First of all, congratulations Steve!
Debian Project Leader Election 2008 Results
The winner of the election is Steve McIntyre.

Security and languages
Meanwhile, Steve Kemp confirms my preference (prejudice?) that Debian maintainers and sponsors must have an understanding of the language used for their packages. (I do not maintain or sponsor KDE, Python or Mono packages for this reason - my C++ knowledge is too patchy to do more than a few queries of the apt C++ interface and I wouldn't understand a single line of python or mono source code.)
Andrew Pollock thinks that all C bugs are upstream bugs.
"Any bug in the software packaged is inherently an upstream bug, and the problem of the upstream author" - noting that he also has a good relationship with upstream and feels competent to apply and refit patches. I must say, I feel that this not something I could consider doing myself or recommending to anyone as sponsor.
Steve Kemp is naturally taking the security point of view and I fully agree that understanding the infamous Smashing The Stack For Fun And Profit (the code itself may need a few updates to work but it still explains the issues) is part of the job of any maintainer or sponsor handling a package that contains a setuid or setgid binary.
I'm upstream for some of my Debian packages and one, in particular, has known issues with static buffers which I inherited from the old upstream. Most of those have been removed but some are embedded a little too deeply into the codebase and it will take time to remove them all. (The ones I know about are tagged in the doxygen output of the source code.) My other programs use GLib dynamic string allocation / parsing instead of calling strcpy and friends directly.
I don't think it is fair or reasonable to maintain a package in a state that would require a new upstream release to fix a critical security bug. Equally, not being able to fix such a bug by creating the patch yourself (e.g. when upstream is not contactable) is also, IMHO, sub-optimal. (The security team are busy enough as it is without being required to write the patches as well.) As I've found with one of my own upstream packages, removing or protecting static buffers is not necessarily trivial and just extending the buffer is usually insufficient. Poor code design or code that is simply very old and stale can be hard to update. (Removing one static buffer required a patch/RCS commit changing some 300 lines in 6 source files during the development of one of my packages.) Changing the buffer behaviour can also cause mysterious bugs elsewhere - in the case of the package referred to above, inability to read or write its own data files and likely corruption of existing files. Thankfully, that application is never going to be one that needs setuid or setgid and is already in a much better state than it was in the Etch release so I'm working on fixing the other buffer issues but without the urgency that would otherwise be necessary.
I'm still learning about improving the security implications of my own code - I would certainly not be happy maintaining a package that uses a root process or a daemon that was written in a language that I simply don't understand, no matter how good my relationship with upstream. IMHO, the problem with security bugs is that the person writing the patch often has to understand the language and the package at a fairly deep level if the fix is not to cause bugs elsewhere in the application. Fixing a static buffer by breaking the application isn't good but then neither is leaving a Debian security bug open whilst waiting for upstream to create a suitable patch for your own Debian package. The problem gets worse if the security bug is architecture-specific or the fix causes bugs that only appear on certain architectures. There are some things that matter in Debian that simply do not matter as much upstream - if a security bug lands in that gap, the Debian maintainer must be able to solve the problem in Debian - at least, that is how I see it.

I highly recommend making some time to read the The Australian Open Source Industry & Community Report. Based on a census of the Australian Open Source community conducted at the end of last year, it presents a range statistics about the state of the Open Source community and industry in Australia. The report seems to be aimed at demonstrating to Government and Businesses that Open Source has become a very viable business strategy in Australia and in particular how increased adoption of Open Source would reduce the Australian trade deficit. You don’t need to worry about being put to sleep. The report is relatively casual in tone and easy to read with lots of bright graphs to present the key statistics and findings. Including:

• The Australian Open Source industry generates around AUD$500M in annual revenue. A small proportion of the AUD$54.4B total revenue for the Australian ICT Industry in 2004-2005. Lots of growth potential!
• 70-80% of the industry is based on the traditional development, customisation, support and maintenance business model.
• Most of the individuals making up the Australian Open Source community are working professionals, over half the community are in a relationship and a third of the community have children.

It would be fascinating to see a similar study of the New Zealand industry. I suspect that we would find that Open Source businesses are spread across the country similar to Australia. Obviously our community and financial figures would be smaller in absolute terms but would our proportion of Open Source based businesses be similar? Maybe a good task for the current NZOSS committee would be to round up some of the larger Open Source businesses in New Zealand, along with the Ministry of Economic Development to sponsor a similar study for New Zealand!

