Search Results: "cas"

25 February 2008

Uwe Hermann: Lest We Remember: Cold Boot Attacks on Encryption Keys

Just in case you haven't already read about this... Some researchers from Princeton have published a paper about methods which can be used to attack full-disk-encryption (FDE) schemes. They have demonstrated that at least BitLocker (Windows Vista), FileVault (MacOS X) and dm-crypt (Linux) are vulnerable to this type of (partly hardware-based) attack scenarios. Quite likely lots of similar other solutions are vulnerable as well. The main problem is that (contrary to popular belief) RAM does indeed retain its data for a non-trivial amount of time after power is cut (seconds, even minutes or hours if it's cooled down enough), so you can mount some new attacks such as:

Get physical access to laptop/computer, cut power to it (the hard way), reboot with a special live CD or USB thumb drive and some special software which dumps the RAM contents to an external disk (or sends it via network). As RAM contents are still there a few seconds after the power is cut, this works astonishingly well.
Get physical access to laptop/computer, open it, remove RAM DIMMs while the computer is running, insert them into your own prepared computer and read the RAM contents using some special software.

Yes, all attacks assume that the attacker has physical access to your PC/RAM, in which case you already have several other problems. Still, the new thing about this is that even full-disk-encryption doesn't help much in some cases. You probably shouldn't depend too much on it (but you shouldn't stop using disk encryption either, of course!). Full paper: coldboot.pdf. There are also some demo videos and pictures. More coverage at Boing Boing, Bruce Schneier's weblog, Freedom to Tinker, Slashdot, Heise (German), and many more... Make sure to read the comments of the various articles for more scenarios and possible ideas for how to prevent such attacks. Some ideas include enabling the BIOS RAM checks (which might explicitly erase RAM contents on reboot; that doesn't help in all cases, though) or using coreboot (previously LinuxBIOS) to erase RAM contents at boot-up and/or shutdown. It's a highly non-trivial issue, though, there's no easy and complete fix so far. The only sure way is to not have your laptop or PC stolen and to not give attackers physical access to your computers.

Pierre Habouzit: Dear John

wrt your issue yes it's true that for short series of patches, it's often asked to rebase it on a clean state if it doesn't merges fully, though if you're doing a complicated work, meaning dozens of patches e.g., it's usually two things:

you're a regular contributor ;
you spend quite some time working on it.

When this happens, upstreams are usually okay with merging from a public repository that you would set-up. Though, it's usually a tiny more work for the upstreams to work with a new remote repository, and those are only used for these cases. Also note that upstream could really fake the same work branching off from the point you branched off, and using git-am from that point instead of git am -3 on the top of the current devel branch (which is similar to a rebase, hence creates new sha's). IOW, it's not really a git deficiency (even if git-format-patch could maybe annotate _more_ where it comes from, and git-am grok that to re-create a topic branch from that) as git has the features, just that it probably doesn't make it easy enough, and that people usually don't care enough for very short series.

24 February 2008

John Goerzen: Git looks really nice, until....

So I have been learning about Git this weekend. It has some really nice-looking features for sure -- some things Mercurial doesn't have.

I was getting interested in switching, until I found what I consider a big problem.

Many projects that use git require you to submit things using git-format-patch instead of pushing/pulling from you. They don't want your merge history.

git-format-patch, though, doesn't preserve SHA1s, nor does it preserve merges.

Now, say we started from a common base where line 10 of file X said "hi", I locally changed it to "foo", upstream changed it to "bar", and at merge time I decide that we were both wrong and change it to "baz". I don't want to lose the fact that I once had it at "foo", in case it turns out later that really was the right decision.

When we track upstream changes, and submit with git format-patch, the canonical way to merge upstream appears to be:

git fetch; get rebase origin/master

Now, problem with that is it loses your original pre-conflict code on a case like this.

There appears to be no clean way around that whatsoever. I tried a separate "submission" branch, that rebases a local development-with-merge branch, but it requires a ton of git rebase --skip during the rebase process.

Thoughts?

Mike Hommey: Crazy ideas

I often have a bunch of somewhat crazy ideas, and I don’t have any time available to test or implement them, which is sad. So just in case these crazy ideas would scratch someone’s itch, I’m going to throw them in the wild. I’ve been using git for a few months, now, and used it not only for source code management, but for efficient storage, too. *VERY* efficient. I’ll have to write about that some day. Anyways, while installing pristine-tar, today, I just thought it would be neat to have an equivalent pristine-deb, to store deb files efficiently. I’m pretty sure someone else thought about this possibility, but it’s still better that such ideas come to the ears (eyes, actually) of someone that could implement them. Such a pristine-deb tool could be used to… store packages from snapshot.debian.net. That would reduce the amount of space required for the archive dramatically, IMHO. I’m pretty sure old packages are not requested that much, so they could be generated on-the-fly from a CGI script placed as a GET action, so that urls wouldn’t change. The same could probably be applied to archive.debian.org. It could even save enough space that archive.debian.org could host snapshot.debian.net. But that depends on the average package content and its average evolution, which I have absolutely no idea about. Update: It would also be interesting to have the .diff.gz files in there, too ; it would obviously allow to have an easy view of the contents, such as copyright files, changelogs, and other bits of information available on packages.debian.org. Update 2: Actually, pristine-deb would as easy as storing 2 pristine-tars (one for control.tar.gz and one for data.tar.gz), and a debian-binary file. The .deb can be aggregated with

