Today I'm travelling home from 32c3, back to Aberdeen via London from Hamburg Airport. My experience passing through security to get to the gates this morning has angered me to the point that I had to vent. They have full-body scanners installed, which in my opinion are a massive invasion of my personal privacy. As I approached the security checkpoint, I noticed a sign where it stated that use of the scanner was not mandatory and that a manual screening process was available. Once I'd loaded my bags into the trays, I asked the security officer how to opt for the manual screening at which point I was told it was not available due to a lack of staff. I was forced to allow for an intimate scan to take place or miss my flight. I'm not really in a position to be making alternative arrangements for travel and so I had to submit but it has left me outraged. Privacy is about the ability to choose what I share and who I share it with. This was meant to be a right protected by the ECHR, but I guess human rights are outdated now we're entering 2016. Bring on the dystopian future!

2015 was another very busy year, but one of stabilization, rebuilding, and recovery. I got through the ramp-up period with my new job, found a better role inside the company for my personal talents and preferences, and ended the year on a professional high note. I also moved, to a place I like much better. It was a year for taking things as they come, focusing on priorities, letting other things slip, and being realistic about how much I can do. All of that, plus quite a lot of company, a business trip, and a few other unexpected distractions, meant less reading than I would have preferred. However, I did catch up completely on review writing, which is another happy sign of stabilization. Reviews came in spotty bursts, but they did come. The only explicit reading goal I'm making for 2016 is to read more than I did in 2015. I'm still working out the best priorities and schedule for me, and finding the best work/life balance points, so a predictable reading schedule will have to wait a while longer. The below statistics are confined to the books I reviewed in 2015, but thanks to significant catch-up work, I've only read one book that I have not yet reviewed (and I finished that one on December 31st). That book will be counted in 2016. Once again, the year saw two 10 out of 10 books, and once again, my favorite book of the year was written by Ann Leckie. The conclusion of the Imperial Radch trilogy, Ancillary Mercy, is as good or better than the start. The second book of the trilogy, Ancillary Sword, was also among my 2015 reviews and got 9 out of 10. I highly recommend the entire trilogy, beginning with Ancillary Justice (my book of the year in 2014), to anyone who hasn't read it. The second 10 out of 10 was non-fiction: Randall Munroe's What If? collection, featuring some material from the web site feature that accompanies xkcd and some original material. These are longer essays exploring interesting bits of science, math, and guesswork in the context of hypothetical questions that usually become surprisingly destructive. As the review says, try a few samples from the web site and see if this is your thing. I loved it. Despite my continuing low reading totals, this was a year full of fiction stand-outs. Becky Chambers's The Long Way to a Small, Angry Planet was the surprise of the year for me: a heart-warming, delightful story of chosen family. Jo Walton's My Real Children was less of a surprise because I already knew she is an excellent writer, but it was probably the best-written book I read all year. In turns sad, thoughtful, and determined, it's slice-of-life fiction so good that it overcame my normal dislike of that subject matter. Other fiction highlights are parts of series: the first two Steerswomen books by Rosemary Kirstein (The Steerswoman and The Outskirter's Secret), which dance between fantasy and scientific discovery, and Seanan McGuire's One Salt Sea, the best of all the October Daye books I've read. In non-fiction, the other book that stands out is Jenny Lawson's Let's Pretend This Never Happened. This combination of memoir and stand-up comedy in book form is one of the funniest things I've read, and it mixes that humor with self-awareness and generous openness. It's a book about being a little crazy and a lot anxious, finding ways to cope by laughing at yourself, and inviting the rest of the world to join in. Finally, Sydney Padua's The Thrilling Adventures of Lovelace and Babbage straddles the line between fiction and non-fiction, but certainly deserves a place in the year-end round-up. Full of great art, humor, steampunk, footnotes galore, and numerous forms of geekery, it's a collection I've been waiting for since Padua's very occasional comic got its moment of Internet fame. The full analysis includes some additional personal reading statistics, probably only of interest to me.

It is with great sadness that I learned of the passing of Ian Murdock. I have never had the chance to meet him. Several persons testify for his kindness and talent. We will always remember him. His legacy influences our lives everyday!

Looking at his latest blog posts, he seemed a bit nostalgic about Debian and still very proud of it.

Later, he wrote about how he came to find Linux and the importance of telling the story of hackers of his generation. In his memory, I'll reread Stephen Levy s Hackers for the nth time too.