It's been a long time since I've written on my blog; longer than I'd like. I really want to get back in the swing of it, if only to keep this entire site from bitrotting interminably. My Alexa ranking has dropped to like >1M, which in my Web-addled state means that my personal worth has dropped, too. I know, I know. tags: blog me alexa

Conference of the Americas: Cancelled I was sorry to see that the Wikimedia Conference of the Americas, scheduled for mid-May, has been canceled. There was some controversy when this conference was announced last fall; it partly originated from a bid by the Atlanta Wikimedia community to host Wikimania. I'm kind of sad to see that it's not going to happen. I like Atlanta a lot, and I think there is a really good case to be made for regional (or at least continental) Wikimedia conferences. I hope this isn't a nail in the coffin for such a regional event in North America. On the flip side, it'd be really nice to see a more detailed explanation of what happened; of what future plans for the COTA are; and just generally a little more communication. tags: cota atlanta wikimedia wikimania wiki

Elsewhere in wikidom That all said, things are looking really cool for Wikimania over the next 12 months. I'm really glad to see that my South American home-away-from-home, Buenos Aires, won the chance to host the 2009 Wikimania event. With 2008's event in Alexandria, Egypt, I think we've got some seriously interesting ground to cover Wikimedia-wise. Also of importance: if you haven't received an invite yet, get yourself over to RecentChangesCamp 2008. The wiki unconference will be happening for the first time in the Bay Area (California). We'll be meeting over May 9-11 in the offices of SocialText in Palo Alto. I can't say enough good things about RecentChangesCamp. It has been instrumental in my understanding of wikis and my connection with the worldwide wiki community. If you are at all interested in wikis or related concepts, you should think hard about coming to this conference. tags: wikimania recentchangescamp rcc2008

Brain bits

• I think microrevie.ws is pretty cool. I got the 100th review today! Yay for me.
• Speaking of twitter stuff, I dig twittermap, but I don't always remember to update. IWBNI there was a portal to/from Fire Eagle.

tags: microreviews hreview twitter twittermap fireeagle

So here's the hard part, if you start writing about people and relationships you have to continue, otherwise people who do follow will make assumptions, or not be aware of any potential gaffes they are about to make. I've written in the past about some stuff which I now wish I hadn't because this post is suprisngly hard to compose.

I'm now single, and living alone.

No fiance, no partner, and no kitten. The next time I write about friends I'll make sure it is for local people only. Unless I get carried away, in which case I should be stopped. ObQuote: The Taming of the shrew; via 10 Things I hate about you.

Having recently been through the process, I've managed to come out the other-side with some some advice for anyone taking this on.

• To start out, the link for making appointments at the Australian Consulate is VisaPoint. I found it was remarkably well hidden.
• Upon entering the country, it's quite likely the immigration officer won't be that familiar with the E3 Visa. I'd recommend you watch them and very politely correct anything you think wrong, in my case my Visa was incorrectly entered as E3-Dependent along with my wife (proving that the system doesn't actually keep referential integrity between an E3 and an E3D holders).
• You can not get paid before receiving a social security number. You can not apply for a social security number within about 10 days of entering the country, as there is a lag between immigration and social security systems. Once you apply it will take a few weeks for the card, but you can probably go back to the office with sufficient ID within two days and receive a print-out of the number. You can call the office you filed with first and they can tell you if it's worth coming in to try it. In the absolute worst case, if things screw-up, you could be in for a long wait. Your company may be able to loan you money if things get desperate.

If anything really stuffs up you'll have to enter the US immigration services, which is no fun. If this happens to you in the Bay Area go straight to the San Francisco office; the San Jose office doesn't have deferred inspections so you'll probably just have to go there anyway.

Your dependent on the E3D Visa will need to fill out an I-765 work authorisation form. This will take up to 3 months to process; you can find out the approximate queue time here. The form doesn't appear to have been updated for E3D; I would strongly recommend getting a lawyer to file it for you so you don't stuff it up. Budget about $400. After this has been processed, the dependent will then need to file for a SSN before they can be paid.

Tax is a black-art. In California expect to pay something like 20-25% federal, 10% state and up to 7% more for Medicare and social security. Expect another $80/month for health insurance.

You can get a bank account without a SSN easily. A good way to transfer money is OzForex, but watch out for fees on the US side (you may have to do wire-transfers which cost about $10 a go, though some banks have bill-pay). The country still runs on cheques for some reason.

You can rent without a SSN, but it will cost you. Budget for 2 months extra rent as deposits and paying ahead.

