Search Results: "ron"

3 November 2008

Eddy Petrișor: signing packages heads-up

When trying to sign some Debian packages fails, you might think that temporally changing LANG to find similar errors on the web is a good idea.

But when you see that the expired key is not the default one and you made sure that the GPG agent environment info is correct, while signing still fails, you might start to consider that bad rendering of the "s comma below" character in your name might be worth taking into account.

gpg: skipped "Eddy Petri or ": secret key not available

Also, remembering that LC_MESSAGES=C is the right way to have English messages, while preserving all the rest of the localization info, is also useful.

Eric Warmenhoven

Dear Lazyweb, what’s best dedicated server/virtual private server offering? My basic requirements are:

web hosting (apache/php/mysql)
mail host, including smtp and imap servers
root shell (ideally running Debian)
some small amount of backup space (say 3GB or so)
reasonably cheap (roughly $70/mo, ideally less)

Right now I have Dreamhost, which has been reasonable for what I pay, which is $16/mo. They run Debian and, aside from root, give me everything else that I want. However, I’m starting to get really annoyed at being on shared hosting. Also, they’re moving everyone over to new servers, and when they do, I won’t be able to use procmail filtering anymore. So I’m looking for alternatives. One of my friends had used ServerPronto, which meets all my requirements. However, his experience convinced me that I don’t want to be using ServerPronto. So, what should I use?

Enrico Zini: rc-buggy packages sorted by popularity

rc-buggy packages sorted by popularity After doing a round of tag reviews so that we release lenny with the latest tag contributions, I still had a bit of spare time. Since people are urging to fix the last bugs I thought I could contribute a list of RC-buggy packages sorted by popularity:

#!/usr/bin/python
import urllib2
import sys, re #, gzip
PKGRE = re.compile(r'<strong>Package: </strong><a href="[^"]+" name="([^"]+)">')
POPCONRE = re.compile(r'^(\d+)\s+(\S+)')
PKGMAPRE = re.compile(r'^([^(]+)\(([^)]+)')
COMMASPLIT = re.compile(r'\s*,\s*')
# Allow to download other package views
if len(sys.argv) > 1:
    url = sys.argv[1]
else:
    url = "http://bts.turmzimmer.net/details.php"
def read_packages(url):
    "Download the list of rc-buggy packages"
    fd = urllib2.urlopen(url)
    for line in fd:
        mo = PKGRE.search(line)
        if mo:
            yield mo.group(1)
# FIXME: this is a deprecated data source, but at the moment it is just what
#        is needed
def read_bintosrc(url = "http://qa.debian.org/data/ddpo/results/ddpo_packages"):
    "Download the binary to source package map"
    fd = urllib2.urlopen(url)
    for line in fd:
        mo = PKGMAPRE.search(line)
        if mo:
            src = mo.group(1)
            bin = COMMASPLIT.split(mo.group(2))
            for p in bin:   
                yield p, src
def read_popcon(url = "http://popcon.debian.org/by_inst"):
    "Download popcon information"
    fd = urllib2.urlopen(url)
    # It doesn't work on urllib2 objects because it wants tell()
    #fd = gzip.GzipFile(fileobj=fd, filename=url, mode="rb")
    for line in fd:
        mo = POPCONRE.match(line)
        if mo:
            yield mo.group(2), int(mo.group(1))
print "Reading mapping of binary packages to source packages..."
bin2src = dict(read_bintosrc())
print "Reading popcon scores..."
# We actually want the score of source packages, and for it we use the score of
# its binary package with the highest score
scores = dict()
for pkg, score in read_popcon():
    pkg = bin2src.get(pkg, pkg)
    if pkg not in scores:
        scores[pkg] = score
#scores = dict(read_popcon("http://popcon.debian.org/by_inst.gz"))
print "Reading list of rc-buggy packages..."
# The bug page has a mix of source and binary packages: convert all to source
# packages
packages = sorted(read_packages(url), key=lambda x:scores.get(bin2src.get(x,x), 0))
for p in packages:
    print scores.get(bin2src.get(p,p), 0), p

This can be run on people.debian.org as ~enrico/popzimmer (0 is the rank of packages that for some reason cannot be mapped to any rank):