When (if?) his webserver will shut down, you will still be able to read his past blog posts using the archived version of his website or a static mirror that has been set up.

RIP Ian.

I woke up this morning and realized that for the first time since 17 April 2001, I am no longer a member of the Debian Technical Committee. My departure from the committee is a consequence of the Debian General Resolution "limiting the term of the technical committee members" that was passed amending the Debian Constitution nearly a year ago. As the two longest-serving members, both over the term limit, Steve Langasek and I completed our service yesterday. In early March 2015, I stepped down from the role of chairman after serving in that role for the better part of a decade, to help ensure a smooth transition. Don Armstrong is now serving admirably in that role, I have the utmost respect for the remaining members of the TC, and the process of nominating replacements for the two now-vacant seats is already well underway. So, for the Debian project as a whole, today is really a non-event... which is exactly as it should be! Debian has been a part of my life since 1994, and I sincerely hope to be able to remain involved for many years to come!

FTP assistant Due to Christmas, I only marked 254 packages for accept and rejected 17 of them. I had to send 14 emails to maintainers. Squeeze LTS This was my eighteenth month that I did some work for the Squeeze LTS initiative, started by Raphael Hertzog at Freexian. As other members of the LTS team had to give back some hours of their workload, this month my initial workload of 18.25h had been increased to 21.25h. Altogether I uploaded those DLAs:

• [DLA 370-1] bind9 security update
• [DLA 373-1] libxml2 security update
• [DLA 375-1] libpng security update

I also started to work on CVEs for packages t-coffee and pitivi, only to recognize that the versions in Squeeze are not affected. Further I prepared patches for passenger and srtp but I could not test them yet, so an upload will be in January. This month I also experienced something strange. Due to the upload of the new version of mysql, I had to process a package for squeeze-lts in NEW. I seldom see a package, that creates so much red output from lintian. I assume this always happens when an old package will be checked by the latest lintian and is a good sign for all the development within Debian. I also tested Raphaels patch for #796784 and could confirm that everything works as expected. Unfortunately the php5 upload must be delayed until Januar. This month I also had another week of frontdesk duties. Other stuff The Advent season is over and the Debian Med Advent Calendar is full to bursting. The incredible number of 150 bugs have been closed this year! Due to the GSL transition a new upload of all meep packages had to be done and all in all I could close #748822, #807210, #807212, #807213, #807214, #807215 and #807747.

In the 4th quarter of 2016, we will freeze Debian Stretch. If you are hoping to do any larger changes for Stretch, please consider starting on them now. This also includes features that need to be in APT/dpkg (etc.) in Stretch, so we can start using them for Buster. Even something as trivial as the automatic dbgsym packages took over 8 months to complete (from the prototype was announced in April). I call it trivial because:

• The specs were simple and were fairly easy to implement
  • Not to mention, the basic idea was already implemented before in e.g. Ubuntu (albeit differently).
• The chosen implementation only had 3 primary tools affected that truly blocked deploying dbgsym packages in Debian.
  • dak
  • debhelper
  • dpkg
• I have yet to hear anyone being against the idea itself.
  • There were some concerns about various implementation details. Fortunately almost all of them had trivial or obvious solutions.
• We could deploy dbgsym packages immediately once the primary tools had been patched in/for unstable.
  • Compared to Multi-Arch, Build-Profiles etc., where we had to wait till the next release before using the feature.
  • It also meant we could immediately test that the feature worked as intended (rather than discovering bugs post release).

NB: There were certainly other parties involved. But these were the most important ones. Mind you, the dbgsym saga is not complete yet. We are still lacking support for migrating dbgsym packages to testing (and, by extension, the next stable release as well). Meanwhile, you can pull the dbgsym packages from snapshot.debian.org. In summary: If you want a larger change to land in Debian Stretch, please start already now. :)
Filed under: Debian, Release-Team

Review: One Salt Sea, by Seanan McGuire

Series:	October Daye #5
Publisher:	DAW
Copyright:	September 2011
ISBN:	1-101-54760-X
Format:	Kindle
Pages:	368

