OK, after a mainboard replacement by HP, I have my AMD64 HP Pavilion DV6000 (DV6615ea) back and a quick update has given me working wireless! The last remaining obstacle has gone - the most recent 2.6.24 kernel update includes working support for the Broadcom Corporation BCM94311MCG wlan mini-PCI (rev 02) in the b43 kernel driver.
a little tip
When connecting this laptop to the mains for a recharge, plug into the mains before connecting the mains lead to the laptop itself. I have a strong suspicion (but it is no more than that) the repair was caused by a power spike from a dodgy extension cable. Plugging into the extension without the other end being connected to the laptop isolates such spikes.
Necessary support

$ uname -a

Linux dwarf 2.6.24-1-amd64 #1 SMP Thu Mar 27 16:52:38 UTC 2008 x86_64 GNU/Linux

 $ dpkg -l 'linux-image-2.6*'

 linux-image-2.6-amd64                 2.6.24+13 

 linux-image-2.6.24-1-amd64         2.6.24-5

Wireless config
The first dmesg output showed a useful tip:

Apr  4 20:07:06 dwarf kernel: b43-phy0 ERROR: 

  YOUR FIRMWARE IS TOO NEW. Please downgrade your firmware.

Apr  4 20:07:06 dwarf kernel: b43-phy0 ERROR: 

  Use this firmware tarball: http://downloads.openwrt.org/sources/broadcom-wl-4.80.53.0.tar.bz2

Apr  4 20:07:06 dwarf kernel: b43-phy0 ERROR: 

  Use this b43-fwcutter tarball: http://bu3sch.de/b43/fwcutter/b43-fwcutter-009.tar.bz2

Apr  4 20:07:06 dwarf kernel: b43-phy0 ERROR: Read, understand and _do_ what this message says, please.

Unpack the b43-fwcutter and call make. Execute ./b43-fwcutter ../broadcom-wl-4.80.53.0/kmod/wl_apsta.o, remove any existing firmware in /lib/firmware/b43/ and replace it with the content created by b43-fwcutter.
Reboot to load the updated firmware into the kernel and your amber wireless light will flash blue. sudo iwlist scan then shows the available access points and network-manager is able to connect without problems.
I'm posting this from the HP laptop over wireless.
Summary: this laptop should be eminently supportable in Lenny
After all my doubts and all the hassle, providing you use 'noapic nolapic' and the support of the Debian-Installer for Lenny.

Are you rebasing or merging? seems to be the 64 thousand dollar question over in vcs-pkg discussions. Various people have offered their preferences, and indeed, several case studies of work flows have been presented, what is lacking is an analysis of the work-flow; an exploration of which methodology has advantages, and whether there are scenarios in which the other work flow would have been better. Oh, what are all these work flows about, you ask? Most of the issues with packaging software for distributions have a few things in common: there is a mainline or upstream source of development. There are zero or more independent lines of development or ongoing bug fixes that are to be managed. And then there is the tree from which the distribution package is to be built. All this talk about packaging software work flows is how to best manage asynchronous development upstream and in the independent lines of development, and how to create a coherent, debuggable, integrated tree from which to build the distributions package. The rebasing question goes to the heart of how to handle the independent lines of development using git; since these lines of development are based off the main line of development, and must be periodically synchronized. Here is a first look at a couple of important factors that will have bearing on that question, and packaging software for a distribution using Git in general. This is heavily geared towards git (nothing else does rebases so easily, I think), but some of the concepts should be generic. I am not considering the stacked set of quilt patches source controlled with Git in this article (I don t understand that model well enough to do an analysis) As a teaser, there is a third answer: neither. You can just add an independent line of development, and just let it sit: don t rebase, and don t merge; and in some circumstances that is a winning strategy.