A car lease is probably a good way to go. Finance will usually look at your visa and only give you a two-year loan, and with no credit that will be at a very high interest rate. In California you can get a 2 year lease on a base model new car (sticker price ~$17,000) drive-away for a down-payment of about $2500 and then $250/month plus taxes. Insurance will be about $120/month on-top of that. The beauty is you just give it back when you go home. For long holiday trips SUV rental may contribute to global warming, but is a very comfortable way to see the country.

In California you'll need to book in for a driving test to get a license; you can't do this in a rental car but some local driving schools offer a short introduction course and then let you use their car for the test.

If you're living in temporary accommodation without great facilities Dream Dinners is a good way to easily get some meals together.

In the Bay Area, Yelp is an awesome resource.

Comcast make Telstra look like a well-run, efficient and customer focused organisation!

Feel free to drop me a line if you're thinking of taking an opportunity and have any questions.

The lenny l10n NMU campaign is now running for about two months now. The objectives of this campaign are tackling pending po-debconf l10n bugs. The process is the following:

• Each day, pick two new packages from the list, going down and ignoring packages not in unstable
• for each, look over its pending l10n bugs *and* other easily fixable issues (of course RC stuff as well). I fixed many LSB headers bugs this way, helping out to achieve that lenny release goal
• try to build it
• if it builds successfully, send an "Intent to NMU" mail to the package maintainer and debian-i18n
• wait for 15 days (that leaves time to maintainers to react, or to have a discussion about the way to deal with such old bugs, etc)
• without news or in case the maintainer agrees before the deadline, send an announcement of upcoming NMU, again to the package maintainer and debian-i18n. Also notify translators with incomplete translations
• wait for 10 days
• build the package, test it and upload it to DELAYED/2-day
• send the full patch to the maintainer

Of course, when the maintainer wants to upload him herself, I immediately stop any action....but I still watch what happens and I nag her him in case nothing happens. In short, you can escape from my trap once I got you! Status as of now:

• 39 packages NMU'ed or updated by their maintainer
• 31 pakcages under work

A few utterly outdated and obsolete packages have also been removed fro mthe archive. All this helped the statistics for many languages to raise up. However, thanks to the effort of many maintainers who invest a lot of energy in emptying down the bottle we're filling up, the top languages statistics don't really move (new debconf templates, modified ones, etc.) With the lenny release becoming closer, I expect package maintainers to calm down now and leave us the opportunity to completee our l10n work without moving the target away when we reach it. The closer the release, the more aggressive l10n NMUs will be. Even for recent bug reports. Those translation issues are the easiest ones to fix, so please fix them. Please also note that I'll very happily sponsor any non DD upload which just fixes l10n issues.

A few days ago, I just screwed the samba packages maintenance. It's been quite some time since we were preparing Samba 3.2.0 packages. Upstream has not published a release version, only pre-releases. The release was planned for next week but will not happen as some last minutes issues have been found in pre-releases. Anyway, we had ready packages for 3.2.0 pre-release 2....which were planed to go to experimental. However, these packages were under preparation for quite a while, so when I finally agreed with Steve Langasek that it's OK to upload, I built and uploaded the packages. Then got a good laugh when discovering that I forgot "UNRELEASED" as target in debian.changelog. It was late, I then "s/UNRELEASED/unstable" as I often do in such case....then uploaded...then forgot about the issue and went to something else. The package went through NEW (it has a new binary package) and 1 or 2 days later quietly entered unstable. ...which I discovered only the next day, when it was way too late to remove from unstable something that was meant for experimental. All this explains why samba packages now use an epoch...:-) Things are back to normal now. Unstable has 1:3.0.28a-2 and experimental will hopefully have 3.2.0~pre2 soon. Next week I go to the Samba annual conference. I'll probably spend some time hunting down some bugs in the package and discuss with upstream about some of the issues we have (old bugs, FHS patch, upstream's .deb packages). And maybe also get better ideas about Samba 3.2.x schedule, to be able to decide with Steve and Noel which release is the target for lenny: 3.0.28* or 3.2.x.