This is the fifth book of the October Daye series. It's the best book of the series to date, at least in my opinion, but this is a series with a substantial cast and political complications. You could probably start here and work out things on the fly, since each story is largely self-contained, but much of the emotional resonance would be lost. As expected for this series, Toby's life doesn't have much time to stabilize after the events of Late Eclipses. This time, though, the initial threat is less personal and more political. The children of the rulers of the Duchy of Saltmist have been kidnapped, and war between Saltmist and the Kingdom of the Mists (Toby's home) is very near. All that stands in the way of horrible casualties, of fae that can scarce afford more death, is Toby's desperate detective work. Toby's confidence and belief in her own abilities has been growing steadily throughout this series. One of my favorite themes in fiction is someone who doesn't really believe in themselves but tries anyway, because they couldn't live with themselves if they didn't, and discovers they're more capable than they thought. In this series, I think that works best when Toby is less scared and more angry, which is very true in One Salt Sea. That's one reason why I liked this book better than either An Artificial Night or Late Eclipses. Another is that I love the politics and the depth of world-building and lore that McGuire brings to this series, and One Salt Sea is a showcase of both. We get the Undersea Duchy of Saltmist, which comes from both different traditions and different fae than the series so far. We get a plot that combines political maneuvering with a more traditional detective story than the last few books. We get more hidden traditions, past alliances and enmity that Toby didn't know about, and further development of Toby's own abilities. She has to tug hard on some threads, move between levels of the fae world, and draw on her network for uniquely fae forms of forensic analysis. I thoroughly enjoyed it, particularly the rocks. (You'll know what I mean when you get to that part.) But the best thing about this book, by far, is the Luidaeg. I've mentioned in reviews of previous books that the Luidaeg is my favorite character of the series. One Salt Sea just cements that. This is the deepest that the Luidaeg has been involved in a story: she gives Toby her mission at the start, substantial help along the way, and is deeply involved in the ending. We even learn some of her own background, and some of her own worries and pain. (And foreshadowing that there's more of this to come, which I'm eagerly looking forward to.) She's moved from a strange ally through a cautious friend to some combination of aunt and mother to Toby, while always staying her irascible and occasionally painful self. The bits with her in this book are the best so far, and there are a lot of them. It's a delightful reading experience. McGuire also uses this story to clear up a plot element that's been lingering since the first book of the series, but that never worked emotionally for me. (I'm talking about this indirectly since it's a significant spoiler.) It's a great resolution, one with heft and emotion and hard choices and pain, and largely makes up for the showing rather than telling that we've gotten in the previous books, while also (at least I suspect) graciously shuffling that plot out of the way in future books. It's a good bit of series work and personal growth for Toby, and I think frees the series to focus on the bits I enjoy the most. The ending of One Salt Sea hurts, but it's a good hurt, full of hard choices made well, bravery, and sacrifice. The best moments of this series have always had that, but I think this book is the most successful delivery of the whole package to date. This has always been a solid urban fantasy series, but I think it's getting better as it goes along. One major reason is that McGuire doesn't seem to be running out of world-building oomph. In a lot of urban fantasy, particularly the werewolf and vampire sort, I feel like the lore gets thinner, more rehashed, and more mundane as the series ages. But McGuire is still introducing new elements, showing existing elements from new directions and in new light, and has been slowly building major puzzles around Toby's life and abilities that intrigue me. And, even more rare, the eventual revelations usually live up to the preceding tension. It's certainly a recipe to keep me reading. Followed by Ashes of Honor. Rating: 9 out of 10

Happy New Year 2016. I wish all the readers of this blog, and everyone else, a good start into 2016, may some of your wishes and hopes become true!

I gave a presentation at 32C3 this week. One of the things I said was "If any of you are doing seriously confidential work on Apple laptops, stop. For the love of god, please stop." I didn't really have time to go into the details of that at the time, but right now I'm sitting on a plane with a ridiculous sinus headache and the pseudoephedrine hasn't kicked in yet so here we go.

The basic premise of my presentation was that it's very difficult to determine whether your system is in a trustworthy state before you start typing your secrets (such as your disk decryption passphrase) into it. If it's easy for an attacker to modify your system such that it's not trustworthy at the point where you type in a password, it's easy for an attacker to obtain your password. So, if you actually care about your disk encryption being resistant to anybody who can get temporary physical possession of your laptop, you care about it being difficult for someone to compromise your early boot process without you noticing.