Today I woke up and found that nenolod.net expired. What? I hadn’t even received any expiration notifications from them. So, I immediately renewed and transferred to another registrar, and they sent me an e-mail with some hilarious excerpts begging me to stay with them:

GoDaddy.com, Inc. delivers superior value. Here’s how: 1. Guaranteed renewal price
2. Risk-free, money-back guarantee transfers
3. More FREE, value-added services with every domain
4. Consistently lower prices
5. Best-in-industry live customer support, 24/7
6. Fast, easy bulk domain transfers and registrations
7. Just-right, affordable hosting options
8. Superior domain search and management tools
9. Fierce protection of your personal information
10. Unique, valuable and innovative software and services

I’m not sure why I need any of these in a domain registrar. After all, it’s just a domain. I don’t think I will be missing these guys much. So if anyone was trying to send me mail and it didn’t go through, sorry about that.

A client of mine seeks a document management system to be run on a Linux machine, and I have no experience in this domain. I am turning to you for help, dear lazyweb, my client will make a donation to a FLOSS project of your choosing in return. I define document management system as an online file storage for OpenOffice.org/Word documents, spreadsheets, PDFs, and pictures. Thus, this is less about content management than about file storage and organisation, aimed at collaboration. The following are the sought features:

• Security
• Tag support
• Multi-user access control
• Support for bulk up- and downloads
• An ability to access the repository with WebDAV or SSH, to be able to manipulate files with command-line tools
• A web interface, ideally with AJAX for such tasks as moving and renaming files. Note that this is not a strict requirement if it s possible to organise the data properly via WebDAV, or similar.

Do you know of any tool we could deploy? I did come across BFExplorer, but that seems to lack support for tags, direct data access, bulk uploads, multiuser environment, and it s not received updates in more than a year. Suggestions welcome! NP: Pulp: Freaks

Today is the first day where we are really here and could work. After some initial troubles with the network setup here, we've managed that everybody was able to get internet access. There are some goal we would like to archieve during this worksession, these goals are:

• remove blocker bugs of our long standing issue #311188
  • bind9 patch
  • dhcp3 patch
  • slapd patch
  • switch syslog daemon to use rsyslog
• improve our dokumentation
• general hacking on ltsp
• further work on cdd-dev

After the first day the bind9 patch is completed and the dhcp3 is almost ready. Hopefully are the other days here in this nice town also so productive! I'll add some photos of this meeting after it is over to my gallery.

Since about half a year now we have a fibre to the home connection. This means that two fiber lines terminate at a box in our living room. It is a blown fibre which means that a tube is buried to your house, after which they use air pressure to put the actual fibre from the house to the POP. There are two fibers: one for bidirectional data (IP), and one that does nothing more than carry the analog cable TV signal. We started out with only the internet facility but now have so-called triple play: phone, analog tv and internet connectivity. The results are in: I find it to be just as good or better than the previous offerings: phone from KPN, tv from Casema or internet from Surfnet. But there's nothing revolutionary. Phone and tv just provide the same service over a different medium. The internet connection is with the standard of 24 Mb/s more than fast enough for any day to day use and an upgrade to 50 Mb/s is pending. A real improvement is that the upstream speed is just as high, very useful when uploading photos, packages or the text of this blog post. One drawback is that they only provide one IP address instead of 32. Also, the service provider (XMSnet) does seem to be a bit stuck in the late nineties with an unfriendly help desk telling you that your situation is impossible , and bad billing, There are plans however to open up the line to other providers in the future. So for now it's just a convenience bundling of services, but nothing really ground breaking. Let's see what the future brings.