$ ~enrico/popzimmer 
Reading mapping of binary packages to source packages...
Reading popcon scores...
Reading list of rc-buggy packages...
0 roxen-fonts-iso8859-2
2 dpkg
11 pam
61 glibc
61 libc6
123 initramfs-tools
149 bind9
150 grub
180 portmap
213 nfs-common
279 libgl1-mesa-dri
298 libsnmp-base
298 snmpd
309 avahi
397 mysql-dfsg-5.0
408 xserver-xorg-input-wacom
409 xserver-xorg-video-vesa
428 docbook-xml
499 openoffice.org-core
567 xine-lib
600 evolution-data-server
669 eog
671 xserver-xorg-video-intel
691 epiphany-browser
691 epiphany-gecko
695 kdelibs4c2a
698 uswsusp
754 guile-1.6
959 gpm
964 cups
990 kdebase
1002 ghostscript
1069 giflib
1076 xulrunner-1.9
1177 libapache2-mod-perl2
1217 vlc-nox
1229 kernel-package
1311 kdeutils-dev
1520 libparted1.8-10
1767 wireshark
1785 selinux-policy-default
1908 dia
1943 htop
1983 boost
2140 cantlr
2145 transmission
2159 emacs22
2312 swfdec-mozilla
2449 eclipse
2449 libswt3.2-gtk-java
2728 lilo
2898 libnss-ldap
3013 java-access-bridge
3051 blender
3099 libtemplate-perl
3499 fglrx-atieventsd
3602 virtualbox-ose
3619 jfsutils
3806 anjuta
3962 kbuild
4076 libgnustep-gui0.14
4222 libwebkit-1.0-1
4332 rosegarden
4412 matplotlib
4412 python-matplotlib
4950 mail-notification-evolution
5195 nut-cgi
5273 sbcl
5538 ruby1.9
5679 kmymoney2
6076 websvn
6147 miro
6264 gnat-4.1
6431 gallery2
6478 gnome-chess
6512 joystick
6862 istanbul
6937 wordpress
7476 luatex
7635 csound
7635 python-csoundac
8257 libpam-mount
8471 wmcpuload
8631 nbsmtp
8642 oxine
8774 axiom
8949 libengine-pkcs11-openssl
9052 clamav-getfiles
9221 open-iscsi
9262 ptex-bin
9701 egroupware-core
10012 debian-cd
10127 libjogl-java
10453 libjson-xs-perl
10698 gcjwebplugin
10736 request-tracker3.6
11294 python-extclass
11518 rkward
11600 alevt
12929 otrs2
13205 bindgraph
13956 icecc-monitor
14223 netmaze
14505 cdebconf
14526 mumble
14687 fnonlinear
14724 recite
14789 jbidwatcher
15766 libnss-ldapd
15812 glpi
15905 lustre-source
15982 win32-loader
16232 ampache
17168 libghc6-missingh-dev
17311 acl2
17830 apertium
18462 emacspeak
18469 glassfish
19257 isight-firmware-tools
19719 libnagios-object-perl
20144 libwx-perl
20465 dns2tcp
21614 python-kinterbasdb-dbg
21690 hf
21902 libcobra-java
22365 tomcat6
22573 libphp-snoopy
23501 coco-java
23926 boxbackup-server
24009 libghc6-wash-dev
26323 libdesktop-notify-perl
26439 opendb
28426 adolc
28795 xorp
29986 libgdata-java
31262 libjboss-serialization-java
31472 pixelpost
31658 cournol
32939 mediamate
34365 gforge-plugin-scmcvs
34659 libgearman-client-async-perl
42233 libhamcrest-java
48076 mahara
55303 mxallowd
85881 roxen-fonts-iso8859-1

So, if you don't know from what package to start fixing bugs, "Begin at the beginning,", the King said, very gravely, "and go on till you come to the end: then stop."

Russell Coker: Christian Principles in an Election Year

The National Council of Churches in the US [1] has produced some advice for Christian voters titled Christian Principles in an Election Year [2]. It starts by saying “Your church, your communion, and the National Council of Churches USA do not endorse any political party or any candidate” (which is in bold in their text) and then lists 10 issues that Christians should consider when voting. Here are the 10 section headings, the full article has a sentence or two explaining each one. I think that most good people (regardless of religion) will agree with all of this - maybe substitute “God” with the name of some other entity that has not been proven to exist or with “humanity”.

War is contrary to the will of God.

God calls us to live in communities shaped by peace and cooperation.

God created us for each other, and thus our security depends on the well being of our global neighbors.

God calls us to be advocates for those who are most vulnerable in our society.

Each human being is created in the image of God and is of infinite worth.

The earth belongs to God and is intrinsically good.

Christians have a biblical mandate to welcome strangers.

Those who follow Christ are called to heal the sick.

Because of the transforming power of God s grace, all humans are called to be in right relationship with each other.

Providing enriched learning environments for all of God s children is a moral imperative.

The Blogger Joy Reid [3] often uses the term “Matthew Christian” to refer to Christians who follow the book of Matthew and act in ways that would be considered to be good by most people regardless of belief. This is in stark contrast to some of the nasty people who call themselves Christian and who promote hatred, inequality, and war - such people give all Christians a bad reputation (see the comment section of any blog post concerning religion for examples). John Goerzen’s post titled Politics and the Church (which references the NCCUSA article [4]) is also worth reading. Interestingly his blog post had a Google advert for “Christian Masturbation” when I viewed it. John also has a good post explaning why he is voting for Obama - based on his Christian beliefs and “Traditional Values” [5].

[1] http://www.ncccusa.org/

[2] http://www.ncccusa.org/votingprinciples/

[3] http://blog.reidreport.com/

[4] http://changelog.complete.org/posts/771-Politics-and-the-Church.html

[5] http://changelog.complete.org/posts/762-What-Traditional-Values-Mean-to-Me.html

Alexander Reichle-Schmehl: Dear Lazyweb,

I use Icedove / Thunderbird for nearly all of my daily mail business. I use it to read blogs, too. However, since I work from different computers, on my mails, I'm slightly annoyed since it seems not possible to synchronize several important settings in an easy way. Is it somehow possible to synchronise:

address book
Read post of the subscribed blogs
Installed extensions

I rely heavily on the automatic completion of e-mail addresses and like, that Thunderbird automatically adds recipients of mails I send to an address book for later use. However it seems to be not possible to share these entries between several computers. Similar to subscribed blogs. I'm subscribed to some blogs on different computers. However I need to "synchronize" which posts I already read by hand. Last, not least: From time to time I find and install a new extension to Thunderbird, which I install on one computer. And later forget to install the very same extension on the other computers :( Yes, technically I could solve these problems myself. E.g. by using the rss2mail script to read blogs via my imap server, or by using some kind of version control for my Thunderbird settings. But that seems kind of ugly to me. Isn't there a better way?

2 November 2008

John Goerzen: Politics and the Church

My church is one in which politics are checked at the door. Some church members wear their politics on their yard, or on their blog -- and just about every opinion is represented in the church. But you rarely hear politics mentioned in church. When it is mentioned, it's issue-oriented rather than candidate-oriented or policy-oriented -- we'll hear updates on efforts to create a peace tax fund, for instance.