As stated yesterday, I have recently worked on some plugins for Ruby on Rails, and I do think they are usable (and useful!) for audiences larger than myself. So, today I'll present here the second such plugin.
acts_as_catalog implements a really simple but really common pattern - Catalog-tables (or should I say catalog-models?) Granted, the amount of code this plugin saves is not very large, but it does add maintainability for our code-base, and includes basic unit tests. Of course, you can also taka a look at its SVN repo. Models A catalog is defined as a table with only a name column of string type, and with a unique index on it (this means, does not allow for duplicate values). Of course, more attributes can be added to a model which acts_as_catalog - they will just be ignored by this plugin. This plugin allows you to specify your model definition as:

  def Mytable < ActiveRecord::Base
    acts_as_catalog
    belongs_to :some_other_table
  end

A catalog is often accessed to populate i.e. drop-down selection or radio boxes, passing what is called collections in Rails-speak. You will often want collections to be sorted by ID or by name, thus:

  collection = Mytable.collection_by_id
  another_col = Mytable.collection_by_name

Migrations You can specify all the catalogs you need to create for a specific migration with a single instruction from inside your self.up method, by giving a list of catalog table names to create_catalogs:

  def self.up
    create_catalogs :countries, :states
    ...
  end

Likewise, you can destroy the created catalogs in a single command. The
drop_catalogs method will usually be the last thing you call in self.down:

  def self.down
    ...
    drop_catalogs :states, :countries
  end

Tests This plugin provides the base functionality to include in your unit tests ensuring the catalog is properly declared. Just include ‘catalog_test_helper’ and include the CatalogTest mixin in your test classes, declare the model name, and off you go. This is, a complete unit test for you Mytable catalog model could be:

  require File.dirname(__FILE__) + '../test_helper'
  require 'catalog_test_helper'
  class MytableTest < Test::Unit::TestCase
    include CatalogTestHelper
    def setup
      @model = Mytable
    end
  end

One of the loveliest things about Unix is the select() function (or its replacement, poll()), and the way it lets a single thread handle a host of concurrent tasks efficiently by just using file descriptors as work queues. Unfortunately, it can be a nuisance to use – you end up having to structure your program as a state machine around the select() invocation, rather than the actual procedure you want to have happen. You can avoid that by not using select() and instead just having a separate thread/process for every task you want to do – but that creates a bunch of tedious overhead for the OS (and admin) to worry about. But magically making state machines is what Python’s generators are all about; so for my little pet project that involves forking a bunch of subprocesses to do the interesting computational work my python program wants done, I thought I’d see if I could use that to make my code more obvious. What I want to achieve is to have a bunch of subprocesses accepting some setup data, then a bunch of two byte ids, terminated by two bytes of 0xFF, and for each of the two byte inputs to output a line of text giving the calculation result. For the time being at least, I want the IO to be asynchronous: so I’ll give it as many inputs as I can, rather than waiting for the result before sending the next input. So basically, I want to write something like:

def send_inputs(f, s, n):
	f.write(s) # write setup data
	for i in xrange(n):
		f.write(struct.pack("!H", i))
	f.write(struct.pack("!H", 0xFFFF))
def read_output(f):
	for line in f:
		if is_interesting(line):
			print line

Except of course, that doesn’t work directly because writing some data or reading a line can block, and when it does, I want it to be doing something else (reading instead of writing or vice-versa, or paying attention to another process). Generators are the way to do that in Python, with the “yield” keyword passing control flow and some information back somewhere else, so adopting the theory that: (a) I’ll only resume from a “yield” when it’s okay to write some more data, (b) if I “yield None” there’s probably no point coming back to me unless you’ve got some more data for me to read, and (c) I’ll provide a single parameter which is an iterator that will give me input when it’s available and None when it’s not, I can code the above as:

def send_inputs(_):
	# s, n declared in enclosing scope
	yield s
	for i in xrange(n):
		yield struct.pack("!H", i))
	yield struct.pack("!H", 0xFFFF)
def read_output(f):
	for line in f:
		if line is None: yield None; continue
		if is_interesting(line):
			print line

There’s a few complications there. For one, I could be yielding more data than can actually be written, so I might want to buffer there to avoid blocking. (I haven’t bothered; just as I haven’t worried about “print” possibly blocking) Likewise, I might only receive part of a line, or I might receive more than one line at once, and afaics a buffer there is unavoidable. If I were doing fixed size reads (instead of line at a time), that might be different. So far, the above seems pretty pleasant to me – those functions describe what I want to have happen in a nice procedural manner (almost as if they had a thread all to themselves) with the only extra bit the “None, None, continue” line, which I’m willing to accept in order not to use threads. Making that actually function does need a little grunging around, but happily we can hide that away in a module – so my API looks like:

p = subprocess.Popen(["./helper"], stdin=PIPE, stdout=PIPE, close_fds=True)
comm = communicate.Communication()
comm.add(send_inputs, p.stdin, None)
comm.add(read_output, None, p.stdout, communicate.ByLine())
comm.communicate()