Currently my SE Linux Play Machine [1] is running as a Xen DomU. So if someone cracks it they would also have to crack Xen to get access to directly change things on the hardware (EG modifying the boot process). As documented in my last post [2] a user of my Play Machine recently managed to change my password. Of course this was just two days after the vmsplice() kernel security flaw had been discovered [3]. Of course any machine that offers shell access to remote users (or the ability to run CGI-BIN scripts or other programs that users can upload) is immediately vulnerable to such exploits and while SE Linux has blocked local kernel exploits in the past [4] there will always be the possibility of kernel exploits that SE Linux can’t block or which can be re-written to work in a way that is not stopped by the SE Linux policy. So it’s best to assume that SE Linux systems are vulnerable to kernel exploits. At the time that the vmsplice() exploit was announced there was a claim that it could be used to de-stabilise a Xen Dom0 when run within a DomU. It’s best to assume that any attack which can make some software perform in an unexpected manner can also be used to successfully attack it. So at the time I was working on the assumption that the Dom0 could have been exploited. Therefore I reinstalled the entire machine, I firstly installed a new Dom0 (on which I decided to run Debian/Unstable) and then I made a fresh install of Etch for the Play Machine. There is a possibility that an attacker could compromise the hardware (changing the BIOS or other similar attacks), but this seems unlikely - I doubt that someone would go to such effort to attach hardware that I use for demonstrating SE Linux and for SE Linux development (it has no data which is secret). If someone attacks my Play Machine they would have to first get root on the DomU in question and then crack Xen to get access to the hardware. Then the machine is on a separate Ethernet segment which has less access to my internal network than the general Internet does (so they would not gain any real benefit). One thing an attacker can do is launch a DOS attack on my machine. One summer a Play Machine overheated and died, I suspect that the extra heat produced by a DOS attack contributed to that problem. But losing a low-end machine I bought second-hand is not a big deal. When discussing the machine there are two common comments I get. One is a suggestion that I am putting myself at risk, I think that the risk of visiting random web sites is significantly greater. Another is a challenge to put the machine on my internal network if I really trust SE Linux, as noted I have made mistakes in the past and there have been Linux kernel bugs - but apart from that it’s always best to have multiple layers of protection.

• [1] http://www.coker.com.au/selinux/play.html


• [2] http://etbe.coker.com.au/2008/04/02/se-linux-play-machine-passwords/


• [3] http://www.avertlabs.com/research/blog/index.php/2008/02/13/analyzing-the-linux-kernel-vmsplice-exploit/


• [4] http://doc.coker.com.au/computers/se-linux-saves/

Share This

... you type in "Barbapapa" in the YouTube search box to pass the time. =)

I've had a rough couple of days - it seems I've developed an intolerance to the pain meds that I was on. I went to the surgeon yesterday to see what we could do about the rash, the constant desire to throw up, and the complete aversion to eating.

I've switched meds now, and unlike at lunch when I went to work to go see some coworkers and I picked over half a bowl of soup, I've had a half-dozen pancakes and a half bowl of a rice-tofu-soyrizo dish that Angie made for dinner.

We're still tweaking the quantity and frequency of the meds (We started at 1 every 6 hours, and are now at 2 every 4 hours), but hopefully we've got it right now.

On the upside, the surgeon visit went very well. They like the way incision is healing, they took X-rays and everything seems good. I have a referral to a physical therapist now (Anyone know a good one around Mountain View?) and I'm permitted to start that in a week or two. My next follow up is at the 6-week mark, and the surgeon says that he'll probably clear me for sitting in the hottub then.

Yay, hottub!

My stamina continues to improve despite this - yesterday I managed a 4-block walk downhill, stopped for dinner, then a 4-block walk uphill again. If you've been to the UCSF medical centre, you'll know what I mean - everything is uphill or downhill from there. Today I went into the office and sorted out some more short term disability paperwork and some more banking paperwork. I'm feeling good about returning to work at the beginning of June.

As one of the maintainers of the iso-codes package, I feel somewhat ashamed to carry that name today. I just proposed my fellow co-maintainers that we take some symbolic action as a kind of protest in the next upstream release of iso-codes. As a French citizen, I'm ashamed that my country's standard organisation, AFNOR, finally turned its planned NO vote into an abstention at the very last minute. It would have been the only european NO vote as far as I can see from unofficial records of who voted what. Kudos to Brazil, Canada, Ecuador, India, New Zealand, South Africa, Venezuela. I should add China to this but the current actions in Tibet prevent me from doing that. And I can't really support dictatures like Cuba and Iran. (of course, I'm talking about OOXML becoming a 'standard', you'd have guessed, right?)