But today, hearing about politics is just about unavoidable.

The relationship between Christianity and government has been uneasy and troubled all the way back to the religion's founding. Many Christians, and I count myself in this, believe that our first loyalty is to Jesus, and on those grounds, refuse to say the pledge of allegiance. What, we wonder, would our word be worth if we were forced to disobey our government because of a law that was unjust or immoral? How could we even say the words "one nation, under God, with liberty and justice for all" when those words were written at a time when the KKK was active, lynchings were common, and are said today at a time when people treat Muslims and immigrants with modern disdain?

In short, we believe we are called to be citizens of a different kingdom first.

So, today, our pastor deliberately picked a difficult scripture passage for us: Romans 13:1-7, which reads, in part:

Everyone must submit himself to the governing authorities. . . The authorities that exist have been established by God. . . Consequently, he who rebels against the authority is rebelling against what God has instituted, and those who do so will bring judgment on themselves. For rulers hold no terror for those who do right, but for those who do wrong. . . Therefore, it is necessary to submit to the authorities, not only because of possible punishment but also because of conscience.

What an extraordinary set of statements. This was written during the time of the Roman Empire, which could hardly be said to have been a just and benign government. It's hard for me to imagine the Roman Legion being established by God.

In more modern times, it would seem to denounce the American revolution as a rebellion against authority and therefore a rebellion against God. It would also seem to denounce the protests that we see all over the world -- striking workers in France, human rights seekers in Burma, war protesters in the United States. Would it even have condemned the protests in the 1960s over civil rights in this country, or the protests against war today?

One commentator notes that "Paul is not stating that this will always be true but is describing the proper, ideal function of rulers. When civil rulers overstep their proper function, the Christian is to obey God rather than human authorities" -- a theme Paul mentioned more than once in Acts.

What relevance does this have for us today? It seems that we are to help our rulers act in a just way, even if we disagree with them -- no matter who wins the election. It is also a reminder that a superficial reading of the Bible, taken out of context and without a deep understanding to understand the author's point, can potentially lead to very strange conclusions.

The American National Council of Churches has issued a non-partisan voting guide, which we found in our bulletin today. It is an interesting read, and probably not what you think; it begins with, "War is contrary to the will of God." Thought-provoking stuff.

I find it interesting that there are a lot of people out there that say that religion is responsible for a lot of ill in this country, then proceed to hold pretty much the same opinions I do for pretty much the same reasons. I just point out that the Bible is deeper than intolerance and submission.

Julien Valroff: Laptop as desktop computer replacement

I am currently studying the possibility to change my current desktop computer for a laptop. This is the first time I am looking at these powerful laptops, as I now only use cheap laptops for small office use (email, web etc.) when traveling. My aim is now to use a laptop for my daily tasks: picture editing, small development, multimedia etc.

Ideal features would be:

Large screen (18,4″)
Large disk space (at least 250Gb)
Separate numpad
At least 2Ghz CPU (dual core)
4Gb RAM
Wifi 802.11g, ethernet 100 connections
At least 3 USB and 1 firewire port
Built-in memory card reader with Compact Flash support
DVD burner

I do not care about the weight, as it would mainly stay on my desktop. I currently have a desktop computer with 2Go RAM, an Intel 4400 Dual Core CPU (@ 2Ghz) with 200Gb hard disk - though it is enough at the moment, I would prefer the laptop to be more powerful in order to be able to run smoothly with future applications which will be released in 2 or 3 years! Ideally, it would be around 1,000 (obviously, the cheaper the better, but I want something reliable for a few years if possible). Last but not least, it needs to be 100% compatible with GNU/Linux (Debian in particular) - I do not care about compiling kernel modules, but would rather prefer they are free (as in free speech). Do you have any experiences with such laptops?
What would be your recommendations? Is my idea something totally weird (I mean, should I keep my current desktop computer)?!

Matthew Garrett: Ultamatix

First, let me make one thing clear. This isn't constructive criticism. This is just criticism. It's directed at software that's so wrong-headed that there's no way to make it significantly better, and everyone involved would be much better spending their time doing something else instead of trying to fix any of what I'm about to describe. It's not worth it. Sit in a park or something instead. Meet new and interesting people. Take up a hobby that doesn't involve writing shell scripts for Linux. You'll be happier. I'll be happier. Everyone wins.

Anyway. I wrote about Automatix some time ago. It died and the world became a better place. More recently it's been resurrected as something called Ultamatix. In summary, don't bother. It's crap. And dangerous. But mostly crap. Again, I'm going to utterly ignore the UI code and just concentrate on what it runs.

```
function cleanup  
echo "Cleaning up..."
sudo apt-get autoremove --assume-yes --force-yes
 
```
In other words, "Remove a bunch of packages that might have nothing to do with anything Ultamatix has installed, and don't ask the user first. Oh, and assume yes when asked whether to do anything potentially damaging". This gets called 103 times in various bits of Ultamatix.
Oh, notice the sudo in there? Ultamatix is running as root already. Despite this, there are 429 separate calls to sudo.