The comm.add() function takes a generator function, an output fd (ie, the subprocess’s stdin), an input fd (the subprocess’s output), and an (optional) iterator. The generator gets created when communication starts, with the iterator passed as the argument. The iterator needs to have an “add” function (which gets given the bytes received), a “waiting” function, which returns True or False depending on whether it can provide any more input for the generator, and a “finish” function that gets called once EOF is hit on the input. (Actually, it doesn’t strictly need to be an iterator, though it’s convenient for the generator if it is) The generator functions once “executed” return an object with a next() method that’ll run the function you defined until the next “yield” (in which case next() will return the value yielded), or a “return” is hit (in which case the StopIteration exception is raised). So what we then want to do to have this all work then, is this: (a) do a select() on all the files we’ve been given; (b) for the ones we can read from, read them and add() to the corresponding iterators; (c) for the generators that don’t have an output file, or whose output file we can write to, invoke next() until either: they raise StopIteration, they yield a value for us to output, or they yield None and their iterator reports that it’s waiting. Add in some code to ensure that reads from the file descriptors don’t block, and you get:

def communicate(self):
    readable, writable = [], []
    for g,o,i,iter in self.coroutines:
        if i is not None:
            fcntl.fcntl(i, fcntl.F_SETFL, 
                        fcntl.fcntl(i, fcntl.F_GETFL)   os.O_NONBLOCK)
            readable.append(i)
        if o is not None:
            writable.append(o)
    
    while readable != [] or writable != []:
        read, write, exc = select.select(readable, writable, [])
        for g,o,i,iter in self.coroutines:
            if i in read:
                x = i.read()
                if x == "": # eof
                    iter.finish()
                    readable.remove(i)
                else:
                    iter.add(x)
            if o is None or o in write:
                x = None
                try:
                    while x is None and not iter.waiting():
                        x = g.next()
                    if x is not None:
                        o.write(x)
                except StopIteration:
                    if o is not None:
                        writable.remove(o)
    return

You can break it by: (a) yielding more than you can write without blocking (it’ll block rather than buffer, and you might get a deadlock), (b) yielding a value from a generator that doesn’t have a file associated with it (None.write(x) won’t work), (c) having generators that don’t actually yield, and (d) probably some other ways. And it would’ve been nice if I could have somehow moved the “yield None” into the iterator so that it was implicit in the “for line in f”, rather than explicit. But even so, I quite like it.

The latest news related to the Beijing Olympic games is that Kevin Rudd (our Prime Minister) has said “It is absolutely clear that there are human rights abuses in Tibet. That’s clear-cut; we need to be upfront and absolutely straight about what’s going on,” - stating the obvious really. If that was all that happened then it wouldn’t be particularly interesting. The paper version of “The Age” quotes George Bush as seconding Kevin Rudd’s statement. I believe that this is quite significant. Bush is well known for being stupid, the fact that he is now following the example of someone else who is doing good things is a very positive thing for the world. When John Howard was our Prime Minister we had an idiot (Howard) following an even bigger idiot (Bush) and the result was not good. Kevan Gosper (an Australian IOC board member) said “They just take their hate out on whatever the issues are at the time, and that hate against the host country is being taken out on our torch“. People who are totally corrupt sometimes seem confused when other people are motivated by moral principles, maybe we have a culture clash between the corrupt IOC board and the attitudes of most people in the rest of the world (I can’t think of any other way to map Kevan’s statement to reality). Mr Rudd has confirmed that Chinese “security guards” (soldiers) will not be permitted to operate in Australia to protect the Olympic torch from protesters, but the “security guards” have been operating in the UK. I read about this on the web site of The Age, but I won’t link to them because they have a lot of broken links with the following explanation - I am not going to link to sites that are so transient in nature (linking to The Age would lower the quality of my blog). Incidentally does anyone know of a news service in Australia that has reliable pages which stay online? We could not find the page you requested. This is often because older content has been removed from our site. In most cases you can still find the item via our archive service, News Store, where you can buy articles for a small fee. It also has the following text which indicates that the most visible problem is probably transient, but the fact that they deliberately break links is unacceptable to me: If you reached this page from a link on our site, please contact the webmaster (choose Technical faults) and tell us the address of the faulty page and the address shown for this page. The MSN article about the meeting between Bush and Rudd also had an interesting quote from Nancy Pelosi (speaker of the house in the US congress) [1]. She said “As I said in India last week where I met with His Holiness the Dalai Lama, if freedom-loving people throughout the world do not speak out against China’s oppression in Tibet, we have lost our moral authority to speak out on behalf of human rights anywhere in the world” and that the IOC made a mistake in awarding the games to China. Pelosi is not known for being left-wing (the US Democratic party is centrist/right by the standards of most democracies) so it’s interesting to see her take a stand on this issue. Erich Schubert has written about this, he points out that the Olympics are not about sports [2]. Well of course the Olympics are about money, drugs, and sports-science! I’m not sure that I agree with Schubert and Pelosi, the Chinese Olympics has focussed a lot of international attention on what China is doing - this has to be good for human rights. The Olympic games are a white elephant, running them costs a huge amount of money and there is no evidence that they actually make money for the host country once the opportunity costs are taken into account. Maybe we should give the Olympics to Zimbabwe or the Sudan next?