There's two approaches to this. The first is UEFI Secure Boot. If you cryptographically verify each component of the boot process, it's not possible for a user to compromise the boot process. The second is a measured boot. If you measure each component of the boot process into the TPM, and if you use these measurements to control access to a secret that allows the laptop to prove that it's trustworthy (such as Joanna Rutkowska's Anti Evil Maid or my variant on the theme), an attacker can compromise the boot process but you'll know that they've done so before you start typing.

So, how do current operating systems stack up here?

Windows: Supports UEFI Secure Boot in a meaningful way. Supports measured boot, but provides no mechanism for the system to attest that it hasn't been compromised. Good, but not perfect.

Linux: Supports UEFI Secure Boot[1], but doesn't verify signatures on the initrd[2]. This means that attacks such as Evil Abigail are still possible. Measured boot isn't in a good state, but it's possible to incorporate with a bunch of manual work. Vulnerable out of the box, but can be configured to be better than Windows.

Apple: Ha. Snare talked about attacking the Apple boot process in 2012 - basically everything he described then is still possible. Apple recently hired the people behind Legbacore, so there's hope - but right now all shipping Apple hardware has no firmware support for UEFI Secure Boot and no TPM. This makes it impossible to provide any kind of boot attestation, and there's no real way you can verify that your system hasn't been compromised.

Now, to be fair, there's attacks that even Windows and properly configured Linux will still be vulnerable to. Firmware defects that permit modification of System Management Mode code can still be used to circumvent these protections, and the Management Engine is in a position to just do whatever it wants and fuck all of you. But that's really not an excuse to just ignore everything else. Improving the current state of boot security makes it more difficult for adversaries to compromise a system, and if we ever do get to the point of systems which aren't running any hidden proprietary code we'll still need this functionality. It's worth doing, and it's worth doing now.

[1] Well, except Ubuntu's signed bootloader will happily boot unsigned kernels which kind of defeats the entire point of the exercise
[2] Initrds are built on the local machine, so we can't just ship signed images

comments

The following is a short summary of my open source work in December, following up on my first report in November.

Debian

• Uploaded mopidy-dirble 1.2.0-1: New upstream release.
• Created the pkg-mopidy Alioth team to set myself up for sharing the maintenance of Mopidy packages. As I upload new releases, I ll gather the git repositories of Debian packages related to Mopidy here. My intention is for the team to follow the DPMT policy closely.
• Sponsored: python-ase 3.9.1.4567-2, which adds Python 3 support.

Mopidy

• The feature/gst1 branch: Finished porting Mopidy from GStreamer 0.10 to PyGI and GStreamer 1.x. Merge of the branch is currently blocked on a single test failure (test_gapless) and issues with transitioning from one track to another with Mopidy-Spotify, which is the only backend using an appsrc for playback. The goal is for this branch to be part of Mopidy 1.2, which I hope to have in Debian/Ubuntu before the Ubuntu 16.04 import freeze February 18.
• The feature/py3-compat branch: I ve worked quite a bit on this private branch, frequently rebased on top of feature/gst1. Currently Mopidy starts without any crashes on Python 3 and the test suite is down to 262 failed and 1841 passed tests. My current thinking, is that this will become part of a Mopidy 2.0 release, which will support both Python 2.7 and 3.4+. As soon as most of Mopidy s extension ecosystem supports Python 2+3, a new Mopidy major release (3.0?) will drop Python 2 support.
• Merged a bunch of pull requests, both targeting the 1.1.2 bug fix release and the 1.2 feature release.

I didn t know Ian Murdock but the news about his passing left me with a very strange and sad feeling, because he started the project that creates the tool that I use every day in my work, and everyday in my communication with my family and friends, and everyday for anything computer related It s like if somebody puts a treasure in your hands and you got distracted looking at it and when you head up to look at the person and say Thank you , he s gone And, in the last years, Debian for me is not just my favorite tool , I ve been slowly getting involved in the community, known some people here and there, been able to put some work to try to improve some small parts, been able to work with other people as a team, and I ve been touched many times admiring how the Debianers work, how they talk and write, how they behave to each other and to the ones that reach the community for first time, and to the world, since most of the communication and work is public I ve felt myself helped, welcomed, encouraged, empowered. Not only in my computer related skills or the improved capabilities of my humble hardware. I ve felt myself helped, welcomed, encouraged and empowered in important areas of my life (understanding other points of view, caring about the ones that don t speak aloud, enjoying diversity and becoming flexible to make it flourish, making friends ). And I like to think that I try to emulate that and help, welcome, encourage, empower others too I m learning. Thanks Ian, for this alive and growing treasure that is Debian (the OS, the community), and thanks Debian, for the past, present and future miracles.
Filed under: My experiences and opinion Tagged: Communities, Contributing to libre software, Debian, English, Moving into free software