Dear lazyweb: I claim to know quite a bit about the IPv6 theory, but I lack experience. I have a couple of hosts out there which are already properly IPv6-addressable and work, but I don t have a network scenario. Unfortunately, I also don t have a lot of time available for this right now. I was thus wondering if anyone of you knew of a document that explained the Debian way of

• how to add IPv6 to an existing network, using addresses determined from the IPv4 address.
• how to convert this into a network with custom addressing.
• how to connect this network to one of my IPv6-addressable hosts via a tunnel and set up the routing/advertising to make the hosts on my home network globally addressable.

I know of documents like Juliusz Getting IPv6 connectivity under Linux (linked from the Debian IPv6 project page, and of course the work by Peter Bieringer (with whom I ve worked previously), but I have not found a concise explanation of how to set it all up with minimal hacks on a Debian system. If noone has such a document, I might have to bite the bullet. Ping me if you want to cooperate. Let me know! NP: The Phoenix Foundation: Pegasus Update: From Waikato, Matt Brown sent this howto on 6to4. I sent back a small number of corrections and hope he ll incorporate them soon. On a related note, I am making good progress getting my Debian systems linked up to the future. I used the excellent SixXS tunnel broker to route 2^80 addresses to my home router and set up another tunnel to one of my native IPv6 hosts in the net. I also added 6to4 to two of my servers. This should give me enough for further experimentation, and eventually for netconf testing. I ve been keeping notes and you can expect a document with simple explanations for everything that I did. But before that, I want to get behind some kernel bugs related to netfilter, such as state INVALID matching valid packets in kernel 2.6.24 and before and conntrack failing to treat ICMP replies as RELATED with kernels 2.6.18 and 2.6.22. The latter seems fixed in 2.6.24, which isn t backported yet, but which we can expect to be in Etch-And-A-Half and Debian lenny. Stay tuned

My SE Linux Play Machine [1] has been online again since the 18th of March. On Monday the 11th of Feb I took it offline after a user managed to change the password for my own account (their comment was “ohls -lsa! i can change passwordls -lsals -lsa HACKED!“). Part of the problem was the way /bin/passwd determines whether it should change a password. The previous algorithm (and the one that is currently used in Debian/Etch) is that if the UID of the account that is having it’s password changed doesn’t match the UID of the process that ran /bin/passwd then an additional SE Linux check is performed (to see if it has permission to change other user’s passwords). The problem here is that my Play machine has root (UID==0) as the guest account, and that according to the /bin/passwd program there is no difference between the root account (for unprivileged users) and the bofh account (which I use and which also has UID==0). This means of course that users of the root account could change the password of my account. My solution to this was to run chcon on the /bin/passwd program to give it a context that denied it the ability to change a password. The problem was that I accidentally ran the SE Linux program restorecon (which restores file contexts to their default values) which allowed /bin/passwd to change passwords, and therefore allowed a user to change the password of my account. The semanage tool that allows changing the default value of a file context does not permit changing the default for a file specification that matches one from the system policy (so the sys-admin can’t override compiled in values). I have now fixed the problem (the fix is in my Etch SE Linux repository [2] and has been accepted for Debian/Unstable and something based on it will go into the upstream branch of Shadow. See the Debian bug report #472575 [3] for more information. The summary of the new code is that in any case where a password is not required to change the user’s password then SE Linux access checks will be performed. The long version is below: The new algorithm (mostly taken from the Red Hat code base which was written by Dan Walsh) is that you can only change a password if you are running as non-root (which means that the pam_unix.so code will have verified the current password) or if you are running as root and the previous SE Linux security context of the process is permitted access to perform the passwd operation in the passwd class (which means it is permitted to change other user’s passwords). The previous context (the context before one of the exec family of system calls was called) is used for such access checks because we want to determine if the user’s shell (or other program used to launch /bin/passwd) was permitted to change other user’s passwords - executing a privileged program such as /bin/passwd causes a domain transition and the context is different) than the program that was used to execute it. It’s much like a SETUID program calling getuid(2) to get the UID of the process which launched it. To get the desired functionality for my Play Machine I don’t want a user to change their own password as the account is shared. So I appended password requisite pam_deny.so to the file /etc/pam.d/passwd (as well as the chfn and chsh commands) so that hostile users can’t break things. The new code in /bin/passwd will prevent users from taking over the machine if my PAM configuration ever gets broken, having multiple layers of protection is always a good thing. The end result is that the Debian package and the upstream code base are improved, and my Debian Etch repository has the code in question.