• [1] http://www.msnbc.msn.com/id/23845275/


• [2] http://blog.drinsama.de/erich/en/2008040901-boycott-olympia.html

Share This

IP, as a field of law, sometimes strikes as one unbelievably large and profitable game of make believe and this case, concerning a digital adaptation of chess-like game, a dead (famous) Marxist, his estate, and widow, makes this “game” all the more absurd (but somewhat entertaining, as all games should be)

I have mostly shifted my main development language to Ruby, as most of the work I do tends to be pretty well covered with Rails. That's not new, however - What is new is that I feel I have got to the point where I actually have something to share. And it feels very good.
So my next couple of posts (three, actually) will be covering some plugins I've written. They are, of course, just sketched - but they work reliably enough to be deemed as useful by their author ;-)
Today I will start by blogging about RealFK. Of course, I will be copying from its documentation/description - I wrote it as well, so I'm not really plagiarizing my own site. I'm not suing self. You can of course also browse the RealFK SVN tree. References Rails is built upon a "dumb database" concept. Rails assumes the database will not force restrictions upon the user - i.e. that the model validators are all there is. But I disagree ;-) I was raised with PostgreSQL, not with MySQL, and I do believe the database can and should impose sane values - It should impose trust on the data..
So, if you want to create a relation field, properly acting as a foreign key and refering to another table, instead of doing it via the ActiveRecord::ConnectionAdapters::TableDefinition#column (or even ActiveRecord::ConnectionAdapters::TableDefinition#references) methods, declare them with add_refrence:

  def self.up
    create_table :proposals do  t 
      (...)
    end
    create_table :proposal_types do  t 
      (...)
    end
    create_table :proposal_statuses do  t 
      (...)
    end
    add_reference :proposals, :proposal_types
    add_reference :proposals, :proposal_statuses, :null => false, :default => 1
  end

The corresponding fields (proposal_type_id and proposal_status_id, respectively) will be created in proposals, and the RDBMS will impose a Foreign Key constraint. The references can be removed via remove_reference, i.e., for inclusion in down migrations:

  def self.down
    remove_reference :proposals, :proposal_types
    remove_reference :proposals, :proposal_statuses
    drop_table :proposal_statuses
    drop_table :proposal_types
    drop_table :proposals
  end

Of course, in this case the remove_reference call is not really needed - But if you are dropping a table that is referred to from a table that will remain existing, you will have to remove the foreign key constraints (that is, the referring columns). Join (HABTM) tables When you define a simple has_and_belongs_to_many (HABTM) relation in your model, you are expected to create an extra table representing this relation. This is a very simple table (i.e. it has only a row for each of the related table‘s IDs), and it carries foreign key constraints.
Please note that join tables are not supposed to carry any extra columns - If you need to add information to join tables, think twice and better use a has_many :elements, :through => :othermodel declaration, and create the othermodel table manually. To create a HABTM table representing that each person can attend many conferences and each conference can be attended by many people:

  def self.up
    create_table :people do  t 
      (...)
    end
    create_table :conferences do  t 
      (...)
    end
    create_habtm :people, :conferences
  end
  def self.down
    drop_habtm :people, :conferences
    drop_table :people
    drop_table :conferences
  end

The last call will create a conferences_people table (according to Rails' conventions, table names are sorted alphabetically to get the join table‘s name).
Note that in this case, in the down migration, the drop_habtm call must appear before the drop_table calls, as it carries foreign key constraints.