#Test O/S 64 or 32 bit...
architecture= uname -m 
targetarch="x86" #Set 64-bit machines to download 32-bit if no options are set
if [ "$architecture" != "x86_64" ] && [ "$architecture" != "ia64" ]; then
    architecture="x86"
else
    architecture="x86_64"
fi

It turns out that ia64 is not especially good at running x86_64 binaries. Never mind, eh?

```
rm -rf $AXHOME/.gstreamer-0.10
gst-inspect
sudo gst-inspect
```
Which translates as "Delete any self-installed plugins, run gst-inspect as root in an attempt to regenerate the plugin database, really run gst-inspect as root in an attempt to regenerate the plugin database". The flaws in this are left as an exercise for the reader.
```
sudo apt-get --assume-yes --force-yes remove --purge
```
Used 111 times. Will remove the packages it installed, but also any other packages the user has installed that happen to depend on them. Without asking.

sudo cp /etc/apt/sources.list /etc/apt/sources.bak
sudo echo "deb http://ppa.launchpad.net/project-neon/ubuntu hardy main" >> /etc/apt/sources.list
sudo apt-get update
if !    sudo apt-get install --assume-yes --force-yes amarok-nightly amarok-nightly-tools amarok-nightly-taglib
then
        AX_fatal "An apt-based error occurred and installation was unsuccessful";
fi
echo "Restoring sources."
sudo cp /etc/apt/sources.bak /etc/apt/sources.list
sudo apt-get update

The good news is that it backs up your sources.list before breaking things. The bad news is that it's still utterly horrifying.

```
#since we have root we need to discover normal username so we can create the shortcut & set proper permissions
NU=$(cat /etc/passwd   grep 1000   cut -d: -f1)
sudo chown $NU:$NU "legends_linux-0.4.1.43.deb"
sudo chmod +x legends_linux-0.4.1.43.deb
sudo dpkg -i legends_linux-0.4.1.43.deb
```
List of fail:
1. Assuming that the user has uid 1000
2. Chowning a deb to the user for no obvious reason (hint: a user can delete root owned files that are in the user's home directory)
3. Making a deb executable for no reason whatsoever
4. Assuming that user information will be in /etc/passwd
5. Not just, say, passing the user's name to the application IN THE FIRST PLACE

sudo apt-get --assume-yes --force-yes install f-spot dvgrab kino devede gtkpod-aac ipod gnupod-tools libgpod-common
libipod-cil libipoddevice0 libipodui-cil libhfsp0 hfsplus hfsutils libipod0

If only we had some way of saying that libraries used by programs should automatically be installed when a program is. Wouldn't that be great?

echo "Adding mediabuntu repository"
sudo cp /etc/apt/sources.list /etc/apt/sources.bak
sudo wget http://www.medibuntu.org/sources.list.d/hardy.list -O /etc/apt/sources.list.d/medibuntu.list
...
echo "Restoring sources."
sudo cp /etc/apt/sources.bak /etc/apt/sources.list

Yeah. that'll help.

The Swiftweasel install that checks your CPU type and then has some insane number of cut and paste code chunks that differ only by the filename of the tarball it grabs. Rather than, say, using a variable and writing the code once.
The cutting and pasting of the same code in order to install swiftdove.
Code that installs packages differently depending on whether they happened to be in your home directory to start with or whether it had to download them for you

if !    DEBIAN_FRONTEND=kde sudo apt-get --assume-yes --force-yesinstall virtualbox

No, I didn't remove any spaces from that.

#create directory incase they installed it elsewhere, no sense in scraping all thier games
sudo mkdir /usr/local/games/WoP/ 2>/dev/null
...
sudo rm -R /usr/local/games/WoP/ 2>/dev/null

What, create a directory and then immediately delete it? How is this useful in any way whatsoever?

There's almost certainly more. I got bored. The worrying thing about this is that the Ultamatix author read my criticisms of Automatix and appears to have attempted to fix all of them. The problem with this is that there's clearly a complete lack of understanding of the fundamental problem in several cases. For example, one of my criticisms of Automatix:

sudo sed -i "s/^vboxusers$.*$:$/vboxusers\1:$AXUSER/" /etc/group

- assumes that the system isn't using some sort of user directory service.

and the Ultamatix response:

Fixed...Got rid of Virtualbox

Except exactly the same problem is present at other points in Ultamatix, as noted above. Taking a bug list and slavishly fixing or deleting all the bugs isn't helpful if you then proceed to add the same bug back in 24 other places. In that respect, it's even worse than Automatix - the author's managed to produce a huge steaming pile of shite despite having been told how to avoid doing so beforehand. He may be no newbie to programming, but if not it's a perfect example of how experience doesn't imply competence.

Don't install this package. Don't let anyone else install this package. If you see anyone advocating the installation of this package, call them a fool. There's absolutely no excuse whatsoever for the existence of this kind of crap.

Minor update:
The above was looking at 1.8.0-4. It turns out that there's a 1.8.0-5 that's not linked off the website. There's no substantive difference, but some of the numbers may be slightly different.