• [1] http://www.coker.com.au/selinux/play.html


• [2] http://etbe.coker.com.au/2007/10/19/my-se-linux-etch-repository/


• [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=472575

Share This

I wrote an essay several years ago called The Geek Shall Inherit the Earth: My Story of Unlearning. It's buried on my website but still manages to attract a consistent stream of readers. It's essentially the story of how I became a geek, about school, ADD, and free software. It is by far the most personal thing I've ever published. That said, several people have told me that it's influenced them deeply -- changed their views, politics and attitudes in important ways. In December, my friend Marcell asked me to give a version of the talk as part of his G33koskop series. I was hesitant to give such a personal talk but I did it anyway. I've finally got around to cleaning up the recording and have posted it online. You can download and listen to the talk here in Ogg Vorbis or here in MP3).

As outlined some days ago, patience is a requirement. That said, I'm glad that all things come to (s)he who waits, Lufthansa hardware finally landed! Ganneff, already very busy with his well-known DAM and ftpmaster hats, managed to also handle shipping some hardware donated by the Lufthansa some months ago. pkg-games was promised a powerful box, look: Pentium 4 (2400 MHz, 1024 MB); we will finally be able to try and provide backports in a semi-automated fashion, so as to ease stable users' life, when it comes to installing bleeding-edge versions of their favourite games! Thank you for making this possible and keeping everyone posted about the status of that hardware donation. Hopefully, it'll be possible to also communicate through bits of the DAMs , as suggested some weeks ago on debian-newmaint@. Yay for communication! \o/

So a year and a half ago, I mentioned I was trying to learn Haskell, and I still am. It’s been going much more slowly than I hoped, since I haven’t really spent any time on it. I never write anything new anymore! So I decided to rewrite something I had previously written myself, need be damned. So I chose the RSS aggregator I wrote, harsh. harsh hasn’t changed in eleven months (and that change was just about making the location of its configuration file configurable), but I still remembered how it worked pretty closely; at least enough that I didn’t have to really go searching through its code too much. That’s probably also a function of how small harsh is; in terms of lines of code (excluding blank lines):

  config.c: 139
  cookie.c: 221
 display.c: 709
    feed.c: 577
    list.c: 96
    list.h: 16
    main.c: 96
    main.h: 84
     md5.c: 360
     md5.h: 76
     rss.c: 120
     xml.c: 276
     xml.h: 17
     total: 2787

It uses expat to parse the HTML, libnbio for socket management (which is available in Debian), and ncurses for the UI. It doesn’t have any sort of threading (libnbio does a good job of making sure that, other than DNS lookups, there’s never anything going on long enough to prevent responsiveness). About its only feature is that it will use my cookies.txt file, so that I can see my LiveJournal friends’ protected entries. I originally wrote harsh in about a day or two. It was really easy because of the 2800 lines, about 850 of them had been written in some of my other projects (list.c/h and xml.c/h) or are standard (md5.c/h). I was also really familiar with the three helper libraries from writing grim (my IM client) and stark (a tool for viewing GnuCash data files). As a learning exercise, rewriting harsh in Haskell was excellent. It’s incredibly small, does a lot of standard things (like networking and console UI), and doesn’t do a lot of non-standard things (like an AIM client does). I got to play with the Haskell light-weight threads and STM; I learned how to create a Debian Haskell package; I learned how to use ghci as a debugger with breakpoints; and I’m much more comfortable with monads and with the language in general. It did take me significantly longer to write than the C version, though that’s more due to me having to learn not just the language but some libraries along the way (like HTTP, Vty, and HaXml). I still think that it would take me just as long to write the Haskell version as the C version, but I’m still much more comfortable with C, and imperative programming in general. From a code size perspective, the Haskell version is about one-sixth the size (excluding comments):