I do very little law-firm-life blogging here, although that life is where I spend the overwhelming majority of my time. Consider Real Lawyers Have Blogs (something of a misnomer — they mean real firms have blogs). Counterpoint: Be Careful What You Post (motion to amend to assert defamation counterclaim against new defendant for comment on blog entry granted). In any event, in case I have any law firm associate readers, I’ll send props to the ABA’s free Litigation Podcast. It has a high signal to noise ratio, and the episodes are usually short enough to complete in my walk to and from the train. I’d like to draw attention to the latest post (”cast?”), The Secrets of Superstar Associates (21.1 MB MP3). Although on some level the advice should seem obvious, the “rules of the game” are seldom spelled out so clearly. I recommend it to any law students looking to join a firm and junior associates as well. In fact, even if you’re not a lawyer, much of the advice is transferable to surviving in any highly-skilled-professional organization. Technorati Tags: ABA, American Bar Association, Litigation Podcast, Law Firm

Share This

• Virgin is testing the use of babassu oil and coconut oil blended with regular jet fuel in commercial flights [1]. They have flown with 20% bio-fuel and tests indicate that they could use up to 40%. This is a difficult problem to solve as most bio-fuels either have problems with vaporising at low pressures or becoming too viscous at low temperatures, it’s good to see some progress on this.

Interesting Rolling Stone article about the US government encouraging idiot “terrorists” [2].

Cory Doctorow predicts a poor future for hardware e-book readers [3]. For my personal use a laptop is better for reading. In most cases when I’m going to do some reading I’m likely to want to write notes or be in a situation where I need my laptop for other purposes. So a laptop plus an e-book reader would be more weight and more battery problems than having just a laptop.

On page 2 of this article about what might happen if the source code to Windows was released freely [4] I am quoted. One thing I should note is that I have nothing against OpenSolaris, it’s merely one large project for which I could inspect the source if I didn’t have legal advice to the contrary. The situation of OpenSolaris may have changed in recent times, but I have not felt the need to seek further legal advice as there seems no real benefit in viewing the source. There is no shortage of GPL source that I would like to read if I had the time…

Location Independent - a blog about working from no fixed address and how to live on the move [5]. Should be of interest to all the people who seem fascinated by my living in hotels for ~18 months.

Martin Luther King Jr’s letter from a Birmingham jail [6]. Inspirational and it is also relevant when considering the positions that churches take today on moral issues. I found the link from The Reid Report blog [7] which is an interesting analysis of US politics.

Scientific American has an article about high altitude destroying brain cells [8], apparently this can happen even when there is no noticable injury and it is permanent. It seems that it would be a good idea to try and locate conferences to minimise air travel by delegates and speakers…

• [1] http://www.brisbanetimes.com.au/news/travel/coconut-jet-fuel-thats-nuts/2008/02/25/1203788223183.html


• [2] http://www.rollingstone.com/politics/story/18137343/the_fear_factory


• [3] http://www.locusmag.com/Features/2008/03/cory-doctorow-put-not-your-faith-in.html


• [4] http://www.itwire.com/content/view/17132/1090/1/0/


• [5] http://locationindependent.com/blog/


• [6] http://www.africa.upenn.edu/Articles_Gen/Letter_Birmingham.html


• [7] http://blog.reidreport.com/


• [8] http://www.sciam.com/article.cfm?id=brain-cells-into-thin-air

Share This

I received a glossy mass mailing today from “Axe Flix,” enclosing a DVD for a film supposedly entitled “A Diary.” (I haven’t loaded the DVD). The promotional copy:

AXE FLIX Did the resounding climax merit a four-hottie rating? Do the action scenes provoke a second go-around? Or did the ending leave her wanting just a little bit more? Be a critic. Rate this movie and you could WIN a year’s supply of Axe.

The whole thing seems suspicious. In my experience, most unsavory operations quickly come to light as such with a Google search. Oddly, there is only one result in a Google search for “Axe Flix”, and it’s not relevant. There is also no IMDB Entry for a movie called “A Diary,” nor do the named actors (Suzanne Knack, Patrick Kelly, Max Lenderman, Alexis Karsant, Jamie Butts, Chad Anderson) show up as real actors. It purports to be based on a best selling novel by “Robert Walker.” Also no dice. Can something possibly be real in this era without significant confirmation of its existence in Google? I think not. Ontology recapitulates search engine optimization. I’m writing this entry to create an anchor for future discussion. Does anyone have any idea what this is? The return address for “contest entries,” “Axe Spread the Love Sweepstakes, P.O. Box 511425, New Berlin, WI 53151,” also doesn’t provide many clues, other than possibly some relationship with toilet paper. Technorati Tags: Axe Flix, A Diary Update: it took all of thirty seconds for this entry to appear as the first result for several related Google searches, and another thirty seconds for me to get my first comment from someone else with the same question. Update 2: Based on discussion in the comments below, I seem to have unintentionally “fed the troll.” Maybe I wouldn’t have walked smack into this if I had heard of this product before. I guess this is my punishment for not having a cable or broadcast TV connection.