ar -rc file.deb debian-binary control.tar.gz data.tar.gz

23 February 2008

Philipp Kern: Trouble with head and legs

Normally I don't have that much pain. Some headaches from time to time, and a busy nose, but that doesn't cause pain, just lots of used tissues. But now I'm at FOSDEM and on the way there yesterday I had some severe headaches and today my right leg and foot hurt quite much. What's up. I guess the latter is related to my slipping on the stairs of the Delirium, where the beer event took place. It got me covered in beer, which wasn't a problem (luckily only two, but well, both were half empty afterwards) but it seems that the bump had some consequences. (No, I wasn't drunk, but too many already spilled too much beer on those stairs.) Now I don't actually see much when looking at the leg, but it feels a bit burning. There's some light, though: I just enjoyed an extensive shower at the hotel and it provided me with some relief. In other news I just tried DesktopBSD and it failed. Apart from the screen being a bit blurry (like with radeonhd without the blitting fix applied) the main blocker was the missing WiFi support, but hey it's an Intel 3945, so it can't be that hard. Maybe I get around into implementing UPnP into Gobby soon, looking at UPnP's test code it does not seem too hard. Funny enough the router providing free WiFi at the hotel broadcasts UPnP stuff so the port mapping actions probably work (as UPnP does not offer any means of authentication). No pictures, yet. Heh.

Russell Coker: Giving Away Hardware

For the last few years I have been actively seeking free hardware to give to members of my local LUG. Whenever a friend or business associate mentions that they are upgrading or replacing computers I enquire what they plan to do with the old ones and request that the old gear be given to me if there are no other plans for it. There is a moderate amount of hardware that I use for my own purposes, but the free hardware that is available is often in excess of my requirements and also sometimes just unsuitable for my use (I am happy to install a second-hand IBM or HP machine for a client but I won’t install a white-box machine). One organisation that I sometimes give computers to is Computerbank [1]. The purpose of Computerbank is to take donations of old machines, fix them and install Linux, and then sell them for extremely low prices to people who can’t afford new machines. It’s been a while since I gave them any computers because for a long time the minimum specs on machines that they were willing to accept were higher than the machines that I obtained. Generally I offer my old hardware to the mailing list of Linux Users of Victoria [2]. I offer not only working systems but also broken systems and other things that might be useless to most people - but are greatly desired by the small minority who can use them. One member of that list wants PC power supplies for repairing other electronic devices, so I collect batches of machines that are broken but appear to have working PSUs and give them to him. I once received a box of free two-button mice. I offered them to LUV members expecting that many people would want one or two for test machines. No-one wanted them for use as mice but one guy wanted all of them to use their sensors in robotics projects. One thing that impresses me is the community spirit demonstrated. Often I will offer some free machines and the first response will be something like “I’d like to take that machine apart for the bits, but if someone wants a complete system please give it to them instead”. There aren’t many occasions when you see someone suggesting that they may not be the most deserving recipient for something that is free! My aims in this effort are to help random Linux users in my area, and to help the environment by reducing the amount of land-fill. My efforts aren’t going to make a significant impact on the environmental situation, but they do make a significant impact on the availability of hardware for members of the Linux community - which seems to be of particular interest to people who want cheap machines for their children or grand-children. I encourage other people to do similar things. One thing that impressed me was the organisation of used hardware gifts at LCA. Near the start of the conference hardware was given away to anyone who put their hand up. At the end of the conference more hardware was given away (I expect it was mostly by delegates who lived locally). It would be good if this idea (which worked so well) was spread to other conferences.

[1] http://vic.computerbank.org.au/

[2] http://www.luv.asn.au/

22 February 2008

Russell Coker: Watching While Waiting

Over the past four years every visit to a doctor or hospital has involved some time spent in a waiting room, in the case of hospital visits it has often been more than an hour waiting. Each of those waiting rooms has had a selection of bad magazines and a TV. If I ever visit a hospital after 8PM then I might have a chance of seeing something that I want to watch on TV, but otherwise it’s all awful. Fortunately there are better things that they could do. It would not be difficult to get a basic PC and install all the content from ted.com (and possibly other sites with quality free content) and have some sort of video juke-box program running. TED not only has lectures about arts and science but also performances by musicians and dancers. The chance that a random person can find something they enjoy in TED’s archives seems significantly greater than the chance of finding something worth watching in the daytime-soap TV segment. But TED is far from the only option available, there are quite a number of free video sites and the ones that include advertising in the video stream would probably be more than happy to have their content copied on to juke boxes.