Russell Coker: Integrity and Mailing Lists

One significant dividing factor between mailing lists is the difference between summary lists (where the person who asks a question receives replies off-list and then sends a summary to the list) and the majority of mailing lists which are discussion lists (where every reply goes to the list by default). I have seen an argument put forward that trusting the answers on a mailing list that operates under the summary list model is inherently risky and that peer review is required. It could be argued that the process of sending a summary to the list is the peer review. I’m sure that if someone posts a summary which includes some outrageously bad idea then there will be some commentary in response. Of course the down-side to this is that it takes a few days for responses to the question to arrive and as it’s common that computer problems need to be solved in hours not days the problem will be solved (one way or another) before the summary message is written. But the idea of peer review in mailing lists seems to fall down in many other ways. The first problem with the idea of peer review is that the usual aim of mailing lists is that most people will first ask google and only ask the list if a reasonable google search fails (probably most mailing lists would fall apart under the load of repeated questions otherwise). Therefore I expect that the majority of such problems to be solved by reading a web page (with no peer review that is easily accessible). Some of those web pages contain bad advice and part of the skill involved in solving any problem relates to recognising which advice to follow. Also it’s not uncommon for a question on a discussion list to result in a discussion with two or more radically different points of view being strongly supported. I think that as a general rule there is little benefit in asking for advice if you lack any ability to determine whether the advice is any good, and which of the possible pieces of good advice actually apply to your situation. Sometimes you can recognise good advice by the people who offer it, in a small community such as a mailing list it’s easy to recognise the people who have a history of offering reasonable advice. It seems that the main disadvantage of asking google when compared to asking a mailing list is that the google results will in most cases contain links to web sites written by people who you don’t know. Sometimes the advice is easy to assess, for example if someone recommends a little-known and badly documented command-line option for a utility it’s easy to read the man page and not overly difficult to read the source to discover whether it is a useful solution. Even testing a suggested solution is usually a viable option. Also it’s often the case that doing a google search on a recommended solution will be very informative (sometimes you see web pages saying “here’s something I tried which failed”). Recommendations based on personal experience are less reliable due to statistical issues (consider the the regular disagreements about the reliability of hard disks where some people claim that RAID is not necessary due to not having seen failures while others claim that RAID-5 is inadequate because it has failed them). There are also issues of different requirements, trivial issues such as the amount of money that can be spent will often determine which (if any) of the pieces of good advice can be adopted. The fact that a large number of people (possibly the majority of Internet users) regularly forward as fact rumors that are debunked by Snopes.com (the main site for debunking urban legends) seems to indicate that it is always going to be impossible to increase the quality of advice beyond a certain level. A significant portion of the people on the net are either unwilling to spend a small amount of effort in determining the accuracy of information that they send around or are so gullible that they believe such things beyond the possibility of doubt. Consider that the next time you ask for advice on a technical issue, you may receive a response from someone who forwarded a rumor that was debunked by Snopes. Sometimes technical advice is just inherently dangerous because it is impossible to verify the integrity of some code that is being shared, or because it may be based on different versions of software. In a previous blog post I analyse some issues related to security of the Amazon EC2 service [1]. While the EC2 service is great in many ways (and implements a good well-documented set of security features on the servers) the unsigned code for managing it and the old versions of the images that they offer to customers raise some serious issues that provide avenues for attack. Getting the EC2 management tools to work correctly on Debian is not trivial, I have released patches but will not release packages for legal reasons. It seems most likely to me that someone will release packages based on my patches (either because they don’t care about the legal issues or they have legal advice suggesting that such things are OK - maybe due to residing in a different jurisdiction). Then people who download such packages will have to determine whether they trust the person who built them. They may also have the issue of Amazon offering a newer version of the software than that which is packaged for Debian (for all I know Amazon released a new version yesterday). The term integrity when applied to computers refers to either accidental or malicious damage to data [2]. In the context of mailing list discussions this means both poorly considered advice and acts of malice (which when you consider spam and undisclosed conflicts of interest are actually quite common). If you ask for advice in any forum (and I use the term in it’s broadest sense to cover web “forums”, IRC, twitter, etc) then getting a useful result will depend on having the majority of members of the forum possessing sufficient integrity and skill, being able to recognise the people whose advice should be followed, or being able to recognise good advice on it’s own. I can think of few examples of forums of which I have been involved where the level of skill was sufficient to provide quality answers (and refutations for bad answers) for all areas of discussion that were on topic. People whose advice should generally be followed will often offer advice on areas where their skills are less well developed, someone whose advice can be blindly followed in regard to topic A may not be a reliable source for advice on topic B - which can cause confusion if the topics in question are closely related. Finally a fundamental difference between “peer review” (as applied to conferences and academic journals) is that review for conferences and journals is conducted before the presentation. Not only does the work have to be good enough to pass the review, but the people doing it will never be sure what the threshold is (and will generally want to do more than a minimal effort) so the quality will be quite high. While peer review in mailing lists is mostly based around the presence or absence of flames. A message which doesn’t attract flames will either have some minimal quality or be related to a topic that is not well known (so no-one regards it as being obviously wrong). Update: The “peer review” process of publishing a post on my blog revealed that I had incorrectly used who’s instead of whose.

[1] http://etbe.coker.com.au/2008/10/13/ec2-security/

[2] http://en.wikipedia.org/wiki/Data_integrity

1 November 2008

Thijs Kinkhorst: Electronisch Pati ntendossier

Today everyone in the Netherlands received a letter about the new national electronic health record (EPD) and the possibility to object against registration. EPD aims to provide access to one's patient data to every care provider through a central information broker. I have submitted the form to disallow my data to be accessed through this system. First of all, there's no clear benefit for me, and I think that goes for the large majority of people. The possible situation where someone has a critical condition and isn't treated by his regular doctor and is unable to inform the stand-in of this and the stand-in has the time to delve through the entire EPD and actually finds and correctly interprets the necessary information seems extremely small for anyone, let alone the big majority that doesn't suffer such critical conditions in the first place. Hence, making it the default for everyone seems very inappropriate. See also this interesting article, written in Dutch by my uncle. Interestingly the same minister was recently opposed to a default-allow for organ donorship, which may address a problem that is much more real. The other concern is security. I am not worried by the technical security of the system, it seems to be of acceptable standard (see this report by my friend Niels). I am more concerned about access restrictions: these are implemented post hoc, that is, anyone can access my file and I can check who accessed my it and whether they had the right to. However, this procedure involves sending in paper forms which I think in practice will not bring about much review. Combined this project reminds me of voting computers - introducing new concerns while solving no actual problems.

Uwe Hermann: Google Tech Talks: coreboot (aka LinuxBIOS): The Free/Open-Source x86 Firmware

Here's a nice opportunity for everyone to learn more about coreboot, a Free Software / Open Source firmware/BIOS for x86 PCs. Ron Minnich, founder of the LinuxBIOS (now called coreboot) project, Peter Stuge of Stuge Konsult, and Stefan Reinauer of coresystems GmbH have given a presentation for the Google Tech Talks series recently. The topic was (of course) coreboot, its history, goals, features and technical details, surrounding tools and libraries such as flashrom and libpayload, as well as an automated test system for running a hardware test-suite upon every checkin in the coreboot repository.