Share This

Mutt

Fran ois Marier has recently been posting some interesting entries about the Mutt mail client upon his blog. His tips are pretty basic, but that doesn't make them less useful. So here's my tip of the day: reply_regexp. When you're viewing a mail, and you choose to reply it the subject of that mail is the basis of your message's subject. For example given a message with "Subject: hello" your reply will typically have the subject "Subject: Re: hello". This is real rocket science here, people. Imagine you're using SPAM filtering which tags messages it isn't sure about with a prefix "UNS:". Suddenly things don't look so hot, as you might end up with a mail with the subject:

Subject: UNS: Re: Hello

Reply to that mail, whilst being half-asleep, and what do you get? You get this:

Subject: Re: UNS: Re: Hello

Bad. Ugly. Wrong. The following snippet in my ~/.muttrc file correctly deals with this case:

set reply_regexp="^(((UNS:[ \t]) [rR][eE]:[ \t])*)+"

Neat. Cool. Nice.

Advertising

I've paid for some advertising upon the LWN.net site. (No link, I'm not trying to game things here.) I didn't know what to expect, but I was willing to risk the expenditure as a way of saying thanks to them for their great content. (Because of my Debian Project membership I get a free LWN subscription, as do all developers. see here for details if you're a developer without a subscription.) I've paid $30 and that has given me a months run of my advert, with clickthroughs hovering around 1%. Not horribly bad at all! I probably won't repeat the experiment for the forseeable future, but I'm glad that I did it at least once. If you have something appropriate for a Debian-based audience don't forget you're welcome to advertise upon the Debian Administration website for free - See the Advert FAQ for details.

ObQuote: The Craft Update: jquery was accepted yesterday. Today I uploaded a new version to more closely align it with the javascript-policy.

I'm currently looking for a printer. I want a Laser printer, black & white should be enough, but color may be ok too if not too expensive (especially toner). I guess I prefer a network one, even if I don't really understand the way everything should work. As I understand it, a network printer just listens on a defined port (9100/jetdirect or ipp/63), and prints jobs sent by a spooler. There is no integrated spooler, so there are two solutions:

• install a cupsd on every box where I need to print (which is OK but a bit sub-optimal, imho, but I may be wrong)
• install a cupsd on only one box, wich will be the print server, and uses its address in /etc/cups/client.conf on every box I need to print on. This is ok, but on a home network there's no real need for a network printer in that case.

Maybe I shouldn't buy a network printer and just pick a usb one (especially since the FreeboxHD can serve as a laser printer if one plugs a usb printer on it. It listens on 9100/jetdirect so one can configure cups to pick it). I've currently narrowed my choices to:

• Samsung ML-2571n
• Lexmark e250dn wich is bigger but does duplex

Moe on #xfce avised me to pick a printer a bit more expensive, because it would be safer on a long term, and advised:

• Kyocera FS-1100n
  
• Brother HL-2150N

I don't really know what to do so, dear lazyweb, I'm asking you. What should I pick? This is for a home installation where we don't really print that often, so I don't want to spend too much, but where goodies like network and duplex printing are cool to have. Cups support is mandatory (except if there's another way to print easily, especially from gtk apps)

There are things that are unique in FLOSS development:

Author: nekral-guest
Date: 2008-04-04 19:43:33 +0000 (Fri, 04 Apr 2008)
New Revision: 1966
Modified:
   debian/trunk/Makefile
Log:
Add a cheesy check.
Modified: debian/trunk/Makefile
===================================================================
--- debian/trunk/Makefile       2008-04-04 18:50:22 UTC (rev 1965)
+++ debian/trunk/Makefile       2008-04-04 19:43:33 UTC (rev 1966)
@@ -1,4 +1,16 @@
 PKG=shadow
 SITE=ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow/
+deb:: check_cheese
+
 include /usr/share/quilt/quilt.debbuild.mk
+
+check_cheese:
+       @dpkg-parsechangelog   grep -q "\* The \".*\" release\."     \
+               echo ""; \
+               echo " **                                  **"; \
+               echo " **  Warning: not a cheesy release!  **"; \
+               echo " **                                  **"; \
+               echo ""; \
+               exit 1; \
+        

Summary: releases of the Debian shadow package all have the name of a French AOC cheese since July 2005. Nicolas, who was focused on a new upstrram release of shadow inadvertently forgot to add such name for the 4.1.1-1 release and thus added a failure of the package build process in case on forgets the cheese name. We should however give NMUers instructions about the right way to NMU the package, such as giving the name of a local cheese.