21 February 2008

Davide Viti: Font tips #2: comparing fonts

Being able to compare images can be really useful sometimes; I found it extremely helpful when I wanted to know what changed between two releases of the same font. Imagemagick does the trick via a set of really powerful command line tools. Here's a very simple demonstration:

  
 pango-view --font="DejaVu Sans Mono" -t "Hello World" -w 180 -q -o a.png
 pango-view --font="DejaVu Sans Mono" -t "Hello world" -w 180 -q -o b.png
 compare a.png b.png hello_diff.png

which results in the following output:

We can now apply the previous tip to something more useful; let's say we want to know how the glyphs in a font changed from a release to another. In a previous post I've explained how to render all the glyphs into a nice PDF using fntsample; we just need to create PDFs for both releases and compare them... ain't that easy?

# Let's suppose you have already created PDF files inside the following dirs
a=dejavu-2.22
b=dejavu-2.23

vsdir="$ a _vs_$ b "
mkdir $vsdir

for f in $(find $a -name '*.pdf') ; do
 f=$(basename $f)
 apng=$ a /$ f/.pdf/ 
 bpng=$ b /$ f/.pdf/ 
 mkdir $ apng  $ bpng 

echo "*** $ f  ***"

 # pdf -> pngs
 convert $ a /$ f  $ apng /$ f/.pdf/ .png
 convert $ b /$ f  $ bpng /$ f/.pdf/ .png

 # compare pngs and, if different, show whre they differ in a png
 for p in $(find $ apng  -name '*.png') ; do
   p=$(basename $p)
   meas=$(compare -metric AE $ apng /$ p  $ bpng /$ p  $ vsdir /$ p  2>&1)
   if [ $ meas  -eq 0 ] ; then
       rm  $ vsdir /$ p  $ apng /$ p  $ bpng /$ p 
   else
       echo  " - $ p "
   fi
 done
done

This is what you get when a glyph was modified:

In case of newly introduced glyphs you get the following:

20 February 2008

Wouter Verhelst: FOSDEM keysigning party: list created

This morning, right before leaving for work and somewhat in a hurry, I created the list of keys for the FOSDEM '08 GPG key signing party. You'll find it at the keysigning website. Unfortunately, I fucked up a bit in that I forgot to check my mailbox. Apparently the key server was down for most of tuesday, and I didn't notice. Some people tried to send their keys, but couldn't. Also, the mail wasn't double-checked carefully enough. Grmbl. Next time, I'll try not to forget to do such things when I actually planned them—in the evening. Anyway; if your key has been received in time by the keyserver, you should have received an email this morning, and you should be in the list that I linked to, above. If you weren't then all is not lost; if you really want to participate, print out key fingerprint slips, and bring them to the party. This is not as efficient, and some people may choose not to accept such fingerprint slips, but at least you'll be able to get some signatures. If you didn't make it because the key server was down last night, I apologise (but then again, waiting for the last moment to participate isn't very smart...). Please also note that we only have two hours, and the list contains 202 people. As such, it may be the case that we won't be able to finish the entire key signing party; it may be the case that we'll have to cut it short. In any case, you will be able to sign a significant amount of keys, and a significant amount of people will be able to sign yours, so that should be good enough -- and you can do the rest next year, or so...

Jeff Bailey: Met with the surgeon.

Angie, Leif and I met with one the two surgeons who will be doing the work. I s'pose it's good and bad that the co-director of the UCSF Spine Centre, Dr. Mummaneni is personally taking on the case. Good that I'll have the best possible care; Bad that I'm apparently interesting enough to warrant it.

Meeting with him was matter of fact. He talked about how he'll approach the surgery (from the back, since the placement of my aortic arch and innominant vein would make coming through the front problematic). It looks like I'll have rods and screws from T1-T6, with a cage replacing the vertebra at least at T3 and possibly at T4. People don't usually do that much movement in their thoracic back so, ongoing, his opinion was that I largely won't notice it.

In hospital-time will depend on whether or not the surgery can be done in one shot. Because of the trickiness of the area, it may not be possible to get it entirely from the back, and he'll do two surgeries rather than one if that can avoid me winding up in a wheelchair. Ideally, there's one surgery, and a week later I'm home and able to take care of myself. The way they take the tumor out in a couple pieces is known as "en bloc spondylectomy", but may not be possible with the way the spinal nerve is being pinched. He described the surgery itself, and the simple version is "remove one or two vertebra, replace them with cages, stabilize the surrounding area". Yay to the Black and Decker surgical division.