Here is my monthly update covering a large part of what I have been doing in the free software world (previously):

• Released try.diffoscope.org, a hosted version of the diffoscope in-depth and content aware diff utility. Thanks to Bytemark for sponsoring the hardware.
• Announced travis.debian.net, a hosted script to easily test and build Debian packages on Travis CI.
• Wrote an Chrome extension for the FastMail web interface that reminds you if you neglect to attach a file if you mention one in the body. (Repo)
• Added graphical image comparison using to diffoscope using libcaca. (commit)
• Did further work on a free-software healthcare project.
• Added the ability to hide Zwift activities in my Strava Enhancement Suite Chrome extension. (#40)
• Updated the Django web framework documentation to discourage the use of filenames in /tmp with predictable names. (#5864)
• Corrected a Python 3.5-ism and a double-encoding issue in django-slack.
• Increased the size of the search form on codesearch.debian.net. (#59)
• Added support for filenames alongside the existing URL support for book cover images in my media database. (code)
• Corrected a trivial typo in FreeBSD's pkg package management tool. (#1353)
• Attended the 32nd Chaos Communication Congress.

---

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donators (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it s one of the best ways to find volunteers to work with me on projects that matter to me. Debian LTS This month I have been paid to work 21.25 hours on Debian LTS. During this time I worked on the following things:

• Sent a first patch and later an updated patch to modify DAK so that it can send the accept/reject mails to the signer of the upload instead of the maintainer. Details in #796784.
• Uploaded MySQL 5.5 compabitility fixes for phpmyadmin and postfix-policyd so that we could release MySQL 5.5 as an upgrade option MySQL 5.1 (see DLA 359-1).
• Released DLA 361-1 on bouncycastle after having gotten the green light from upstream.
• Released DLA 362-1 on dhcpd fixing three CVE.
• Released DLA 366-1 on arts fixing one CVE.
• Released DLA 367-1 on kdelibs fixing one CVE.
• Handled the LTS frontdesk for a whole week.
• Sponsored the upload of foomatic-filters for DLA 371-1.
• Filed #808256 and #808257 to get libnsbmp/libnsgif removed. Both packages had recent CVE and were sitting unused in Debian since their introduction 6 years ago
• Released DLA 372-1 announcing the end of support of virtualbox-ose.
• Updated git repository of debian-security-support to account for the former change and also took care of a few pending issues.
• Released DLA 376-1 on mono to fix one CVE.
• Added some initial DEP-8 tests to python-django that will help to ensure that a security update doesn t break the package.