Config.lhs: 53
  Feed.lhs: 144
 Harsh.lhs: 272
  Util.lhs: 26
     total: 495

However, that’s not a very fair comparison. In the C version, md5.c/h are included in the total count, when really they should be considered a standard library (and on the Haskell side, I used Data.Hash.MD5 from MissingH). On the C side, I did all of the HTTP request and response processing myself (which is what more than half of feed.c is about), while on the Haskell side I left that to an HTTP client library. Excluding all those things though, the Haskell version is still about one-fourth the size. Anyway, I put the Haskell version of harsh up here. If any Haskell hackers out there could take a look at it and let me know what I’m doing wrong or oddly, I’d appreciate it.

Since yesterday I am through with my NM procedure. Looking back I get to the same conclusion as probably most NMs have: not overly hard, but time-consuming and glad to have it over with. Anyway, so far so good, just waiting for DAM approval and my account now. There are still a couple of people in front of me but I hope for another processing before the elections close. (I guess it would at least be good for the turnout.) For now, many thanks to my Application Manager Andreas Barth who has been very responsive and always answered my mails quickly and thoroughly, and also to Martin Zobel-Helas for advocating me.

I started a bread journal. It seemed that I was always taking pictures of my breads and showing them to people so I decided this is the best thing to do — people can look at or ignore it as they choose.

Via Lifehacker, legal cost-free books under copyright from Wowio. This is a great idea, and I give it even odds for being the future of books. (Or at least, part of books’ future).

What is WOWIO?
WOWIO is a new kind of online bookstore that enables readers to download ebooks for free, using commercial sponsorships to compensate authors and publishers. Readers get free ebooks. Sponsors get a powerful new channel to communicate their message to precisely the people they want to reach. Publishers get a new means of distributing their books, expanding their readership, and monetizing their intellectual property.

Does WOWIO use any kind of digital rights management (DRM)?
Since anyone can defeat the most “sophisticated” DRM with the print screen button, we believe that technology-based DRM is essentially a fraud. Our approach takes the market incentive out of misbehaving, rewards people for doing the right thing, and tries to stay out of the way of honest users. To help keep everyone honest, however, readers must authenticate their identity and agree to a licensing agreement when they set up their account. Then, each ebook is serialized with the reader’s authenticated name and a unique serial number, as well as other less visible markers. WOWIO will immediately terminate the account of anyone caught illegally distributing ebooks, and will prosecute serious offenders.

Technorati Tags: Wowio, Books, DRM, Digital Rights Management, Copyright

Share This

Last week I went to Puerto Rico to take my so-called spring break to visit my mom. I expected a semi-relaxing visit as her caretaker, Milagro, would be around and I also expected one last visit with my mother before embarking on the difficult process of moving her into a nursing home, which I planed to do over the summer. But a day and a half after I arrived, we brought her to the hospital because she basically had stopped eating and even drinking water and now that she has been released from the hospital, she has been placed in a nursing home. We brought my mom to the hospital because she was malnourished and dehydrated. To admit her was an exercise in managing a fireball of pure fury. Even if she was weak, she mustered every last piece of her energy so as to transform herself from a little old lady to a little old lady of pure Russian terror, unleashing her wrath left and right, not to mention up and down. But well, thanks to her (I think, somewhat calculated) wrath, at least they took her in immediately (despite a truly truly packed packed emergency room). Once inside, it took 4 nurses and her caretaker to put the initial IV in her arm and then they threw in a little haldol to calm her down. We waited nearly a day to find out that her doctor, Dra Nazario ordered a feeding tube without consulting with me or my sister (of course at some point they would need consent). At first I did not want a feeding tube put in her. But after talking with various nurses and other family members in the hospital with parents with Alzheimers, I decided to go for it. It is clear that my mom just does not eat enough and when she does, she eats poorly and I did not want to go through another traumatic visit in the emergency room at some future date to do the same. After her operation and after a few days of getting food, she was conscious but barely so. She did not want to talk, did not seem to be able to talk, and this of course, was heartbreaking because we thought that the operation, 4 days without food, and the really difficult hospital entry did her over. But once she developed slight pneumonia and an UTI, funny enough, she actually came back to life pretty much as she was before the hospital (which is still pretty limited but at least she did not seem any worse and it will be interesting to see what happens after she gets proper nutrition for a few weeks). So in the last 9 days I spent a lot of time in the hospital, more than I have ever spent in one. Let’s face it they are creepy places and exude a low-level, sometimes higher grade level of architectural and atmospheric grossness. The smell is so distinct: part disinfectant, part something that I can only describe as that of pre-death (or pre-rot), a smell that especially lingers for it co-mingles with the palpable sense of anxiety and worry (and tiredness) that family members carry with them. I took my mom to Hospital Pavia, which is supposedly one of the better hospitals in the San Juan metropolitan areas, and like 3 minutes from my house. And generally things were orderly and run well but there were a few times, when I was floored and beyond livid by they way they treated my mother and it is clear that a hospital is only as good as the doctors and the ability of the nurses to carry out their orders correctly. (more…)