He'll be assisted by Dr. Chau for spinal cord monitoring and the rest of the surgery.

The last thing they did as I left the hospital last Saturday was a full body CT scan with contrast, and the radiologists have declared that that they see no additional tumors in the body. I'll visit with an oncologist to do some final tests, but consistently the answer is coming back that this isn't cancer, it's more likely an isolated mutation. Dr. Mummaneni doesn't feel that this is a side effect of sitting at a computer since I was 3 years old, any of the car accidents, or being hit across the back with a flute case in grade 9.

I did ask if I'll set off metal detectors at airports after this, and apparently the titanium used doesn't do that.

So, erm. What are the risks? Honestly, pretty consistently less than doing nothing. Having this thing would eventually result in paralysis anyway, and aside from the usually OMG-they're-cutting-me-open-anything-could-happen type of things that don't keep me from biking to work on a regular basis, all the other options are "And life improves from here". Informed consent means that I have statistics in my head that I'd rather not dwell on and a laundry list of things to panic about when I wake up in the middle of the night but those really are just nerves acting up and stress wanting to come out. Nothing wrong with any of that.

Surgery is booked for March 3rd. We'd hoped to go to Vancouver for Leif's birthday around then, but I've been asked not to fly. Rapid pressure changes apparently will aggravate what's there now.

I feel good about this. I'm back to pretty much 100% after the hospital time last week, and noticed that after the embolism that I'm moving a bit freer than I was before. That's enough to start the optimism going already. We've also twiddled my medicine for every 8 hours rather than 6, which will help me sleep better, and reduced it, which will help me feel better.

Having time-frames and knowing that I'm in good hands is a lovely place to be after all that.

19 February 2008

Jonathan McDowell: Epic IPv6/DG834G fail

Since I've moved to Castlerock I've started using my DG834G to provide my ADSL again, as it was quick to setup and easily found in all the boxes. Up until now I've just been using it with the normal Netgear firmware, but I'm getting to the point where enough of the rest of the house is sorted that I want to think about the network layout. Part of that is enabling IPv6 (I'm with an Entanet reseller these days, and Enta claim to do IPv6), part of it is not bridging the wireless and wired networks (I'd like to be able to trust the wired one a bit more) and part of it is just being able to run useful bits on the router itself. Anyway. I had built up an OpenWRT SVN image last month and tonight I decided was the time to try it, having been putting it off for ages. Epic fail. Managed to get the backup of the Netgear image done fine, eventually got the new image on there, waited and waited and no joy. Wouldn't even ping on the LAN side. Further investigation showed that it would ping for a few seconds when first power cycled and then die. So I had to find my serial console level shifter so I could have a look. All signs point to it failing when loading the wireless or ADSL firmware blobs. Bah. I spent a while trying to get the old firmware back on it; ADAM2 seems really unhappy if it receives unexpected traffic (like, say, DNS requests because my network thinks the router is the DNS server/gateway) while you're ftping an MTD image. I got there, but decided I'd try out my WGT634U setup again, which is what I used in Norwich. Found the frog, fired up the router, changed my old Black Cat details to the new Enta ones and crossed my fingers. At first all appeared well (well, except for no IPv6 PPP; must email Enta to see if they need to tweak settings at their end for my username), but after a while it became apparent that the ADSL connection was flakey; it was resyncing every couple of minutes. Bum. It might just be the frog; I do have another one somewhere, but I ended up just falling back to the DG834G with the stock Netgear firmware ie exactly where I started this evening. I've pulled latest OpenWRT SVN and I see a few kernel/VLYNQ patches regarding AR7, so I shall try another build and see what happens. Epic fail. I shouldn't play with networking on a school night.

John Goerzen: Registrar Dynadot Conspires to Help Take Down Wikileaks?

Yesterday, Wired ran a story on the Cayman Islands bank that got Wikileaks.org blocked. This story said, in part:

When the bank's lawyers indicated they would be filing a suit, she asked them to tell her where so that Wikileaks could find an attorney in the appropriate jurisdiction to represent it. She says the lawyers refused to tell her. Two and a half weeks later, the bank filed a restraining order against Dynadot and Wikileaks in San Francisco. Wikileaks received notice only a few hours before the case went to a judge who accepted the agreement between Dynadot and the bank.

(emphasis mine)

Now, Dynadot and this Cayman Islands bank apparently had an agreement to block wikileaks.org already. Not only did Dynadot effectively take wikileaks.org down, but also they "lock(ed) the wikileaks.org domain name to prevent transfer of the domain name to a different domain registrar." The U.S. Disctrict Court for Northern California issued this injunction without ever giving Wikileaks a chance to respond. The bank only filed the request against Dynadot. Apparently Wikileaks received notification that this was going to happen only 6 hours before the hearing (an incredibly short time in legal terms), nowhere near enough time to prepare a case.