A video of the talk, aptly named coreboot (aka LinuxBIOS): The Free/Open-Source x86 Firmware (134 MB), is available from Youtube, get it for instance via:

  $ apt-get install youtube-dl
  $ youtube-dl http://www.youtube.com/watch?v=X72LgcMpM9k

The talk includes various demos of coreboot and various payloads you can use with coreboot. One nice example is the TINT payload, a Tetris-like game for Linux (apt-get install tint for the curious), which has been reworked to be usable as a coreboot payload.

So, yes, you can now put Tetris in your BIOS ROM chip and play it from there (no hard drive required). Other demos included some cluster nodes with coreboot, and a "normal" x86 desktop board booting coreboot + Linux in a very few seconds (much room left for optimizing there though, if you really want to get into fast booting). Check out the full talk for more infos, and if you're willing to give it a try (see the list of currently supported boards), contact us on the mailing list or join the #coreboot IRC channel on Freenode.

31 October 2008

Gunnar Wolf: How (and how not) to create cyclist awareness

Michael blogs about Critical Mass.
What is Critical Mass in case you are too lazy to go to Michael's or to the Wikipedia? A cyclist-awareness movement, showing how bikers are safer (i.e. more visible) when there are more of them. The (dis)organizational nature of this movement (at least according to Wikipedia's information) seems quite fun and interesting.
However, I have to oppose what Michael says is a strong point of CM in Austria - At least, given my country's culture.
People who don't bike often say we have the least bike-aware culture, and that this city must be like hell to cyclists. It is not - Mexicans tend to believe this is the worst place possible on many accounts, and I'm happy to prove the contrary. I do feel that bringing people out to the streets, as our local government's Mu vete en bici program pushes, is completely right: It shows people how fast they can move in real streets in the city, taking away the fear of being run over by a bus, and people will gradually understand we can all excercise the right to use the streets without polluting, and gives us a better idea on how to behave with traffic (even if the traffic is made of fellow bikers) around us. I know this program works - At least, because it worked on me. Whenever possible, I go everywhere in this (not small or friendly by any measure) city by bike.
Anyway - What criticism do I have for Michael's post? That he states they:

Bicycling ludicrously slowly for a good hour, we managed to claim some fairly busy streets while many people tried to get home by car.

IMHO, what we should be doing is to demand the drivers to respect us, not to make them want to run us over. They should not be driven into hating bikers because of the chaos they generate - It is terrible to sit in a car for two hours when you usually take 30 minutes. There is simply no justification for that.
When I took part of the World Naked Bike Ride, some people wanted to take all four lanes of Reforma. Fortunately, reason prevailed, and we took only the lane we were assigned. And we should keep that in mind! Whenever possible, we should protest and make ourselves heard, but without interfering, without damaging, other people's lives!
Oh, by the way: If anybody in Mexico wants to have some nice hours of healthy fun: I am still pondering whether to join, as it is a huge effort, but I am very inclined to do so. Next week, November 9, we will go by bike from Mexico City's Z calo to Pachuca. We face 95Km and close to four hours. The road to Pachuca is basically flat, and going in a large group is a great experience. Hope to see you there!

MJ Ray: Recent Events: London LinuxExpo, Toronto Free Software and Open Source Symposium, Public Sector Online, Get Online Day, the Global Financial Crisis, c&binet

Today’s the last day for the Gov.UK Consultation on Forced ISP Snooping: Please Say NO. I didn’t get to LinuxExpo, partly because of Monday Machine-Mangling Madness but I saw LinuxExpo 2008 Robert Castelo from the Drupal point-of-view. I also didn’t get to Public Sector Online (report by Andrew Lewin with links to more) and I definitely didn’t travel to Toronto, so the report on the Free Software and Open Source Symposium from Randy Metcalfe is pretty welcome. I wrote about the Social Enterprise Photography Competition and Cooperatives South-West Trade Fair last Friday - the photography competition deadline has been extended to 7 November. So you’ve still time to capture a vision of a more progressive approach to business that values people and the planet as well as profit. Last Friday was Get Online Day but TTLLP didn’t do anything for it this year - I took one look and reached similar conclusions to Graham Jones: Get online…! Oh - you are…! Related to that: on Tuesday, I got really annoyed about how many branches of government (national, regional, sub-regional and local) are obsessed about the private sector and are paying even less attention to other types of businesses, includingbuying off-the-shelf software which doesn’t conform to their stated policies about accessibility and interoperability. (Sorry if you saw evidence of that outburst… yes, local councillors are pretty powerless and get as annoyed about incompetent government services as everyone else.) It seems I’m not the only one feeling that good cooperative businesses are being overlooked. The ICA have recently sent an open letter to the Governments of the G-8 reminding them that co-operative financial institutions are an alternative secure, stable and sustainable model of business owned and controlled by people. Finally, a bit of advance notice here: “The inaugural Creativity & Business International Network (c&binet) will take place at The Grove in Hertfordshire from 26 28 October 2009” - is this something that free software and free culture supporters should get involved with? (And why did they pick a name that includes an XML special character?)