Distro Tracker I put a big focus on tracker.debian.org work this month. I completed the switch of the mail interface from packages.qa.debian.org to tracker.debian.org and I announced the change on debian-devel-announce. The changes resulted in a few problems that I quickly fixed (like #807073) and some other failures seen only by me and that were generated by weird spam messages (did you know that a subject can t have a newline character but that it can be encoded and folded over multiple lines?). Related to that I fixed some services so that they send their mails to tracker.debian.org directly instead of relying on the old emails (they get forwarded for now but it would be nice to be able to get rid of that forward). I updated (with the help of Lucas Nussbaum) the service that forwards the Launchpad bugs to the tracker, I sent a patch to update the @packages.debian.org aliases (not yet applied), I updated the configuration of all git commit notice scripts in the Alioth collab-maint and python-modules project (many remain to be done). I asked Ubuntu s Merge-O-Matic to use the new emails as well (see LP 1525497). DAK and the Debian BTS still have to be updated, as of yet nobody reacted to my announce last but not least I updated many wiki pages which duplicated the instructions to setup the commit notice sent to the PTS. While on a good track I opted to tackle the long-standing RC bug that was plaguing tracker.debian.org (#789183), so I updated the codebase to rely on Twitter s bootstrap v4 instead of v2. I had to switch to something else for the icons since glyphicons is no longer provided as part of bootstrap and the actual license for the standalone version was not suitable for use. I opted for Github s Octicons. I made numerous little improvements while doing that (closing some bugs in the process) and I believe that the result is more pleasant to use. I also did a lot of bug triage and fixed a few small issues like the incomplete architecture list (#793547), or fixing a page used only by people with javascript disabled that was not working. Or the invalid links for packages still using CVS (ugh, see #561228). Misc packaging Django. After having added DEP-8 tests (as part of my LTS work, see above), I discovered that the current version in unstable did not pass its test suite so I filed the issue upstream (ticket 26016) and added the corresponding patch. And I encouraged others to update python-bcrypt in Debian to a newer version that would have worked with Django 1.9 (see #803096). I also fixed another small issue in Django (see ticket 26017 with my pull request that got accepted). I asked the release managers to consider accepting the latest 1.7.x version in jessie (see #807654) but I have gotten zero answer so far. And I m not the only one waiting an answer. It s a bit of a sad situation we still have a few weeks until the next point release but for once I do it in advance and I would love to have timely feedback. Last but not least, I started the maintaining the current LTS release (1.8.x) in jessie-backports. Tryton. I upgraded to Tryton 3.8 and discovered an issue that I filed in #806781. I sponsored 5 new tryton modules for Matthias Behrle (who is DM) as well as one security upload (for CVE-2015-0861). Debian Handbook. I uploaded a new version to Debian Unstable and requested (to the release managers) the permission to upload a backport of it to jessie so that jessie has a version of the package that documents jessie and not wheezy contrary to my other Django request, this one should be non-controversial but I also have had zero answer so far, see #807515. Misc. I filed #808583 when sbuild stopped working with Perl 5.22. I handled #807860 on publican, I found the corresponding upstream ticket and discovered a work around with the help of upstream (see here). Kali related work I reported a bug to #debian-apt about apt miscalculating download size (ending up with 18 EB!) which resulted in a fix here in version 1.1.4. Installing a meta-package that needed more than 2GB was no longer possible without this fix and we have a kali-linux-all metapackage in that situation that gets regularly installed in a Jenkins test. I added captcha support to Distro Tracker and enabled this feature on pkg.kali.org. I filed #808863 against uhd-host because it was not possible to install the package in a systemd-nspawn s managed chroot where /proc is read-only. And we started using this to test dist-upgrade from one version of Kali to the next Thanks See you next month for a new summary of my activities.

No comment Liked this article? Click here. My blog is Flattr-enabled.

Amb el cor compungit, Debian lamenta la p rdua d'Ian Murdock, ferm partidari del programari lliure i de codi obert, pare, fill i l'"ian" a Debian. L'Ian va comen ar el projecte Debian l'agost de 1993, i va publicar les primeres versions m s tard el mateix any. Debian es convertiria en el sistema operatiu universal pel m n, que funciona en tot tipus de dispositius, des de sistemes encastats fins a l'estaci especial. L'Ian es va centrar en crear una distribuci i una cultura de comunitat que fessin el correcte, ticament o t cnica. Publicar quan estigui a punt i la ferma posici sobre la llibertat de programari s n les regles d'or en el m n del programari lliure i de codi obert. La seva devoci per fer el correcte va guiar la seva feina, tant a Debian com els seg ents anys, sempre treball per assolir el millor futur possible. El somni de l'Ian est viu, la comunitat de Debian continua incre blement activa, amb milers de desenvolupadors que treballen innumerables hores per proporcionar un sistema operatiu segur i fiable. Els pensaments de la comunitat de Debian s n amb la fam lia de l'Ian en aquests moments tant durs. La seva fam lia ens ha demanat privacitat en aquests moments dif cils i volem respectar-ho. Des de Debian i des de la comunitat de Linux en general podem enviar mostres de condol a in-memoriam-ian@debian.org; seran guardades i arxivades.

With a heavy heart Debian mourns the passing of Ian Murdock, stalwart proponent of Free Open Source Software, Father, Son, and the 'ian' in Debian. Ian started the Debian project in August of 1993, releasing the first versions of Debian later that same year. Debian would go on to become the world's Universal Operating System, running on everything from embedded devices to the space station. Ian's sharp focus was on creating a Distribution and community culture that did the right thing, be it ethically, or technically. Releases went out when they were ready, and the project's staunch stance on Software Freedom are the gold standards in the Free and Open Source world. Ian's devotion to the right thing guided his work, both in Debian and in the subsequent years, always working towards the best possible future. Ian's dream has lived on, the Debian community remains incredibly active, with thousands of developers working untold hours to bring the world a reliable and secure operating system. The thoughts of the Debian Community are with Ian's family in this hard time. His family has asked for privacy during this difficult time and we very much wish to respect that. Within our Debian and the larger Linux community condolences may be sent to in-memoriam-ian@debian.org where they will be kept and archived.