Now, the reason I post this is because I have looked at Dynadot as a registrar before. They have good prices and a whois privacy service that makes sense: where you remain the owner of record, making it easier if you need to transfer the domain or prove your ownership of it.

But before signing up, I read their AUP carefully. Among many alarming things, I noticed this paragraph:

You further agree that Dynadot, in its sole discretion and without liability to You for any resulting loss or damages, may take immediate corrective action, including, but not limited to, removal of all or a portion of Your domain services and/or deletion, suspension, cancellation, termination, or other interruption of domain services or Your customer account with Dynadot, at any time during the term of this Agreement, in the event of notice of any possible violation of this Agreement by You or Your end users, or if such service or account is used in association with morally objectionable activities, or for any reason whatsoever. In such cases, any and all fees paid to Dynadot will be non-refundable and ineligible for account credit.

So, I thought I would write to them about it. Here is an excerpt from their response:

We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.

From Wired's story, it doesn't look like that really happened. The US Government has already issued advisories about Cayman Islands banks, and it is unclear (to me at least) what law Wikileaks broke, or how Dynadot could find their actions of exposing fraud "morally objectionable". What's more, collaborating with the bank to get a takedown order written, but not talking to Wikileaks, seems to go against their statements to me (assuming again that the Wired story is accurate).
Here is my entire mail. You may also find archive.org's copy of the AUP from last July to be helpful. (I wrote the email in November, and they've added some sections since then, so the section numbers don't necessarily match up)

Subject: Re: SITE: Questions about your AUP

From: Dynadot Info <info@dynadot.com>

Date: Sat, 3 Nov 2007 13:42 -0800

To: jgoerzen@complete.org

Hello,
Thank you for your email. Responses are below.
Best Regards,
Dynadot Staff
--------------------------------------------------
DYNADOT... $8.99 domain names... $1/mo. web hosting
http://www.dynadot.com

Hi,
I currently have several domains being hosted with Gandi.  I have long been looking for someone that can provide a level of privacy for my whois data in a sane way.  I think Dynadot is the first I've seen that looks like it can do that and still be affordable.
In preparation to transfer over a first test domain, I read your AUP and frankly am quite troubled by what I saw.  I hope that you can allay my fears.
In section 4 of part 2, the last paragraph states that Dynadot "for any reason whatsoever" may delete, cancel, or terminate my domain services or customer account.  It also lists "notice of possible violation" as a justification for that.  That makes me even more nervous -- any random person could send you an email claiming something nefarious is happing with my domain name, and I'm agreeing to just let you delete it because of that?


We always conduct an investigation before taking action against a domain. We will give you a chance to respond to the complaints.

A very similar clause appears in section 7 of part 1 ("cancellation of services").  It goes on to cast a very broad net around objectionable material and says that Dynadot decides what's objectionable.  Now, if you go to my website at www.complete.org or blog at changelog.complete.org, you'll see I'm an upstanding netizen.  But the AUP says that things that "are designed to or effectively... embarrass" third parties could get my domain cancelled.  So if I post a review of Vista that says I think Microsoft did a poor job of engineering, would my account be yanked if one of their engineers complained?  What if I (legally!) linked to a Comedy Central sketch using real TV footage to mock George W. Bush or Hillary Clinton?


The cases you described above would never happen with us. Complaining about Microsoft or making fun of George Bush are protected free speech. The service agreement is designed to give us some flexibility in dealing with customers that break the law.

I'm particularly concerned about this because apparently DynaDot felt it worthwhile to try to take down the website of someone that found a security hole: http://www.jhuskisson.com/friends/dynadot-fights-back-bans-nick-from-everything
While I wouldn't condone step-by-step cracking instructions in most cases, this is concerning to me.


He was posting a step by step guide to hacking our website, which is illegal. The hack did not work, but we noticed an upsurge in strange activity in our logs, so we requested the hacking guide be taken down.

Finally, item (i) under the Domain Privacy Service section says that you could immediately reveal all my information upon the receipt of merely a *claim* (not even a court order), even if it's invalid.  But I thought that NOT doing this was what you were saying made your service better, over at http://www.dynadot.com/resource/article/qa.html?aid=0


Once again we need to build some flexibility into our service agreement to deal with people who use their domains for criminal activity. Otherwise we could be liable for the damages that they cause to others. So far, we have never dropped anyones privacy except in the few cases we were forced to by a FBI subpoena.