As I type this my internet connection is being once again powered by my DG834G. It's also very dark, but that's because I'm observing Earthhour (I don't think it'll change the world, but I don't mind sitting in the dark that much and there's only me in the house). After my last OpenWRT/AR7 experiment I thought I'd bricked the Netgear. I ended up using my BT Home Hub as a stop gap solution and wondered how to proceed. I bought a Conexant Accessrunner USB modem and tried it with the WGT634U. This proved more stable than the USB Speedtouch, but still resulted in a couple of line drops a day at least. AR7 still seemed the way forward. I picked up a D-Link DSL-502T off eBay. This has a USB port, an ethernet port and no wireless. However it's AR7 based and has 4MB of flash and 16MB of RAM; the same as the Netgear. It also has a serial header already soldered on, so it was easy to connect my level shifter up and have a play. I built up a recent OpenWRT and managed to install it successfully and then hook it up to my ADSL. All seemed quite stable and I was feeling pretty happy. In parallel with this I'd picked up a cheap D-Link G604T off eBay - this has a 4 port switch and wireless and is basically the same hardware as the Netgear. It was listed as faulty, but I was hoping to be able to use it for parts or at the very least for testing. As it turned out it worked perfectly; didn't need to reflash it or anything to get it going. I put the image I had working on the 502T on it and hooked it up. Again, everything seemed stable. I managed to get the wireless detected ok, but the driver doesn't seem to support AP mode that well - there are big warnings in dmesg when you enable it. It's an acx111 chipset and unfortunately there doesn't seem to be a lot of upstream activity - there's some work on a version using the in kernel 802.11 stack, but it doesn't currently compile with 2.6.24 AFAICT. Anyway. I had working ADSL with OpenWRT, albeit without wireless (having the switch was useful though, as the router lives beside the media box but also needs to be connected to the switch upstairs in the study). I'd chased Enta a week ago about IPv6 but still not heard anything, so I gave them another prod. This time I got a speedy response indicated my account was now enabled for IPv6 and providing me with a /64. I added +ipv6 to /etc/ppp/options and restarted PPP and it all just started working. In addition I've configured up radvd on the box so everything on the ethernet autoconfigs. Flush with the success of all this I thought I'd try my Netgear again and see if it was really dead or if I could get the original firmware back on it. For some reason that worked first time and the router booted fine. So I thought I'd try OpenWRT again, given that I had an image I knew worked fine on another AR7 router - if it didn't work on the Netgear I'd know there was some sort of hardware difference or problem rather than a build issue. And it worked. My DG834G is now running OpenWRT SVN r10685, doing IPv6 and generally everything I need except for wireless. I've updated my DG834G page a little bit, including a link to the OpenWRT config I'm using. Hopefully the wireless will get there; certainly most chipsets seem to be getting much improved upstream support these days and I'm sure it must be possible for the ACX guys to make use of the in kernel stack to reduce their work.