Con el coraz n compungido, Debian lamenta el fallecimiento de Ian Murdock, firme partidario del software libre y abierto, padre, hijo y el 'ian' en Debian. Ian empez el proyecto en agosto de 1993, publicando la primera versi n de Debian m s tarde en el mismo a o. Debian se convertir a as en el sistema operativo universal para el mundo, funcionando en cualquier dispositivo, desde sistemas embebidos hasta la estaci n espacial. Ian se centr en crear una distribuci n y una cultura de comunidad que hiciera lo correcto tanto en lo tico como en lo t cnico. Publicar cuando est listo y una postura firme sobre la libertad de software son las reglas de oro en el mundo del software libre y de c digo abierto. La devoci n le gui en su trabajo, tanto en Debian como en los a os posteriores, siempre trabajando hacia un futuro lo mejor posible. El sue o de Debian est vivo, la comunidad permanece incre blemente activa con miles de desarrolladores que trabajan incontables horas para ofrecer un sistema operativo seguro y confiable. La comunidad de Debian da el p same a la familia en este momento tan dif cil. Su familia nos ha pedido discreci n durante estos momentos dif ciles y deseamos respetarlo. Desde dentro de Debian y de la amplia comunidad de Linux podemos expresar nuestras muestras de condolencia a in-memoriam-ian@debian.org, donde ser n guardadas y archivadas.

During our development sprint at 32c3 [1] and remote, we managed to get our--long awaited--mailing list server online:

• Arctica Project's Announcements Mailing List
• Arctica Project's Developers' Mailing List
• Arctica Project's SCM Mirroring Mailing List

Happy subscribing to those who are interested in remote desktop computing on Linux. Disclaimer: Please note that the Arctica Project is still in its infancy and we hope to have first releases during the upcoming year. Also we actively and intensively continue maintenance of what was formerly known as NX (version 3) [2]. light+love
Mike [1] https://events.ccc.de/category/32c3/ (traditionally down during the event)
[2] https://github.com/ArcticaProject/nx-libs

As of a few minutes ago, the old weblog on christoph-egger.org is past. I've added redirects for all the entries to the new one at weblog.siccegge.de.if you find any dead links please contact me so I can fix it up. Note that comments are gone. I'll try to include the already present comments on the new blog some time in the future. Not sure if I will ever add a comment function again (though chronicle seems to have some support for that)

I made a change recently on the gjay program. gjay is a gtk program that basically analyzes your music and makes playlists. There is a gui frontend and a analyzer back-end and they communicate through a pipe. One really useful debugging option gtk has is to make warnings fatal, so when gtk finds one it crashes at that point and you can use gdb to trap it. The flag is g-fatal-warnings. I have been updating gjay and initially it didn t have this option, so I needed to add the gtk options, which is a simple one-liner. But then gjay gave some odd errors about XCB. Often, but not every time gjay started on stderr the following cryptic messages appear:

[xcb] Unknown sequence number while processing queue
[xcb] Most likely this is a multi-threaded client and XInitThreads has not been called
[xcb] Aborting, sorry about that.
forktest: ../../src/xcb_io.c:274: poll_for_event: Assertion  !xcb_xlib_threads_sequence_lost' failed.

OK, so part of my init sequence was unhappy. The odd thing was it only appeared when I added the gtk options. I narrowed it down with some test code which displayed the error but stripped all the other parts out. What we got going on here is a simple gtk program. Line 11 with the gtk_get_option_group() was the line I added. The problem is that the child process is not quite setup and when the parent goes into gtk_main then you get those xcb errors. The options need to be parsed before the fork, because one of the options is to not fork (it just runs the child code directly and uses stdout with no GUI). Gjay is obviously a lot more complex than this, but follows the same pattern. There is the front-end looping through gtk_main and the back-end looping on g_main_run. The backend needs to use glib not gtk as there is a non-gui option which can be used. The solution is actually (but not obviously to me) in the documentation for gtk_get_option_group. The parameter for that function whether to open the default display when parsing the commandline arguments . Changing the TRUE to FALSE on line 11 stops XCB from complaining! The screen still appears fine but not more strange XCB messages.