I know this is a long message, and I appreciate your time.  I really do want to use your service, but -- no offense intended -- I want to make sure I'm not dealing with scammers first, and from reading the AUP, I'm not so sure!


No offence taken. I will email our counsel to see if we can tighten up the agreement a bit.

-- John Goerzen

18 February 2008

Sylvain Le Gall: ocamlcore.org ongoing progress

With a small team, we are setting up ocamlcore.org. For now the site is quite experimental. This site should help OCaml developpers to have a common place to share their coding experience with other. This includes, but is not limited to, a planet and a forge. I think that we will be able to finish the setup of the planet quite soon, but i am uncertain about the forge settings, which is far more complicated. However, this is a great experiment, because i never have really try to set up this kind of things... I think this week (and this week-end) will help us achieve a great part of the settings of ocamlcore.org. We will have occasions to meet face to face with Stefano Zacchiroli and Romain Beauxis, either here in Paris or at FOSDEM.

Sune Vuorela: digital cameras

Dear lazyweb I have been looking for a small nice digital camera, one that of course takes nice pictures, but besides that have the following technical features:

connected with a “generic” usb cable

a usb mass storage device for the computer

battery charged over the usb cable

uses a generic memory card type (eg. sd)

I want it to be using a generic cable for charging and transfering pictures because I am not that good at not loosing cables and chargers and such so a replacement cable should be very easy to get. And I want it to be a usb mass storage because I want it working with any computer. It kind of seems hard to figure out what devices to look at. Most “technical specifications” doesn’t contain information on wether it is a USB A => USB mini B cable or some vendor specific cable, nor do they contain information on wether it is a usb mass storage device or a device requiring mtp/ptp. Canon looks like it is doing mtp/ptp over a generic cable - and with a external charger.
Samsung tells deep inside their manuals that it uses the usb mass storage driver. Samsung uses a vendor specific cable, but is also charged thru this cable.
Kodak seems to be using a generic cable, a external charger and undefined how the communication with the computer is.
Olympus seems to be using a vendor specific cable and a external charger. But it is a bit unclear. Seems to be able to do both mtp and usb mass storage
HP seems to use a generic cable, standard AA batteries and no charger bundled, seems to be configured to use usb mass storage.
Sony uses memory sticks which are just too expensive.
Casio seems to use a generic cable, a external charger and is a bit unclear about communication. Could be usb mass storage though.
Nikon seems to use generic cable, mtp protocol and a external charger Argf. What have I missed?

Michal Čihař: Network manager not working?

For a long time I had problems on my work computers with Network manager still thinking that it is not connected. And I was really lazy to debug it. But as more and more application take online/offline settings from it, this became more and more annoying. After some googling I found out that the problem might be in /etc/network/interfaces file, which is parsed by Network manager. Some "complex" things might confuse it. Well in my case the complex thing was calling of some script in post-up. Commenting this out magically fixes everything. Moving script to /etc/network/if-up.d/ also is not a big problem, but why the hell the Network manager thing does not tell where the problem is?

Stefano Zacchiroli: galax in debian

Galax in Debian version 0.9.9 in experimental / NEW Executive summary: Galax (a fast XQuery implementation with support for static typing) is now in Debian. After my introductory post on XQuery and how to use it in Debian I've got motivated again in finishing the Debian packaging of Galax. (Or was the motivation coming from the fact that Saxon-B is terribly slow and also the annoying thought that one has to pay for extra-optimizations and static typing?) Galax, on the contrary, is really fast, Schema-aware, and supports static typing out of the box (you won't discover too late that you've added an integer to a string-valued node). Galax is now (almost) in Debian: yesterday I've uploaded version 0.9.9 to experimental, but of course it will need to pass through NEW before being available to the public. In the meantime it is available from my repository, here's the needed sources.list line:
deb http://people.debian.org/~zack/debian unstable main
in case you wanna look at the source package you can do one of:
$ dget http://people.debian.org/~zack/debian/pool/galax_0.9.9-1.dsc $ debcheckout svn://svn.debian.org/svn/pkg-ocaml-maint/trunk/packages/galax/trunk
Getting started with Galax Mini howto for evaluating XQuery queries with Galax:
# aptitude install galax $ cat sample.xq <bookshelf> for $book in doc('books.xml')//book where some $surname in $book/author/last satisfies $surname eq "Stevens" return <title> xs:string($book/title) </title> </bookshelf> $ head -n 7 books.xml <bib> <book year="1994"> <title>TCP/IP Illustrated</title> <author><last>Stevens</last><first>W.</first></author> <publisher>Addison-Wesley</publisher> <price>65.95</price> </book> $ galax-run sample.xq xmllint --format - <?xml version="1.0"?> <bookshelf> <title>TCP/IP Illustrated</title> <title>Advanced Programming in the UNIX Environment</title> </bookshelf>
The galax-doc package contains much more documentation of course ...
PS this evening I'll travel to Paris, where I'll be for a week, moving to FOSDEM for the week-end. Drop me a note if you want to get in touch for beer/keysigning/whatever.