29 October 2008

David Welton: Nokia 6120

I finally got around to getting myself a new mobile phone, as it looks like the Android phones may take a while to arrive here in Europe, unlocked, and my old phone was fading. I ended up selecting a Nokia 6120 in order to get something that runs Symbian, which has a decent amount of apps above and beyond the Java ME stuff. So far, I'm fairly happy with the phone. Here are some notes:

It's small and light. Nice!
It runs Java ME (J2ME) applications surprisingly slowly. I'm non-plussed by this. And no, it's not just Hecl, even ShopList, which is quite simple and small (~ 6K), takes several seconds to start up. This is not appreciably faster than on my cheap phone from several years ago.
My old, cruddy phone was able to recharge (slowly) via USB. This one doesn't, as far as I can tell.
I bought it from Amazon.de, and the bozos who were the 'real' sellers sold me a phone intended for the polish market, meaning the dictionary languages installed are all eastern European - no Italian, which I need. Not the phone's fault though, and I guess it's probably possible to replace that stuff.
The camera has some weird issues where it leaves streaks. I realize that it's only a phone camera, but it ought to be able to do better. Here's an image from my recent trip to Oslo, by way of example:

Creating videos wors pretty well though.
Playing video is just a bit jerky - it mostly keeps up, but not 100% of the time, when you lose a few frames.
Nokia ought to do a better job making sure that it's integrated with Linux (Ubuntu in my case). That said, things work quite well, by and large, and I was able to get things done with relatively little fiddling.
The amount of progress over a few years is very impressive. This phone completely blows my old phone out of the water. Sure, it's a bit pricier, but it's way more capable.

All in all, I'm happy with it, but I think that my next phone will be some kind of Android-based device, as that system is way more hackable than Java ME, and the people developing it seem to 'get it' a bit more. That said, I'm glad I got it - I needed something modern to play with Hecl on, and hopefully I will be able to work on using some of the fancier bits of the phone from Hecl. Oh, and by the way, I'm always on the lookout for phones to try Hecl with - even if they're old and worn out, the only thing that matters is that they are able to run Java ME applications. Contact me for shipping information:-)

David Welton: Dynamic Languages in Desktop Applications

Ted Leung talks about the lack of dynamic languages in desktop applications. There's something ironic about that: Ted works for Sun Microsystems. Sun Microsystems, back in the day, was a big contributor to Tcl and Tk. Despite not being the "in thing", Tcl and Tk are used a lot more than people think. Not so much in the latest and greatest things being built now, due to the (undeservedly) "uncool" reputation, but in lots of products that are still chugging along, earning money and serving their users well, if not noisily so. Interestingly enough, my biggest client here in the Innsbruck area is one of these. They have offices worldwide, make a good living at what they do, and their user interface is mostly in Tk.

David Welton: Dynamic Languages in Desktop Applications

David Welton: Nokia 6120

It's small and light. Nice!
It runs Java ME (J2ME) applications surprisingly slowly. I'm non-plussed by this. And no, it's not just Hecl, even ShopList, which is quite simple and small (~ 6K), takes several seconds to start up. This is not appreciably faster than on my cheap phone from several years ago.
My old, cruddy phone was able to recharge (slowly) via USB. This one doesn't, as far as I can tell.
I bought it from Amazon.de, and the bozos who were the 'real' sellers sold me a phone intended for the polish market, meaning the dictionary languages installed are all eastern European - no Italian, which I need. Not the phone's fault though, and I guess it's probably possible to replace that stuff.
The camera has some weird issues where it leaves streaks. I realize that it's only a phone camera, but it ought to be able to do better. Here's an image from my recent trip to Oslo, by way of example:

Creating videos wors pretty well though.
Playing video is just a bit jerky - it mostly keeps up, but not 100% of the time, when you lose a few frames.
Nokia ought to do a better job making sure that it's integrated with Linux (Ubuntu in my case). That said, things work quite well, by and large, and I was able to get things done with relatively little fiddling.
The amount of progress over a few years is very impressive. This phone completely blows my old phone out of the water. Sure, it's a bit pricier, but it's way more capable.

Benjamin Mako Hill: An Invisible Handful of Stretched Metaphors

The following list is merely a small selection of scholarly articles listed in the ISI Web of Knowledge with "invisible hand" in their title:

Beyond the Reach of the Invisible Hand
The Real Invisible Hand: Presidential Appointees in the Administration of George W. Bush
The Invisible Hand of God, Visible in the History of Chemotherapy
Does the Latex Glove Fit the Invisible Hand? Application of Market Ideology to the Doctor/Patient Relationship.
One-Armed Economists and the Invisible Hand.
Subjective Image of Invisible Hand Coded By Monkey Intraparietal Neurons
Exploitation - The Invisible Hand Guided By a Blind Eye: Confronting a Flaw in Economic Theory
The Invisible Hand: Supernatural Agency in Political Economy and the Gothic Novel
The 'Invisible Man' and the Invisible Hand - H.G. Wells's Critique of Capitalism
The Dilemmas of Laissez-Faire Population Policy in Capitalist Society: When the Invisible Hand Controls Reproduction.
Hong Kong Government Policy and Information Technology Innovation: The Invisible Hand, the Helping Hand, and the Hand-Over to China
Helping Russian Students See the Invisible Hand.
Hailing with an Invisible Hand: A 'Cosy' Political Dispute Amid the Rise of Neoliberal Politics in Modern Ireland
Adam Smith's Invisible Hand Is Unstable: Physics and Dynamics Reasoning Applied to Economic Theorizing
Offering an Invisible Hand: the Rise of the Personal Choice Model for Rationing Public Benefits
From the Invisible Handshake to the Invisible Hand? How Import Competition Changes the Employment Relationship
Invisible Hand Effect in an Evolutionary Minority Game Model
Did the Invisible Hand Rock the Cradle?
Internet: The Invisible Hand of Deliberation
The Invisible Hand Has Already Wreaked Much Havoc - About Adam Smith
Gaussen's Invisible Hand: The University Mechanics and Machine Inspector Moritz Meyerstein: An Instrument Maker in the 19th Century.
"The Invisible Hand" of the Market or "The Ever-Present Hand" of Management (On New Discussions and Methods in the Field of Economic History)
Statin Utilisation - Recognising the Role of the Invisible Hand
The Universe's Invisible Hand.
How Did the Invisible Hand Handle Industrial Waste? By-Product Development Before the Modern Environmental Era
When Iron Fist, Visible Hand, and Invisible Hand Meet: Firm-Level Effects of Varying Institutional Environments in China
Behavioural Genetics: Evolutionary Fingerprint of the 'Invisible Hand'
The Hunting of Forbidden Books. Censored Books, Persecuted Books, the Story Written By the Invisible Hand
Identification of Pareto-Improving Policies: Information as the Real Invisible Hand
The Conspiracy of the Invisible Hand: Anonymous Market Mechanisms and Dark Powers
The Other Invisible Hand, Delivering Public Services Through Choice
Reviving the Invisible Hand: the Case for Classical Liberalism in the Twenty-First Century
Plant Science - The "Invisible Hand" of Floral Chemistry
Suppressive Effect of Multimodal Surface Representation on Ocular Smooth Pursuit of Invisible Hand
The Visible Versus the Invisible Hand - A Tension Inherent in Modern Economies
The Invisible Hand and the Grabbing Hand
A Close Eye on the Invisible Hand
The Contracts of Credit in a Long Term Relationship From the Invisible Hand to the Handshake
Chile's New Entrepreneurs and the "Economic Miracle": The Invisible Hand or a Hand From the State?
The Invisible Hand or Hands Across the Water, American Consultants and Irish Economic-Policy
How Would the Invisible Hand Handle Money
A Helping Hand for the Invisible Hand
Measuring the Speed of the Invisible Hand - The Macroeconomic Costs of Price Rigidity
The Invisible Hand Turns Green - Using Economic Instruments to Conserve the Environment
The Invisible Hand Made Visible, the 'Birth-Mark'
Trembling Invisible Hand Equilibrium
Guiding the Invisible Hand - Economic Liberalism and the State in Latin-American History
The 'Invisible Hand Meets the Dead Hand High Above Washington D.C.'
From the Invisible Hand to the Gladhand - Understanding a Careerist Orientation to Work
Public-Sector Reform - Not So Invisible Hand
Darwin and Paley Meet the Invisible Hand
Economics as Ideology - On Making the Invisible Hand Invisible
The Invisible Hand - Poetics and Narration of Verga, the Novelist
Invisible Hand, Invisible Death
The Invisible Hand Strikes Back - Motor Insurance and the Erosion of Organized Competition in General Insurance, 1920-38
The Creeping Invisible Hand - Entrepreneurial Librarianship
The Speed of the Invisible Hand
From the Invisible Hand to Visible Feet - Anthropological Studies of Migration and Development
Invisible Hand, the Marijuana Business
The Invisible Hand in San Francisco.
The Invisible Hand That Feeds the Cults - Messianic Capitalism
Can an Invisible Hand Palpate the Carotid Pulse
Invisible Hand or Fatherly Hand - Problems of Paternalism in the New Perspective on Health
Palm-Reading the Invisible Hand - A Critical-Examination of Pro-Competitive Reform Proposals
The Market as Messiah: The Invisible Hand Strikes Again.
Federal Legislation and Investment Policy - Far-From-Invisible Hand of Congress and Treasury
Shaking Hands with Invisible Hand - Transitional Strategies for Global Social-Change - Questions and Issues
Invisible Hand and Clenched Fist - Is There a Safe Way to Picket Under First Amendment
Institutional Change and Quasi-Invisible Hand

And, finally:

What's Wrong with Invisible-Hand Explanations?

MJ Ray: Why Are You Distributing Leaflets?

Like all visitors to the Listening to the Social Entrepreneur conference, my pack included a leaflet from a university research centre. Today it popped up on the top of my in-tray while I was making a concerted effort to clear it. The leaflet is a description of the research centre, but it included a web address, so I visited that website. It contained essentially the same information and nothing else. What was the point of that? I already had their contact details in the attendee list. How much did these leaflets cost? In general, it’s a little disappointing when you get a “null pointer” from a private company, but it’s particularly annoying from a university. University mistakes like “technology transfer programmes” (that stop software becoming free software available to social enterprises) are justified by a need to get more money - but clearly this particular university has money to waste. How about others? If there was a way to subscribe to email or blog news of their research publications, I probably would have subscribed. Instead, I’ve just ranted here (without rewarding them with a link) and now I’m going to recycle the flier. I’ll probably have forgotten the three-letter acronym by next week. It’s simply bad marketing. It’s paper spam. Please, if you are putting things into conference handout packs, ask yourself why? What are you hoping to get out of it? How are you going to measure its success?

MJ Ray: Get Safe Online - but no encryption advice

One of the main UK computer security websites (Get Safe Online, GSO, a public/private partnership) has recently changed to using a website for security alerts, instead of sending emails that contained a “secret” word. Of course, a non-SSL website is not really safer or easier to verify than the emails, so I asked them: why don’t you use OpenPGP or GPG, like debian’s excellent security advisories? The reply essentially boils down to “our target audience doesn’t use encryption software and we’re not going to educate them and other countries don’t either.” The encryption instructions on their site consists of an extremely vague explanation and links to a dozen or so other websites, along with insulting open source programs (which is disappointingly usual for GSO). The site is a little better than it was last year, but not much. I think it’s a terrible shame that the gov.uk-supported site is failing to encourage encryption software use. Do you think this stems from a fear of strong encryption making it harder for the public sector to snoop on us? So I guess this falls to the common/civil sector to promote personal security. How could we spread encryption software to the masses? GnuPG and as many mail client plugins as you can find? Icedove/Thunderbird and Enigmail?

Next.

Previous.