that they can just hack around any sort of barrier and impediment. While we can, without a doubt, identify a strain of libertarianism among hackers, it is by no means representative of all of geekdom and in fact, is becoming more and more a worn out 1990s stereotype/clich as time passes than an accurate representation of what is a far more variegated set of ethics and practices among hackers (and I will soon publish an article on this topic). It also completely fails to capture the ethical spirit as well as sociological, and political workings of one of the most important strains of hacking free and open source software which not only powers most of our (open) Internet but which in fact has provided a pretty hefty ethical backbone by which to conceptualize one of the ways we should think about the fight for the future of the Internet. Ok, time for a rant now Geeks not only designed the Internet, an indisputably revolutionary medium, but also implemented, and continue to maintain it, and then in their copious spare time, also engage in fighting back the political, legal and corporate encroachment which threatens to limit the very revolutionary nature of the Internet (as Chris Kelty’s new book on Free Software argues). If these acts by geeks are not enough political action, then maybe the development of not just one, but multiple entirely open and free alternatives to the only two proprietary operating systems that exist today might be a political act that would satisfy? Many would agree that even simply using a free operating system is a political act. It would be better to claim that individuals, lawyers and other political actors are not doing enough to save the Future of the Internet, rather than imploring the already overtaxed geeks to set aside everything that they are already doing to do something even more. (end rant) It also seems that when it comes to political questions related to the Internet, net neutrality being the hot topic now, or fighting restrictive and problematic laws like the DMCA, one of the only groups of people (outside of lawyers and librarians) to actually understand and dissect the fine print (and geeks actually are pretty attuned to and like to dissect the fine legal print), to protest these unsavory laws, and to support the organizations who are doing something about it (like the EFF), are geeks and hackers. While many geeks are not necessarily keen on conceptualizing their labor in traditional political terms, or aligning their technical projects with a political affiliation, and yes would rather just be writing good code, they do fight for their productive freedom and this productive freedom just happens to relate to most questions and concerns related to an open, accessible, and tweakable Internet, built by the geeks, lest we forget What was perhaps most surprising was that he also seemed to think that geeks and developers have not turned to “apprenticeship,” nor policies and procedure to coordinate their development projects, unlike Wikipedia, which he considers a shining example that geeks should look towards as a beacon of policy that geeks should consider emulating in their projects (comments made answering my question). He clearly has not been hanging out with any Debian developers in the last 10 years nor has he gone through their New Maintainer Process In other words, he seems to think they are allergic to regulation due to their accentuated libertarianism, or are against structure because of their anarchism, neither which is remotely true. I think I found this characterization most ironic and problematic for before Wikipedia was even an entry on a Wiki, projects like Debian (and most other F/OSS projects) were transforming and changing to integrate normative procedures and policies that allowed a group of people to work together, scale, grow and deal with crises’. No, they don’t have the Wikipedia badge system, but that system is emblematic of Wikipedia’s own transformation into integrating its own normative procedures and policies for working together, not an example of an idealized policy system that other projects are too primitive to have evolved into yet. About one hour into the talk when questions opened up, I objected to his characterization, but given his answer back to me, I did not make much of a dent in his thinking. Another lawyer Tim Wu (who also wrote a wonderful book on the Internet) chimed in to give me some props and also made a good point that even if geeks are the only groups of people who would storm AT&T and know intimately about the importance of net neutrality, there is a lot of room for thinking about how to strengthen and improve the tactics and politics among geeks and developers so that we can ensure the type of open and generative Internet and set of technologies we value. As part of thinking and rethinking new strategies, it is as key to acknowledge and honor the past. In this regard, free software development has been pivotal both in terms of providing software (and making it is an important political act as is choosing to use free software over propriety software) and a set of important set of ideas that a lot of lawyers like Yochai Benkler and Lawrence Lessig have run with to make some important political claims of their own. So despite my rant above, which was a rant and thus exaggerates things to some degree, I do think there is much more that geeks and non-geeks can do, such as help translate these uber-geeky issues into less geeky terms (and actually this is already being done by some geeks as the work of Jelena Karanovic has shown, or translate the technical issues into new domains as the uber-geek Karl Fogel is doing with question copyright but first lets give credit where credit it due and recognize that labor is political

I installed Debian upon a new desktop machine yesterday, via a PXE network boot. It was painless. Getting xen up and running, with a 32-bit guest and a 64-bit guest each running XDMCP & VNC was also pretty straightforward. There is a minor outstanding problem with the 32-bit xen guest though; connecting to it from dom0, via XDMCP, I see only a blank window - no login manager running. GDM appears painlessly when I connect via VNC. The relevent configuration file looks like this:

# /etc/gdm/gdm.conf
[security]
AllowRoot=true
AllowRemoteRoot=true
[xdmcp]
Enable=true

The same configuration on the 64-bit guest works OK for both cases. (I like to use XDMCP for accessing the desktop of Xen guests, since it means that I get it all full-screen, and don't have to worry about shortcuts affecting the host system and not the guest - as is the case if you're connecting via VNC, etc). Weirdness. Help welcome; I'm not 100% sure where to look Anyway, once again, a huge thank you to the Debian Developers, bug submitters, and anybody else involved peripherally (such as myself!) with Debian! I love it when a plan comes together. SSL ObRandom: Where is the cheapest place to get an SSL certificate, for two years, which will work with my shiny Apache2 install? Somebody, rightly, called me for not having SSL available as an option on my mail filtering website. I've installed a self-signed certificate just now, but I will need to pay the money and buy a "real" one shortly. So far completessl.com seems to be high in the running:

• 1 year - 26
• 2 years - 49

For double-bonus points they accept Paypal which most of my customers pay with .. ObQuote: The Princess Bride

When I heard that there will be a miniseries based on “The Andromeda Strain” book, I was very exited. That was one of my favorite sci-fi books in my childhood. After watching the miniseries I must conclude that this is another book perverted and trivialized by Hollywood. SPOILERS AHEAD! They created some crazy pseido-sci-fi idea that humans from the future sent Andromeda back from the future via a wormhole in a container that contained a message which was then picked up by a satellite that was sent up to investigate the wormhole. No wormhole was there in the book. The book had a much more modest idea - a Scoop satellite was to skim the outer layers of the atmosphere for mutations of common Earth bacteria for military purposes when it was impacted my a micrometeorite carrying the Andromeda. Much more probable, no need to involve wormholes, time travel, ASCII messages, eco-terrorists and a sub-plot on conservation of marine species. Due to extreme modernization of the script, the whole subplot of the teletype mechanical failure was omitted. Andromeda was made sentient instead and communicated via ’some kind of inductive field’ to shoot down a fighter jet and activate a nuke. The survivors and their pH levels got barely a glance. Also the amount of destruction was obviously too low for the movie, so the Andromeda was made to mutate more, spread out of containment easily and even make a flock of birds attack a squad of solders ‘Hitchcock style’. Disgustingly cheap scriptwriting. Huge chunks of plot were ripped out (searching for the micro-meteorite impact crater with different lenses, central core security) and the two hours were filled with Rembo style journalism vs. black ops, selfless president and scenes of animals eating each other and dieing. At the end they ran out of budget and just made it look like presence of Andromeda made air and water bright red so that people would have something to run away from in fear. Oh and the scientists are allowed to freely talk about the event after it’s done. Yeah, right. In my book this movie rates very close to the infamous “The Core” with the only difference that they managed to fuck up a really good book. Do not watch it and read the book instead.

There was a discussion today on the LUV-main mailing list about apache virtual hosting. Someone suggested mod_vhost_alias which is OK for a simple solution, but pretty limited. IMO, there are much better ways of doing it. Specifically, generating config fragments for each virtual host. I wrote such a system years ago, and have always thought “I should package it up for debian”. There’s a moderate amount of work involved in doing so, and probably an even larger amount of support work afterwards. Worst of all, I’d have to write - or con someone else into writing - documentation for it (it’s easy enough to use that you can be SHOWN how to use it in 10 minutes, but that isn’t good enough for a distributed package). I guess the point of this blog post is to find out if there’s sufficient interest to make it worth the effort. Feel free to comment or email me about it. If anyone wants to look at the code, i can tar it up easily enough, and even write some simple/minimalist instructions. anyway, here’s (a slightly edited version of) what i posted to LUV-main: Preamble I looked into apache’s mod_vhost stuff years ago, but IMO it’s just too inflexible and limited to be of much use. It’s fine if ALL your vhosts are identical…but not if you need different settings on some or all of them. As soon as you need a custom setting for one vhost, you have to step outside mod_vhost_alias and roll-your-own anyway. which means you now have two different methods of configuring your vhosts. Instead, I’ve used my own vhosting system for years (long before mod_vhost), on dozens of servers…the largest of which had over 500 vhosts on it - the biggest problem was the enormous number of file handles the apache processes needed for log files. After tweaking the kernel file-max etc limits, it actually worked without problem but I always intended to rewrite that bit of it to use a log splitter daemon, perhaps vlogger or similar. Unfortunately, I a) left that job before I had time to implement it, and b) never did figure out a good way to handle the error logs because apache doesn’t prefix the vhost name to ErrorLog output like it does for CustomLog outout (best compromise was to just have one combined error log rather than one per vhost….most web programmers/website operators never look at the error logs anyway. Personally, I find it invaluable, most people don’t even seem to think of looking at it) Synopsis of Operation 1. Creating a new vhost is a 3-step operation:

1. create a user (with adduser), optionally with a postgres or mysql account of the same name.
2. edit /etc/virtuals/virtual-hosts.conf, copy/paste/edit one line
3. run “make”

In step 2, hardly anything needs to be changed from one vhost to another - in the most common case, just the account’s login name, and the domain name. There are a number of different “flags” that can be set for each vhost in this file - ssl, cgi, mason, htdig, webcheck, aliases, group, samba, canonify (use mod_rewrite to redirect back to the site’s canonical name), and more. The Makefile runs perl scripts to generate the apache config fragment (and other config fragments - e.g. for htdig and samba), add/remove any IP addresses if needed (usually not, with name-based vhosts), set up the home directory structure, copy in any sample files (e.g. html forms and images for htdig), and reloads apache. It also checks in any changes to svn (or RCS. easily modified to use other revision control systems). On machines which are part of a load-balanced setup, it even ssh-es into other machines in the array, runs “svn update” and “make” to ensure that the vhost is operational on the other machines too. Finally, it concatenates all the active config fragments into one large file because apache reloads a LOT faster if it doesn’t have to load hundreds of little config files. 2. Removing a vhost is as simple as editing virtual-hosts.conf and commenting out or deleting the line, then running make again. virtual-hosts.conf The virtual-hosts.conf file is extremely useful. It gives me a single authoritative source of all the relevant details about EVERY vhost running on a machine. These details can be used by other scripts (e.g. cron jobs to run webalizer, analog, htdig indexing, webcheck, etc; cgi scripts to display a list of vhosts on the machine with clickable links, and more). This single config file makes the whole system easily extensible: write a new script to parse the config file, and loop through each entry, performing some relevant operation. e.g. run webalizer for every vhost, dumping the output under ~/public_html/LOGS/ (with optional .htaccess file to control access). Adding optional generation of samba shares for each vhost was quite easy. In theory, it wouldn’t be hard to put a GUI or web front-end on to it. Oddly enough, i’ve never bothered. And I’m not inclined to bother now (but wouldn’t object if anyone else did) Database? no, thanks I’ve occasionally thought about putting this config data into a database, but the benefits just aren’t anywhere near good enough to outweigh vi and all the benefits of text file configuration (especially comments!) Packaging? And, of course, one of these days, i should package it all up for debian. I’ve been saying that for years, and just haven’t got around to it. It wouldn’t take a huge amount of work to do so, there are only a few small things i need to do to automate the installation, things that i just do by hand in a few minutes when installing on a new box. Before packaging it, I also want to automate the adduser part of the process, as well as creation of postgres or mysql accounts. Most importantly, I ought to separate the code from the templates in the config fragment generator scripts, so that the local sysadmin can edit them without having to edit the scripts….OK, all up not a tiny job but not particularly big either….just big enough to be ignored on my TODO list for years. I’d definitely have to change the config file format from the current one-line (colon separated fields) to using a .ini style file. I’ve wanted to do that for a while but have inertially-resisted it so far because the one-line format is so convenient…unfortunately, I’ve added so many flags and features over the years that it’s seriously ugly - probably scary to someone who doesn’t know it already (i.e. anyone outside of the set of “me + a handful of other people”). I estimate this would take about a days worth of hacking I’d also take the opportunity to clean up some of the cruft :-) Essential Design Criteria BTW, one crucial design criteria for my system is that it should *NEVER* under any circumstances overwrite any hand-edited changes. This is implemented in a number of ways. First, it takes an md5sum of each vhost’s config fragment when it generates it. If/when the script is run again, it only re-generates the config fragment if the md5sum hasn’t changed. If it has changed, it generates the updated fragment as “.new” for manual merging if required. Secondly, when generating conf fragments it looks for specially named files in a directory for extra stuff to add before the <VirtualHost> line, between the <VirtualHost>…</VirtualHost> lines, and/or after the </VirtualHost> line. This is to provide another location to put custom changes for each vhost while still retaining the ability to have improvements/new features to the script automatically applied to existing vhosts. The reason for this is that I utterly loathe and despise allegedly “easy” configuration tools that blow away custom hand-edited changes. I hate them so much that this was THE major incentive for developing my own vhosting system. In Use I’ve been using my system for over 10 years now. It grew out of earlier bits and pieces, but the current incarnation has been working since 1999, with the occasional new feature or update (e.g. to add support for apache2 as well as apache1, and minor changes to adapt to changes in debian’s apache packaging). There are also a handful of ISPs and several small businesses around Australia running it because they’ve hired me to set up their web servers. Finally… My vhosting system isn’t a system for people who are scared of or dislike command-lines or text-file configs. It’s a system for people who love them, but want an easy way to automate a dull, repetitive task. Such automation is easy for CLI tools, and next to impossible for web/GUI tools. Syndicated from Craig Sanders' Errata: Miscellaneous Thoughts poll: package my vhosting system for debian?