Wouter Verhelst: ID cards, followup

I should've known that posting something about ID cards would spark a number of reactions. In fact, I did—which is one of the reasons why I posted that; nothing like a bit of discussion every once in a while. Brian M. Carlson writes:
The difference between the US and Belgium, for example, is that Belgium has comprehensive privacy legislation.
Well, yes. Obviously, ID cards require some privacy legislation in order to prevent abuse of said cards. In Belgium, only the police is allowed to require me to show them my ID card; everyone else can ask, but I can tell them to go screw themselves. Of course they can then also refuse to provide me with a given service, but I may be able to sufficiently prove my ID with other means. The point is, whether or not a designated ID card exists does not impact the need for privacy legislation; if you want to protect your privacy, you need such legislation anyway, ID or no ID. The fact that you don't have an ID card does not mean in any way that people can't ask you to prove your ID; and the existence of an ID card does not mean that all of a sudden all other ways for me to prove my ID are null and void. "Anonymous" writes:
You seem to take as a given that we need an official government-issued ID card, and from there you draw the fairly reasonable conclusion that if we need one it ought to exist separately from a driver's license. I agree that your assumption leads to your conclusion, but I disagree with your assumption.
Well, no, I do not assume that we need an official government-issued ID card. I know we do. That's not to say we need government-issued ID in all cases where we need to provide proof of ID; but when we do, there should be a way that does not overload some document into something which it was never intended to be. "bignose" writes:
You miss the main complaint of a national ID card system: that it would be *mandatory* for a person who wishes to operate in the country. That's the important part that is not true for a driver's license: not having a driver's license does not make the person an unperson.
It is not necessary for me to have an ID card to "operate" in Belgium. There are a few things where the ID card is indeed required; e.g., the last time I personally had to use my ID card was during the last elections. If I would have had an encounter with the police in that time, they could have asked for it, too; but that didn't happen. Also, when doing my tax declaration online, I used the electronic keys on the ID card, so that I could only update my tax declaration—and not, say, my neighbour's. But that's only doable when you have an electronic ID card system, which is not necessarily a good idea (in contrast to plain old paper ID cards, I do have privacy concerns with electronic versions—details on request) Of course, the fact that I can "operate" in Belgium without the use of an ID card does not mean it is legal for me to walk around without one; but that is not entirely the same thing. There were some more comments to my previous blog post, but I don't disagree with those.

17 February 2008

Russell Coker: Laptop vs Book Weight

Matt Bottrell wrote an interesting and informative post about laptops for school kids [1]. His conclusion is that based on technical features the OLPC machine is best suited for primary school children and one of the ASUS EeePC, the Intel Classmate, and the Everex Cloudbook would be best suited for high-school students. The Asus EeePC [2] is a good option, it runs a variant of Debian and the Debian Eeepc Team are active in getting full Debian support for it [3]. The Intel Classmate [4] has a choice of Windows XP, Mandriva, and Metasys Classmate. The web page says that it’s designed “for primary students (ages 5-14)“, so I think that Matt made a mistake in listing this as a possibility for high-schools, of course when running Mandriva it could have software installed for any age group but the hardware design may be better suited to younger children. The Everex Cloudbook [5] runs the GOS Rocket [6] OS which seems to be an Ubuntu variant with an Enlightenment based GUI and a configuration aimed at using Google services (blogger, gmail, etc). Configuring Ubuntu to suit your needs is easy enough (it’s based on Debian). Note that Matt did not mention where one might purchase a Cloudbook in Australia and I don’t recall seeing one on any of my many window-shopping expeditions to Australian consumer electronics stores, while the EeePC is widely available (except when sold out). But I’m sure that if the government wanted to place an order for a couple of million units then Everex would ramp up production quickly enough. Matt made one statement that I strongly disagree with, he wrote “A traditional notebook is far too heavy for high-school kids to lug around“. To test this theory I searched for some high-school text books and a set of scales. A year 11 Maths A text book from ~1988 weighed 600g and the pair of year 12 Maths A and Maths B texts weighed 1.6Kg. When I was at high-school the day was divided into seven “periods”, some classes took two periods so four different classes which required text books (or other books) was typical. Carrying 3Kg of books to school would not be uncommon for year 12 students. The Lenovo T series (advertised as “premier performance” and the model I personally prefer) is listed as having a starting weight of 2.1Kg (which presumably doesn’t include the power pack). My Thinkpad T series (from about 2004) weighs about 2.4Kg according to my kitchen scales and has a battery weighing just over 400g. My practice for a long time was to own a spare power pack for my Thinkpad so that I could leave it at work (saving 400g when travelling to and from work). I have also had the practice of buying a spare battery when I buy a Thinkpad (you need a spare battery for a long trip). So if I had really wanted to save weight I could have left a battery at work and reduced by travel weight by another 400g (with the cost being that I couldn’t use it when on a train or bus). A spare power pack is not overly expensive. In the usual case students would only need a battery when at school (it’s a little known fact that Thinkpads work perfectly without a battery plugged in). So if a student had a power pack at home as well as one at school and if they left their battery at school and they owned one of the latest Thinkpad T series (listed with a starting weight of 2.1Kg) then their travel weight might be about 1.7Kg. If the majority of school texts could be stored on their laptop then the result of using a Thinkpad T series would be a significant weight reduction! If the students were using a Thinkpad X series (more expensive so maybe not a good option) then the list weight is 1.57Kg and the travel weight might be as low as 1.3Kg (at a rough estimate). The EeePC offers significant benefits for school use, it is light, cheap (children tend to break or lose things more frequently than adults so you should budget for buying two of anything that they use), and having no hard drive (flash storage) it should cope well with being dropped. The screen on the EeePC is unreasonably small buy Asus could release a new model with a bigger screen (they may do this in the future anyway or a government contract could encourage them to do it sooner). I agree that the EeePC or the Everex Cloudbook is probably the best option for high-school students, but I can’t agree with any claim about a traditional laptop being too heavy, the only reason for excluding a traditional laptop is that those new ultra-lights are better. Another reason that might be cited for not using laptops is the cost. While prices of $1000 or more for a traditional laptop are rather expensive, the $500 for an EeePC is not that expensive - and the government could surely negotiate a better deal, I would be surprised if they couldn’t get the price down to $350 by some bargaining and by removing the middle-man. A careful child could use the same laptop for the entire duration of high-school and their parents would incur less expense than they currently would spend on text books. As for the current lack of electronic text books. Currently when the education department selects a book it’s a license to print money for the author and publisher. All that the education department has to do is to declare that they will do a deal with the first company to release their books under a creative commons license. The idea would be that an author (or publishing company) would get paid a fixed sum of money for a CC release of a text book which would then be available for use by anyone anywhere in the world. World-wide free distribution would be no loss to the author (each country tends to have unique books anyway) but would be a good act of charity from our government to developing countries. Once books were available under a creative commons license (without the “no modifications” clause) they could be freely improved by anyone. Improving text books for younger students could be a good school project. Update: Thanks to Steve Walsh for pointing out that the Classmate can run Linux. It’s a pity that he didn’t link to my post so that his readers could see what he was referring to. I take it as a good sign of the quality of my posts that such small errors get pointed out.

[1] http://matt.bottrell.com.au/item/166/

[2] http://eeepc.asus.com/au/index.htm

[3] http://syn.theti.ca/articles/2008/02/16/bits-from-the-debian-eee-pc-team

[4] http://www.classmatepc.com/

[5] http://www.everex.com/

[6] http://www.thinkgos.com/

Share This

Biella Coleman: The HealthCare Issue (with something on OLPC)

I have not heard of them until last week but I like their name, Frog Design, and they have an issue dedicated to Health Care including an intriguing article The Paradox of Choice
A capitalist case for universal health care. For those just into tech, they also have a piece by OLPC.

Neil Williams: Monitoring long running processes via ssh

I'm trying to work out how to monitor a remote script - in this case a mass build script. The script itself is trivial - a simple for loop in perl. It calls a script from emdebian-tools that calls a variety of other scripts and programs.
What's the best way for me to monitor that script from another machine on the network?
Yes, 'ps wax' is usable but not particularly friendly - the script has to work its way through a list of packages that need building. I want to know which package is being built at the time and the 'ps' output does show this information but only if you recognise parts of the build process for particular packages.
I thought about getting the script to output the current package name to some file in /var/ but that seems a bit of a hack (it's a userspace command and should not need to use sudo or require particular permission setups). Sending email is overkill. A file in /tmp/ is possible, true, but that means adapting the script itself. I'd like a solution that could work with (almost) any package, including binaries, without altering the source code. I've also thought of running the script within screen but then when the machine is in the middle of a compilation, it isn't easy to work out which package is actually being built just from the gcc output, plus there is the continual problem that screen doesn't support scrollback.
I have a feeling this is a potential reinventing the wheel problem so I'm looking for ideas.

Update:
The closest process output I can use is ps wfh which at least collates all the processes started by the top level script into one tree. I've worked out why the info I wanted was not being shown - the call from perl was exec() not system(). Doh! Ne'er mind. ps wfh will be enough for what I need - but I will need to adapt the wrapper after all. Thanks to all those who posted comments.

Next.

Previous.